ASR Rule - Block Win32 API Calls from Office Macro

Occasional Contributor

What does this ASR rule really do ?
This question because we see that not only Win32 API Calls are blocked but also x64.
During tests, we used an Excel 64-bit with VBA-code.

First test was VBA-code written in 32-bit.
As example: 
Private Declare Function GetTimeZoneInformation Lib "kernel32" ( _
lpTimeZoneInformation As TIME_ZONE_INFORMATION) As Long

2nd test was same VBA-code but written in 64-bit.
As example:
Private Declare PtrSafe Function GetTimeZoneInformation Lib "Kernel32" ( _
lpTimeZoneInformation As TIME_ZONE_INFORMATION) As LongPtr

 

Both are given the same result.
We can't open the excel.
It is given the message 'Excel cannot access file.xlsm. The document may be read-only or encrypted.'

If we change the ASR rule from Blocked to Not Configured. XLSM is perfectly going open.

0 Replies