What is BiffView++ (BIFF Command Viewer) and BIFF (Binary Interchange File Format)
BiffView++ as the name suggests is a “BIFF Command Viewer”. BIFF is “Binary Interchange File Format”, which is a format that any XLS (*.xls) file is built on, based on commands. Think of it as a list of BIFF commands (a script) that get executed when you open XLS file and build up the Spreadsheet document inside Excel application.
Affiliate: Experience limitless no-code automation, streamline your workflows, and effortlessly transfer data between apps with Make.com.
XLS format is and old Microsoft Excel format (from 2003 and older) that was exchanged in Microsoft Office 2007 to XLSX format (also DOCX, PPTX, which are Open XML format that is a Zipped set of XML files and objects, which you can extract with 7zip and other ZIP tools). XLS also known as BIFF Binary format and is part of the OLE (Object Linking and Embedding) Microsoft Suite (all the contents are stored in the CFB container – Microsoft Compound File Binary container), which are all the Microsoft Office products from 2003 and older (Excel – XLS, Word – DOC, PowerPoint – PPT).
So, what good is BiffView++ for you? You can use it on XLS files (Microsoft Excel 2003 and older OLE type) to view its BIFF commands, without opening the Excel editor and finding data that might be hidden in the Microsoft Excel editor GUI. These include the Excel 4 Macros from 1992 that became popular lately for Malicious usage by adversaries.
BiffView++ can show you all the BIFF commands that are used in the given XLS and it has also full detailed explanation on what each command do. So, if there’s a hidden Workbook in your XLS or a URL that navigates to a malicious URL, you can see it in the BIFF command list.
BiffView++ was written as part of “Office Binary (DOC, XLS, PPT) to Open XML Translator” by DIaLOGIKa German software house. They were mapping XLS and XLSX and released the BiffViewer as by product for everyone to use.
BiffView++ Usage
1. Download BifView++ from Sourceforge.
*** I believe there’s only one version available there (1.0.0.0) from 2008. Their Open XML translator project wasn’t updated since then.
2. Extract the archive.
3. Execute the “BiffView.exe”.
4. [Browse] for XLS file.
*** Remember that the application only opens the older Excel XLS format files. You will get an error if you try to open the newer Excel XLSX format or anything else. Since only XLS is built on the BIFF commands.
5. Click [Create].
After that BIFF Command Viewer will open your default browser showing you all the BIFF commands (of your XLS) with their binary and hex values. Each command can be clicked and you will see the value of the current command and also all the explanations about this BIFF command.