📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Debuggers  >>  Visual Basic Application

Topic created on: October 13, 2005 16:52 CDT by leadzero .

I need help on how to attack a VB app. The app in question uses a file distibuted with the file as input and I need to figure out how its decoding the file. I know it has to be something very simple (like ROT13 simple). The file shows clear structure and appears to have CR/LF sequences. Analysis of the lines of the file show structure (like every other line for a section beginning with the same string of characters). I'm working on trying to break the encoding, but an easier method would obviously be to debug the app and watch it use the data. However, it's a VB app.

So far I've been unable to find anything on how to debug a VB app. I've done dozens of executables with Olly and IDA but this is the first time I've had to do a VB program. (I'm used to doing virus's and trojans, not spyware!) I attempted to break on every call to OpenFile[AW] and was able to break on the call opening the file in question, but that didn't really help much.

The app in question is adware, everyone hates adware :) any help would be appreciated.

  leadzero     October 13, 2005 16:53.44 CDT
I forgot to add the file is a compiled VB app.

  quig   October 13, 2005 17:56.20 CDT
numega smartcheck is pretty nifty for the task, or write a quick hooker to log the vb runtime character manipulation exports and have it dump the output. If the app is native code this willwork nice, cant remember if pcode uses the exports of the runtime the same way but i would guess so

  MohammadHosein     October 13, 2005 20:26.51 CDT
this may sound crazy but did you test it with a VB decompiler by any chance ? people around say they have lots of successful cases using damn VB apps and easy to use decompilers are freely available around , seems you dont have an unpacking or decrypting challange so a decompilation test for your VB app may help more than reading the data structure

  quig   October 14, 2005 07:41.33 CDT
only vb3 (circa 1995?) has a real decompiler, "decompilers" offered for latter versions, last i checked, are generally only capable of recreating the forms used in the project
check following site for more info

http://vb-decompiler.com/

  smidgeonsoft     October 14, 2005 09:17.54 CDT
If this is a VB6 app, you might want to checkout my debugger, PEBrowse Interactive, at www.smidgeonsoft.com.  A new node will be displayed for VB6 executables called "VB Callbacks."  Under this node will be displayed callbacks into the main executable available to the VB runtime.  Sorry - no decompilation though.

  anonymouse     October 15, 2005 12:35.30 CDT
ther are some decompilers available one is called p32dasm other one is vbdecompiler by gpch may be you could try them and see how they fare

http://vbdecompiler.dotfix.net  < vbdecompiler
p32dasm can be found at kaparos site protools.reverse-engineering.net

but normally i use ollydbg right click use find all sequences type:

sub dword ptr ss:[esp],const
jmp const

and set break point on all refrance and hit f9 :)
that signature mostly is for the call backs from msvbvm dll

  warl0ck     October 20, 2005 02:54.11 CDT
Check out lite from [url]www.vb-decompiler.net[/url]

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit