2

I'm reverse engineering a Visual Basic application and I've run into a big of a sticky situation, so I was hoping that someone might have an opinion on a way to approach it. It's basically a crackme but I haven't been able to nail down where the callback code is for the function I'm looking for. I've found the labels and captions but I was hoping for an intelligent way to start looking at the binary instead of crawling through it from top to bottom until I find the right comparison.

I've taken a look at the output of VB Decompiler but the output isn't matching up to what I'm used to.

here's the output from VB Decompiler

In other VB apps it seems like the locations given there is enough to get started and find the callbacks, but not with this one: this is what I get when trying to find any of the actual code.

I thought at first the code was just being rendered poorly in the debugger but after playing around with it I don't think that location is correct at all. So I'm looking for ideas on where to go from here.

Thanks.

1 Answer 1

3

This is probably P-code compiled file, not native code. Try WKT Debugger:

http://www.woodmann.com/collaborative/tools/index.php/Whiskey_Kon_Tequilla_VB_P-Code_Debugger

2
  • This gives me an error whenever I try to run it about missing DLLs. I couldn't find copies online and I saw something about the debugger only erroring out if the application isn't pcode compiled?
    – Fewmitz
    Commented Aug 21, 2013 at 18:52
  • I take what I said before back. I must have had a corrupt download the first time around or something. I tried again and that gave me enough information to get what I was looking for.
    – Fewmitz
    Commented Aug 22, 2013 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.