I am analyzing some Visual Basic 6.0 malware(before .NET) and I have several questions regarding the internal structure of the format. The samples I have are both p-code
or native code
compiled(depends on the malware version). In the last couple of days I read Alex Ionescu's paper as well as one other paper on the subject and I have a couple of questions regarding the format. Also, if you have any more resources where I can obtain additional information about the Visual Basic internal structure feel free to post them here.
So the questions are:
In the
ProjectInformation
structure there is a field at offset0x20
calledlpNativeCode
. Based on Alex's paper, the description saysPointer to .DATA section
. When analyzing my samples, I noticed that the following field is0x0
forp-code
compiled samples and contains an address fornative code
compiled samples. So, my question is: Is it safe to use the following field to determine if the sample isp-code
ornative-code
compiled?Inside the
ObjectInfo
structure there are fields at offsets0x20
and0x24
calledwMethodCount
andlpMethods
. Forp-code
compiled samples I noticed that thelpMethods
field points to an array of methods for that object. What I don't understand is the zero bytes that appear before the actual method addresses in the array. To make it more clear I included the following pictures:
The first picture is a dump view of an ObjectInfo
structure while the second picture is the methods array pointed to by lpMethods
field. Notice the 8 zero bytes before the actual method addresses (on some other samples there are more than 8 zero bytes so it's not always that number). What I would like to know is what are those zero bytes?
And finally my last question. In the
PublicObjectDescriptor
structure there is a field at offset0x1C
calleddwMethodCount
with a description ofNumber of methods in Object
. Also, inside theObjectInfo
structure there is a field calledwMethodCount
and in theOptionalObjectInfo
there are fields calledwEventCount
anddwControlCount
. What I would like to know is what are the relations between those fields.I noticed that for
p-code
compiled samples thePublicObjectDescriptor.dwMethodCount
is equal toObjectInfo.wMethodCount
, while fornative-code
compiled samples the following relation does not stand.