I am analyzing some Visual Basic 6.0 malware(before .NET) and I have several questions regarding the internal structure of the format. The samples I have are both
native code compiled(depends on the malware version). In the last couple of days I read Alex Ionescu's paper as well as one other paper on the subject and I have a couple of questions regarding the format. Also, if you have any more resources where I can obtain additional information about the Visual Basic internal structure feel free to post them here.
So the questions are:
ProjectInformationstructure there is a field at offset
lpNativeCode. Based on Alex's paper, the description says
Pointer to .DATA section. When analyzing my samples, I noticed that the following field is
p-codecompiled samples and contains an address for
native codecompiled samples. So, my question is: Is it safe to use the following field to determine if the sample is
ObjectInfostructure there are fields at offsets
p-codecompiled samples I noticed that the
lpMethodsfield points to an array of methods for that object. What I don't understand is the zero bytes that appear before the actual method addresses in the array. To make it more clear I included the following pictures:
The first picture is a dump view of an
ObjectInfo structure while the second picture is the methods array pointed to by
lpMethods field. Notice the 8 zero bytes before the actual method addresses (on some other samples there are more than 8 zero bytes so it's not always that number). What I would like to know is what are those zero bytes?
And finally my last question. In the
PublicObjectDescriptorstructure there is a field at offset
dwMethodCountwith a description of
Number of methods in Object. Also, inside the
ObjectInfostructure there is a field called
wMethodCountand in the
OptionalObjectInfothere are fields called
dwControlCount. What I would like to know is what are the relations between those fields.
I noticed that for
p-codecompiled samples the
PublicObjectDescriptor.dwMethodCountis equal to
ObjectInfo.wMethodCount, while for
native-codecompiled samples the following relation does not stand.