I am a beginner and I am doing a few crackme stuff, I'm pretty okay when it comes to system calls such as user32.

But there is one crackme which uses msvbvm50.dll (Visual Basic) and it has weird calls, I just cannot find information about it. I tried API monitoring, but I cannot locate the field which is taking the input from the user.

I tried to disassemble using a VB decompiler, I see similar assembly to which I saw in Immunity debugger.

In this crackme challenge, I need to find the function which is taking my input further in the memory.

How can I do that? Any ideas how I should proceed?

  • vb has its own set of apis look for __vbastrcmp , rtcInputox kinda functions
    – blabb
    Jul 1 '17 at 16:38

Use a dedicated VB decompiler - you can find links to few of them on StackOverflow.

VB programs has a special format that is quite easy to understand - http://reteam.org/papers/e46.pdf

  • Thanks a alot. Just one query here. even immunity debugger can reverse VB, how is this gonna be better ?
    – Atply
    Jul 1 '17 at 15:35
  • hard to tell as I don't know what crackme you want to RE, but specialized VB decompilers can show you the UI and with a simple double click navigate to the code that handles the button or the input Jul 1 '17 at 17:53
  • It's from a URL rogerfm.net/challenge/crackme. I've cracked the first two. Actually also the third one. So the challenge is to find the serial number , which when entered gives the password , but I got the password by changing the program flow . I still couldn't find the serial key.
    – Atply
    Jul 1 '17 at 17:57
  • @Atply I think that blabb already showed how to approch those apps Jul 2 '17 at 5:46
  • Thanks a lot for your assistance Pawel Lukasik . Really appreciate it.
    – Atply
    Jul 2 '17 at 9:50

As i commmented vb has its own set of functions
the fuction you have to look for in the 3rd crackme are
vbastrvarval() ,

the algo loops over the name characters
adds a constant to each
multiplies the result with another variable
and adds up all of them that is your serial
if you give the right serial you get a msgbox with password axxxxxxo

a simple keygen in powershell can look like

 $b =0;$a = SOMECONSTANT;@('d','u','g','g') | % { $c= (([int][char]$_ + SOMEOTHERCONSTANT) * AVARIABLE);($b+=$c) };$b

enter image description here

edit ,

vb does not use registers mostly

it uses a VARIANT structure for almost all functions and uses stack

if you use windbg you can take a look at the structure with

dt ole32!VARIANT

basically it is a ten byte long structure consisting of an union

0:000> dt -v ole32!Variant
struct tagVARIANT, 50 elements, 0x10 bytes  

the first member vt (SHORT int2b) indicates the variant type
(find Wtypes.h and look for

        VT_EMPTY    = 0,
        VT_NULL = 1,
        VT_I2   = 2,
        VT_I4   = 3,

the next 3 SHORTS are reserved
the value at 0x08 is to deciphered based on the value of vt member
the member at 0x0c is pRecInfo
the member at 0x10 is tagDec an array

now that part is clear the function __vbaVarMul Takes three Arguments of type VARIANT

the first is the result the second is multiplier the third is multiplicand

here is a redacted windbg output for char 'd'

0:000> ? poi(@esp)
Evaluate expression: 1241928 = 0012f348
0:000> ? poi(@esp+4)
Evaluate expression: 1241944 = 0012f358
0:000> ? poi(@esp+8)
Evaluate expression: 1241880 = 0012f318
0:000> dt ole32!Variant vt poi(@esp)
   +0x000 vt : 0  <---- vb NULL / v_EMPTY
0:000> dt ole32!Variant vt poi(@esp+4)
   +0x000 vt : 3 <-------vbLong 
0:000> dt ole32!Variant vt poi(@esp+8)
   +0x000 vt : 2  <-----vbInt

0:000> .enable_long_status 1

0:000> dt ole32!Variant lVal poi(@esp)
   +0x008 lVal : 0x12f3f0
0:000> dt ole32!Variant lVal poi(@esp+4)
   +0x008 lVal : 0xxx
0:000> dt ole32!Variant lVal poi(@esp+8)
   +0x008 lVal : 0xxxx
0:000> ? 'd' + xxx
Evaluate expression: xxxx = 00000xxx
  • Wow. That's awesome. I remember seeing a function similar to this. Let see if I can remember it right as I don't have a pc next to me. So there was a loop and there were two exit points. One was the overflow which was handled by the DLL itself. And the other was a jz after a test instructions. The place I was stuck was because a function called vbavarfornext was changing the vales or eax, ebx and edx registers. And because of which this jz jump was being taken.. is there any document which tells me the details of which registers will be modified?
    – Atply
    Jul 2 '17 at 10:06
  • edited my answer to add some infor about vb Arguments take a look
    – blabb
    Jul 2 '17 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.