1

I am a beginner and I am doing a few crackme stuff, I'm pretty okay when it comes to system calls such as user32.

But there is one crackme which uses msvbvm50.dll (Visual Basic) and it has weird calls, I just cannot find information about it. I tried API monitoring, but I cannot locate the field which is taking the input from the user.

I tried to disassemble using a VB decompiler, I see similar assembly to which I saw in Immunity debugger.

In this crackme challenge, I need to find the function which is taking my input further in the memory.

How can I do that? Any ideas how I should proceed?

Improve this question
1
  • vb has its own set of apis look for __vbastrcmp , rtcInputox kinda functions
    – blabb
    Commented Jul 1, 2017 at 16:38

2 Answers 2

Reset to default
2

Use a dedicated VB decompiler - you can find links to few of them on StackOverflow.

VB programs has a special format that is quite easy to understand - http://reteam.org/papers/e46.pdf

Improve this answer
5
  • Thanks a alot. Just one query here. even immunity debugger can reverse VB, how is this gonna be better ?
    – Atply
    Commented Jul 1, 2017 at 15:35
  • hard to tell as I don't know what crackme you want to RE, but specialized VB decompilers can show you the UI and with a simple double click navigate to the code that handles the button or the input
    – Paweł Łukasik
    Commented Jul 1, 2017 at 17:53
  • It's from a URL rogerfm.net/challenge/crackme. I've cracked the first two. Actually also the third one. So the challenge is to find the serial number , which when entered gives the password , but I got the password by changing the program flow . I still couldn't find the serial key.
    – Atply
    Commented Jul 1, 2017 at 17:57
  • @Atply I think that blabb already showed how to approch those apps
    – Paweł Łukasik
    Commented Jul 2, 2017 at 5:46
  • Thanks a lot for your assistance Pawel Lukasik . Really appreciate it.
    – Atply
    Commented Jul 2, 2017 at 9:50
1

As i commmented vb has its own set of functions
the fuction you have to look for in the 3rd crackme are
rtcMidCharVar()
vbastrvarval() ,
rtcAnsiValueBstr()
_vbavarmul()

the algo loops over the name characters
adds a constant to each
multiplies the result with another variable
and adds up all of them that is your serial
if you give the right serial you get a msgbox with password axxxxxxo

a simple keygen in powershell can look like 

 $b =0;$a = SOMECONSTANT;@('d','u','g','g') | % { $c= (([int][char]$_ + SOMEOTHERCONSTANT) * AVARIABLE);($b+=$c) };$b

enter image description here

edit ,

vb does not use registers mostly

it uses a VARIANT structure for almost all functions and uses stack

if you use windbg you can take a look at the structure with

dt ole32!VARIANT

basically it is a ten byte long structure consisting of an union 

0:000> dt -v ole32!Variant
struct tagVARIANT, 50 elements, 0x10 bytes

the first member vt (SHORT int2b) indicates the variant type
(find Wtypes.h and look for 

enum VARENUM
    {
        VT_EMPTY    = 0,
        VT_NULL = 1,
        VT_I2   = 2,
        VT_I4   = 3,

the next 3 SHORTS are reserved
the value at 0x08 is to deciphered based on the value of vt member
the member at 0x0c is pRecInfo
the member at 0x10 is tagDec an array

now that part is clear the function __vbaVarMul Takes three Arguments of type VARIANT

the first is the result the second is multiplier the third is multiplicand

here is a redacted windbg output for char 'd'

0:000> ? poi(@esp)
Evaluate expression: 1241928 = 0012f348
0:000> ? poi(@esp+4)
Evaluate expression: 1241944 = 0012f358
0:000> ? poi(@esp+8)
Evaluate expression: 1241880 = 0012f318
0:000> dt ole32!Variant vt poi(@esp)
   +0x000 vt : 0  <---- vb NULL / v_EMPTY
0:000> dt ole32!Variant vt poi(@esp+4)
   +0x000 vt : 3 <-------vbLong 
0:000> dt ole32!Variant vt poi(@esp+8)
   +0x000 vt : 2  <-----vbInt

0:000> .enable_long_status 1

0:000> dt ole32!Variant lVal poi(@esp)
   +0x008 lVal : 0x12f3f0
0:000> dt ole32!Variant lVal poi(@esp+4)
   +0x008 lVal : 0xxx
0:000> dt ole32!Variant lVal poi(@esp+8)
   +0x008 lVal : 0xxxx
0:000> ? 'd' + xxx
Evaluate expression: xxxx = 00000xxx
Improve this answer
2
  • Wow. That's awesome. I remember seeing a function similar to this. Let see if I can remember it right as I don't have a pc next to me. So there was a loop and there were two exit points. One was the overflow which was handled by the DLL itself. And the other was a jz after a test instructions. The place I was stuck was because a function called vbavarfornext was changing the vales or eax, ebx and edx registers. And because of which this jz jump was being taken.. is there any document which tells me the details of which registers will be modified?
    – Atply
    Commented Jul 2, 2017 at 10:06
  • edited my answer to add some infor about vb Arguments take a look
    – blabb
    Commented Jul 2, 2017 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.