Reverse Engineering Windows PowerBuilder Binaries

Question

I recently stumbled across a binary file built using Sybase PowerBuilder 12.5 and I am looking for any assistance in reversing it as it's actually quite different than a typical C++ binary. I'm especially interested in understanding the file format of the PBD files, which appears to hold most if not all of the content. My goal is to be able to retrieve values for specific variables and do some basic static analysis.

Searching around seems to indicate that this is not a popular type of binary as I could not find much about them, so I'll document my few notes here in hope it helps someone in case I can't go further.

First, the application is launched by a PE as any other, but the PE is mostly empty, it basically calls FN_RunExecutable from the PBVM125.dll shipping the program. Within PBVM125.dll, FN_RunExecutable will initialize the program. This dll appears to be the main library as it exports a lot of functions, a bit similar to the core .NET dll.

At some point, it surely loads data from these PBD files. These PBD files seems to contain names of objects and variables. Names are in Unicode and some of these objects are followed by additional bytes, prefixed with "DAT*":

And here's another example of the contents of a PBD file:

While many of these strings seems to reference a component or a variable, I have failed to find their related values so far. There is a .db file with the application. Using a hex editor (the database file is not a SQLlite database - I suspect it's some Sybase format), I could not see any of these strings within it. This database file is accessed every time the application is opened.

In any case, if someone with PowerBuilder experience (or anyone) could provide assistance in understanding the PBD file format to extract data from it, it would greatly speed my project.

Thanks,

Update 1: Consulting the Sybase documentation, PowerBuilder applications are somewhat more akin to .NET. The PBVM125.dll is actually a virtual machine that interprets PBD files, making the code platform-independent. PBD files are a collection of objects that get executed by the VM. While describing the format of PBL files - that is PDB files with source code - this reference gets me pretty close to my goal. I'll use this information to try to get values out of the files.

Answer 1

I'm especially interested in understanding the file format of the PBD files, which appears to hold most if not all of the content. My goal is to be able to retrieve values for specific variables and do some basic static analysis.

You can think of PowerBuilder as another Java (for PB Classic, since PB10 or PB11, there is also a version of PowerBuilder that can produce .Net assemblies - I will only talk of PB Classic), as the source is compiled into bytecode that is run by a VM located in PBVMxxx.dll (replace xxx by the PB version, like 90, 100 or 125). There used to have Mac, Solaris or AIX VMs, but nowadays only the windows VM remains.

Each PB object (structure, window, visual or non visual object, menu, ...) is compiled into a corresponding binary like a .java is compiled into a .class that keeps an extension telling its nature (e.g. object .sro -> .obj, menu srm -> .mnu, structure srt -> str, ...) and all the objects are stored into a .pbd file (when using the development environment, you are using instead .pbl (=PB library) that also contains the source code "files").

.pbl and .pbd files have both the same tree stucture, including a directory of contained files, and a linked-list of data blocks. It looks like a game resource file for old-timers. :o)

Neither the class format nor the library are officially documented, but the library structure has been reversed and published. Based on this I did a dumper that can extract the contained objects.

I did not finished a work-in-progress on the reversing of the class format, but you can note that it keeps variable and object names, along statement line numbers, thus it is possible to retreive a quasi identical source code from compiled bytecode (you only loose the comments) and I already seen some chinese commercial decompilers.