I recently stumbled across a binary file built using Sybase PowerBuilder 12.5 and I am looking for any assistance in reversing it as it's actually quite different than a typical C++ binary. I'm especially interested in understanding the file format of the PBD files, which appears to hold most if not all of the content. My goal is to be able to retrieve values for specific variables and do some basic static analysis.
Searching around seems to indicate that this is not a popular type of binary as I could not find much about them, so I'll document my few notes here in hope it helps someone in case I can't go further.
First, the application is launched by a PE as any other, but the PE is mostly empty, it basically calls
FN_RunExecutable from the
PBVM125.dll shipping the program. Within
FN_RunExecutable will initialize the program. This dll appears to be the main library as it exports a lot of functions, a bit similar to the core .NET dll.
At some point, it surely loads data from these PBD files. These PBD files seems to contain names of objects and variables. Names are in Unicode and some of these objects are followed by additional bytes, prefixed with "DAT*":
And here's another example of the contents of a PBD file:
While many of these strings seems to reference a component or a variable, I have failed to find their related values so far. There is a
.db file with the application. Using a hex editor (the database file is not a SQLlite database - I suspect it's some Sybase format), I could not see any of these strings within it. This database file is accessed every time the application is opened.
In any case, if someone with PowerBuilder experience (or anyone) could provide assistance in understanding the PBD file format to extract data from it, it would greatly speed my project.
Consulting the Sybase documentation, PowerBuilder applications are somewhat more akin to .NET. The
PBVM125.dll is actually a virtual machine that interprets PBD files, making the code platform-independent. PBD files are a collection of objects that get executed by the VM. While describing the format of PBL files - that is PDB files with source code - this reference gets me pretty close to my goal. I'll use this information to try to get values out of the files.