1

A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString. The application is dynamically generating the values it provides at runtime, so it is not straightforward to identify through static analysis. While I can dump memory of the process and find some of these values, some are not simple strings so not as straightforward to find this way.

I built a test VB6 program and compiled with symbols with code like this:

Private Sub SetConnectionString()
aABCFeeList1.ConnectionString = "Provider=SQLOLEDB;Trusted_Connection=Yes;initial catalog=sql;data source=sqlserver;"
End Sub

In IDA this shows disassembled as:

.text:00401D20 ; void __stdcall Form1::SetConnectionString(Form1 *this)
.text:00401D20 ?SetConnectionString@Form1@@AAGXXZ proc near ; CODE XREF: .text:004016E0j
.text:00401D20
.text:00401D20 var_20          = dword ptr -20h
.text:00401D20 var_18          = dword ptr -18h
.text:00401D20 var_14          = dword ptr -14h
.text:00401D20 var_10          = dword ptr -10h
.text:00401D20 var_8           = dword ptr -8
.text:00401D20 var_4           = dword ptr -4
.text:00401D20 this            = dword ptr  8
.text:00401D20
.text:00401D20                 push    ebp
.text:00401D21                 mov     ebp, esp
.text:00401D23                 sub     esp, 8
.text:00401D26                 push    offset ___vbaExceptHandler
.text:00401D2B                 mov     eax, large fs:0
.text:00401D31                 push    eax
.text:00401D32                 mov     large fs:0, esp
.text:00401D39                 sub     esp, 28h
.text:00401D3C                 push    ebx
.text:00401D3D                 push    esi
.text:00401D3E                 push    edi
.text:00401D3F                 mov     [ebp+var_8], esp
.text:00401D42                 mov     [ebp+var_4], offset dword_4010A0
.text:00401D49                 sub     esp, 10h
.text:00401D4C                 mov     ecx, 8
.text:00401D51                 mov     edx, esp
.text:00401D53                 mov     eax, offset ___vba@09EB2DB8
.text:00401D58                 push    68030012h
.text:00401D5D                 mov     [ebp+var_14], 0
.text:00401D64                 mov     [edx], ecx
.text:00401D66                 mov     ecx, [ebp+var_20]
.text:00401D69                 mov     [edx+4], ecx
.text:00401D6C                 mov     [edx+8], eax
.text:00401D6F                 mov     eax, [ebp+var_18]
.text:00401D72                 mov     [edx+0Ch], eax
.text:00401D75                 mov     eax, [ebp+this]
.text:00401D78                 push    eax
.text:00401D79                 mov     ecx, [eax]
.text:00401D7B                 call    dword ptr [ecx+2FCh]
.text:00401D81                 lea     edx, [ebp+var_14]
.text:00401D84                 push    eax
.text:00401D85                 push    edx
.text:00401D86                 call    ds:__imp____vbaObjSet
.text:00401D8C                 push    eax
.text:00401D8D                 call    ds:__imp____vbaLateIdSt
.text:00401D93                 lea     ecx, [ebp+var_14]
.text:00401D96                 call    ds:__imp____vbaFreeObj
.text:00401D9C                 push    offset loc_401DAE
.text:00401DA1                 jmp     short loc_401DAD
.text:00401DA3 ; ---------------------------------------------------------------------------
.text:00401DA3
.text:00401DA3 loc_401DA3:                             ; DATA XREF: .text:004010ACo
.text:00401DA3                 lea     ecx, [ebp+var_14]
.text:00401DA6                 call    ds:__imp____vbaFreeObj
.text:00401DAC                 retn
.text:00401DAD ; ---------------------------------------------------------------------------
.text:00401DAD
.text:00401DAD loc_401DAD:                             ; CODE XREF: Form1::SetConnectionString(void)+81j
.text:00401DAD                 retn
.text:00401DAE ; ---------------------------------------------------------------------------
.text:00401DAE
.text:00401DAE loc_401DAE:                             ; CODE XREF: Form1::SetConnectionString(void):loc_401DADj
.text:00401DAE                                         ; DATA XREF: Form1::SetConnectionString(void)+7Co
.text:00401DAE                 mov     ecx, [ebp+var_10]
.text:00401DB1                 pop     edi
.text:00401DB2                 pop     esi
.text:00401DB3                 xor     eax, eax
.text:00401DB5                 mov     large fs:0, ecx
.text:00401DBC                 pop     ebx
.text:00401DBD                 mov     esp, ebp
.text:00401DBF                 pop     ebp
.text:00401DC0                 retn    4
.text:00401DC0 ?SetConnectionString@Form1@@AAGXXZ endp

In this case the connection string is being set at line

  .text:00401D53                 mov     eax, offset ___vba@09EB2DB8

My question is how I can identify

1) Which ActiveX control this code is configuring 2) Which property on the ActiveX control it is setting

The program I need to find this in is much larger and more complex.

Some other reference:

dword_4010A0    dd 40004h, 2 dup(0)   

If I could find references to the ActiveX control in question I should be able to configure breakpoints.

I set a breakpoint on module load of the ActiveX control in WinDbg, as I suspect I will need to capture initialization:

0:000> sxe ld FeeList.ocx
0:000> g
ModLoad: 75f50000 75f76000   C:\WINDOWS\SysWOW64\IMM32.DLL
ModLoad: 73cd0000 73cdf000   C:\WINDOWS\SysWOW64\kernel.appcore.dll
ModLoad: 73c10000 73c8c000   C:\WINDOWS\SysWOW64\uxtheme.dll
ModLoad: 5fd70000 5fdf6000   C:\WINDOWS\SysWOW64\SXS.DLL
ModLoad: 74080000 741c3000   C:\WINDOWS\SysWOW64\MSCTF.dll
ModLoad: 704a0000 704c3000   C:\WINDOWS\SysWOW64\dwmapi.dll
ModLoad: 76b70000 76bf3000   C:\WINDOWS\SysWOW64\clbcatq.dll
ModLoad: 615b0000 615cf000   C:\adv2000\FeeList.ocx
eax=00000000 ebx=00800000 ecx=00000000 edx=00000000 esi=007db8d8 edi=007db820
eip=7744ab5c esp=0019e034 ebp=0019e080 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
ntdll!NtMapViewOfSection+0xc:
7744ab5c c22800          ret     28h
0:000> kv
 # ChildEBP RetAddr  Args to Child              
00 0019e030 7741878f 000001cc ffffffff 007db8f0 ntdll!NtMapViewOfSection+0xc (FPO: [10,0,0])
01 0019e080 7741856d 007db820 00000000 007db82c ntdll!LdrpMinimalMapModule+0xa0 (FPO: [Non-Fpo])
02 0019e0a8 77415643 007db820 00000000 007db904 ntdll!LdrpMapDllWithSectionHandle+0x15 (FPO: [Non-Fpo])
03 0019e0f8 7743418c 0019e2f8 007db820 00000000 ntdll!LdrpMapDllNtFileName+0x12f (FPO: [Non-Fpo])
04 0019e228 7743393e 9e745ffd 0019e2f8 0019e2f4 ntdll!LdrpMapDllFullPath+0xbc (FPO: [0,71,4])
05 0019e278 7742aff7 9e745f45 0019e438 0019e4c8 ntdll!LdrpProcessWork+0x10a (FPO: [SEH])
06 0019e2c0 7741a8eb 00000600 00000004 00000000 ntdll!LdrpLoadDllInternal+0x17c (FPO: [SEH])
07 0019e40c 77417d42 00000000 00000001 0019e430 ntdll!LdrpLoadDll+0x93 (FPO: [3,71,4])
08 0019e490 76ee3b58 00002009 0019e4b8 0019e4c8 ntdll!LdrLoadDll+0x92 (FPO: [Non-Fpo])
09 0019e4d4 762192c8 0019e598 00000000 00002008 KERNELBASE!LoadLibraryExW+0x148 (FPO: [Non-Fpo])
0a 0019e4f8 76219245 00002008 0019e560 0019e598 combase!LoadLibraryWithLogging+0x1b (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\common\loadfree.cxx @ 160] 
0b 0019e524 762190a2 0019e558 0019e55c 0019e560 combase!CClassCache::CDllPathEntry::LoadDll+0x50 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\dllcache.cxx @ 2394] 
0c 0019e56c 7621615b 0019e590 007db588 80004005 combase!CClassCache::CDllPathEntry::Create+0x35 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\dllcache.cxx @ 2235] 
0d 0019e7c4 761fd3de 00000001 0019eb3c 0019e814 combase!CClassCache::CClassEntry::CreateDllClassEntry+0xf3 (FPO: [Non-Fpo]) (CONV: thiscall) [onecore\com\combase\objact\dllcache.cxx @ 1070] 
0e 0019eaf4 761b5239 0019eb1c f57d20f9 0019eb28 combase!CClassCache::GetClassObjectActivator+0x52e (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\dllcache.cxx @ 5516] 
0f 0019eb28 761b507a 0019f164 761b4f50 0019f85c combase!CClassCache::GetClassObject+0x30 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\dllcache.cxx @ 5284] 
10 (Inline) -------- -------- -------- -------- combase!CCGetClassObject+0x3d (Inline Function @ 761b507a) (CONV: stdcall) [onecore\com\combase\objact\dllcache.cxx @ 8308] 
11 0019eb94 762088ad 7633b4a4 0019f164 0019f85c combase!CServerContextActivator::GetClassObject+0x12a (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 719] 
12 0019ebd0 7622173b 0019f164 0019f85c 00000000 combase!ActivationPropertiesIn::DelegateGetClassObject+0x8d (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\actprops\actprops.cxx @ 1832] 
13 0019ebf8 76221056 7633b4a8 0019f164 0019f85c combase!CApartmentActivator::GetClassObject+0x6b (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 2089] 
14 0019ec1c 762210d0 7633b4a0 00000001 00000000 combase!CProcessActivator::GCOCallback+0x56 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 1569] 
15 0019ec40 7622115b 7633b4a0 0019ef90 00000000 combase!CProcessActivator::AttemptActivation+0x40 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 1524] 
16 0019ec84 762213aa 7633b4a0 0019ef90 00000000 combase!CProcessActivator::ActivateByContext+0x7b (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 1390] 
17 0019ecb4 762088c0 7633b4a0 0019f164 0019f85c combase!CProcessActivator::GetClassObject+0x6a (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 1213] 
18 0019ecf0 76205907 0019f164 0019f85c 003a0043 combase!ActivationPropertiesIn::DelegateGetClassObject+0xa0 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\actprops\actprops.cxx @ 1832] 
19 0019ef44 7620888d 7633b49c 0019f164 0019f85c combase!CClientContextActivator::GetClassObject+0xd7 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 451] 
1a 0019ef80 76202204 0019f164 0019f85c 76124fa8 combase!ActivationPropertiesIn::DelegateGetClassObject+0x6d (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\actprops\actprops.cxx @ 1884] 
1b 0019f99c 7618cd55 00000000 66030510 00000000 combase!ICoGetClassObject+0x834 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\objact.cxx @ 1341] 
1c 0019fa50 7618cc3e 00000000 66030510 0019fad0 combase!CComActivator::DoGetClassObject+0xef (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\immact.hxx @ 337] 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\SysWOW64\MSVBVM60.DLL - 
1d 0019fa70 66070023 005b5cf4 00000003 00000000 combase!CoGetClassObject+0x4e (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actapi.cxx @ 84] 
WARNING: Stack unwind information not available. Following frames may be wrong.
1e 0019fa9c 66044e26 005b5cf4 00000003 00000000 MSVBVM60!IID_IVbaHost+0x419e3
1f 0019fad4 66045557 0000002d 02392574 66012f70 MSVBVM60!IID_IVbaHost+0x167e6
20 0019fb2c 66048e33 00000001 02392574 0019fb74 MSVBVM60!IID_IVbaHost+0x16f17
21 0019fb3c 6606d2cc 0000002d 02392574 005b5c70 MSVBVM60!IID_IVbaHost+0x1a7f3
22 0019fb74 66032695 02392ccc 02392574 02392b1c MSVBVM60!IID_IVbaHost+0x3ec8c
23 0019fba0 6603291b 024a05bc 0019fbc4 02392ccc MSVBVM60!IID_IVbaHost+0x4055
24 0019fbc8 6603295e 024a05bc 02392574 00000000 MSVBVM60!IID_IVbaHost+0x42db
25 0019fbf8 66032737 024a05bc 02392501 00000000 MSVBVM60!IID_IVbaHost+0x431e
26 0019fc30 660320a5 024a05bc 02392574 02392454 MSVBVM60!IID_IVbaHost+0x40f7
27 0019fc90 66031ead 024a05bc 00000000 00000000 MSVBVM60!IID_IVbaHost+0x3a65
28 0019fcb0 660648d1 024a05bc 005b5f9c 00000000 MSVBVM60!IID_IVbaHost+0x386d
29 0019fd08 6606ff18 0019fd40 00000001 024a05bc MSVBVM60!IID_IVbaHost+0x36291
2a 0019fd44 6601e703 02392454 00000001 00403010 MSVBVM60!IID_IVbaHost+0x418d8
2b 0019fe94 66007b3e 024a05bc 00401358 005b05bc MSVBVM60!Zombie_Release+0xfcaa
2c 0019feb8 66003981 00401358 00000000 00401358 MSVBVM60!BASIC_CLASS_QueryInterface+0xeca
2d 0019fed8 660036fa 00400000 00400000 0040116c MSVBVM60!ThunRTMain+0x3dd
2e 0019fef8 66003600 00000000 00400000 0040116c MSVBVM60!ThunRTMain+0x156
2f 0019ff78 00401176 00401358 75f98484 00321000 MSVBVM60!ThunRTMain+0x5c
30 0019ff94 77443ab8 00321000 9e744259 00000000 fee3!__vbaS+0xa
31 0019ffdc 77443a88 ffffffff 7745f2f4 00000000 ntdll!__RtlUserThreadStart+0x2f (FPO: [SEH])
32 0019ffec 00000000 0040116c 00321000 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.