Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I have a program written in VB6 with a label that is updated every time I push a button:
When I push the "Hourglass" button, the 72 label goes up by 10. How can I find the part of the program that handles this so I can set a breakpoint and examine the assembly?
Also, if the answer involves searching for strings, how would I do it without (in case I have a future program that encrypts strings or something)?
A VB6 program might be compiled to P-Code and come with a P-Code-Interpreter packed into the .exe, or it might be compiled to assembly. How to proceed is very dependent on which of these executables you have:
If you have a P-Code program, all you could ever disassemble is the interpreter, and you won't learn much from tracing the interpreter while it interprets the original program. But fortunately, there are several decompilers which generate more-or-less readable basic from P-code. Check http://www.vb-decompiler.org/products.htm, or one of the decompilers at http://www.program-transformation.org/Transform/VisualBasicDecompilers.
If the program was compiled to machine code, check my answer here, or this one.
As pointed out by @guntram-blohm, you first need to determine if your VB6 target is compiled as P-Code or as native. If it's P-Code, I cannot help. If it's native, what you need to do is known as differential debugging. You can do it without using plugins or external tools directly from IDA.
If by any chance you're running an old version of IDA that lacks that support, you can use MyNav, a tool I wrote for doing differential debugging as a replacement for BinNavi, a tool that you might be able to use if your target is a 32 bits one.
You might also want to take a look to this question: Trace assisted code identification?.
