16

Alex Ionescu, co-author of the latest "Windows Internals" book and contributor to ReactOS, wrote a good paper on the topic of VB decompilation quite a while ago. Here the direct link to the PDF (originally from http://www.alex-ionescu.com/vb.pdf). The paper documents the structures and constants of the file format itself and probably goes a long way in ...


12

They are some tools can be useful in reversing p-code binary vb-decompiler lite (free ver): very good decompiler can be download from vb-decompiler official site P32Dasm: another p-code decompiler see here and see below of page how they debug p-code with IDA WKTVBDE: p-code debugger, I don't work with it but good to try, to download search tuts4you.com ...


9

Your program is not packed, but rather compiled as Visual Basic P-code or Visual Basic native code. If it's VB native code, you can use your favorite debugger (OllyDbg, IDA, etc.) to debug it, and IDA to disassemble it. If it's VB P-code, you can use VB Decompiler Pro to disassemble/decompile it: ... and WKTVBDE to debug it: Note that VB Decompiler Pro ...


6

A very comprehensive resource on the p-code was on the site of vb vb-decompiler. Luckily there is a backup in the wayback machine, link here: http://web.archive.org/web/20101127044116/http://vb-decompiler.com/pcode/opcodes.php?t=1


6

Edit: The encryption is Bitwise XOR with the key 0x04 (see the bottom of this answer) The application uses a simple Substitution Cipher (Or, to be exact Caesar Cipher with shift 4) and then perform reverse() on the function. We can domnstrate it using python's maketrans method: The method maketrans() returns a translation table that maps each ...


4

Based on your examples, it looks like the strings are reversed and each byte is XORed with the byte 4. Here's a quick Perl one-liner to demonstrate this: perl -lne 'print reverse($_) ^ ("\x04" x length($_))' and what happens when you apply it to your test strings: $ cat test.txt AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz 1234567890 1 2 123 ? ...


4

Here are the two best free and available resources about Microsoft's VB P-Code. First one, the list of opcodes (here). Second one, a 12 pages document written by Alex Ionescu on how to decompile and analyze VB binaries (here).


3

This is probably P-code compiled file, not native code. Try WKT Debugger: http://www.woodmann.com/collaborative/tools/index.php/Whiskey_Kon_Tequilla_VB_P-Code_Debugger


2

Yes, it is possible! You'll have to do some trial and error for positioning though. Adding in a new control is fairly easy. We essentially need to do what the designer usually automatically does for us and create the new control and set up its properties ourselves. Luckily, we can use the button that's already there as a template. First order of business ...


2

Use a dedicated VB decompiler - you can find links to few of them on StackOverflow. VB programs has a special format that is quite easy to understand - http://reteam.org/papers/e46.pdf


2

VB Decompiler Pro decompiles VB P-Code to Visual Basic code. See below for an example of the decompilation output: Alternatively, if you're looking for help in analyzing the raw P-Code itself, you can check out the following links in addition to the links that yaspr posted: VB P-code Information by Mr Silver Info about P-code


1

As i commmented vb has its own set of functions the fuction you have to look for in the 3rd crackme are rtcMidCharVar() vbastrvarval() , rtcAnsiValueBstr() _vbavarmul() the algo loops over the name characters adds a constant to each multiplies the result with another variable and adds up all of them that is your serial if you give the right serial you ...


1

disclaimer: Since the VB file structure is still undocumented, we cannot provide guaranteed answers without fully reverse engineering the format. This has been attempted to some success by Ionescu and others as you and others have mentioned. I will attempt to answer your questions to the best of my ability without opening any reverse engineering tools. If ...


1

I had a look at the program you mentioned and the compilation means only packaging, so decompilation is always possible. The format of the file seems to be very simple, so if you want you can reverse it easily. However you can insert the decompilation flag into the meta.ini with a hex editor for example in the following way: Open the file in your preferred ...


1

So, I assume I need to decompile this dll too. As Guntram said, no, you don't need to decompile the VBX files. So, it decompiled fine to mak, frm and bas files. I compiled the program again in Visual Basic 4, after correcting some syntax problems, but I get a totally non-interactive window in which none of the buttons work. The window's form is defined ...


1

Large exe files are primarily due to large amounts of embedded data. Embedded data may mean binary resources and/or overlay. Large file sizes can also be due to static linking. If it is due to overlay then you may try to strip the overlay using any decent PE editor such as exeinfo pe and then try to load it in Ollydbg to do an analysis. However the exe will ...


1

http://web.archive.org/web/20071020232030/http://www.alex-ionescu.com/vb.pdf [more chars ftw][more chars ftw]


Only top voted, non community-wiki answers of a minimum length are eligible