• Welcome to Valhalla Legends Archive.
 

Visual Basic Disassembling

Started by n00blar, December 18, 2002, 02:23 AM

Previous topic - Next topic

n00blar

I wrote an article on how visual basic assembles functions, It could be useful for disassembling any software made in that language you can check it out here: www27.brinkster.com/WsckVBUpdates/example.html

n00blar

#1
No one interested in this or do you just have nothing to say because your stunned at the article? lol haha =P

iago

#2
Yes, I was speechless.

*looks at it*
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


iago

#3
eeew, no wonder visual basic runs so slowly :-(

This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


n00blar

yea thats kinda huge for just one function with one line of visual basic code huh? =P You should see the error handlers they are huge in a bad way =P

Skywing

#5
For the most part it's not worth trying to translate/understand assembly found in a VB program; in my experience large portions of it tend to be rewritten (interpreted internal opcodes?) by the VM.  The best thing to do is to break on the VM imports, since a VB app will import those for doing literally anything, and they're all so nicely named as to give us hackers clues to what the program is doing ;).

n00blar

QuoteFor the most part it's not worth trying to translate/understand assembly found in a VB program

There are quite a few games comming out now days as a result of TrueVision3D and a few other 3D engines!

Quotein my experience large portions of it tend to be rewritten (interpreted internal opcodes?) by the VM

This simply is not true if its compiled into native code-- however PCode is a totally different matter!

Quotethe VM imports, since a VB app will import those for doing literally anything, and they're all so nicely named as to give us hackers clues to what the program is doing .

I couldn't have said it better myself! However, there are some NoName functions that you have to look at to figure out what they do =P

Skywing

I said that I didn't think it was worth trying to translate the asm because you can learn most everything you need to know by watching the VM imports, not because there's nothing in VB worth cracking, btw.