VBReFormer 6.4 Released with support of for/next and array-related statements decompilation

As annouced previously, we just release the Free and Professional editions of VBReFormer 6.4.

This new version improve such a lot the decompiler engine and this is one of the most important release I’ve done until now.

The decompiler engine has been improved as it can now perform variable type determination. This means that VBReFormer is now able to guess the type of a variable and argument from its use inside the code.

We also added for/next support, and multi-dimensional array-related statements decompilation.

Example:

Original source code:

Recovered source code:

Lot of other improvement has been made, here is the full details:

New: Improved support of file I/O operation statements:

  • __vbaGetOwner4
  • __vbaGetOwner3
  • __vbaGet3

New: Improved support of error statements:

  • __vbaOnError
  • __vbaResume
  • __vbaGenerateBoundsError

New: Improved support of array-related statements:

  • __vbaAryLock
  • __vbaRedim
  • __vbaRedimPreserve
  • __vbaAryConstruct2

New: Improved support of FOR / NEXT loop-related statements:

  • __vbaForEachAry
  • __vbaNextEachAry
  • __vbaExitEachAry
  • __vbaForEachCollVar
  • __vbaForEachVar
  • __vbaForEachCollAd
  • __vbaNextEachCollVar
  • __vbaNextEachCollAd
  • __vbaExitEachColl
  • __vbaExitEachVar
  • __vbaCyForInit
  • __vbaVarForInit
  • __vbaVarForNext
  • __vbaRaiseEvent
  • __vbaErase

New: Improved support of internal system statements:

  • __vbaSetSystemError
  • __vbaFreeVar
  • __vbaFreeObj
  • __vbaFreeStr
  • __vbaFreeStrList
  • __vbaFreeObjList
  • __vbaFreeVarList

New: Improved support of string statements:

  • rtcCompareBstr
  • rtcInStrChar

New: Other improved statements:

  • __vbaObjIs
  • __vbaStopExe
  • VarPtr

New: support of type consistency at decompilation time, this means that the decompiler engine can now be determinist about variable type

New: Support of OLE, PropertyPage, and UserDocument elements in GUI recovery & edition

New: Support of COM / OLE property edition

vbreformer3

New: New settings windows that allows to:

  • edit colors of source code’s syntax highlighting

vbreformer2

  • choose if you want only Visual Basic, assembly, or both (mixed) differently for viewing and saving
  • choose your own prefix for private method and private variable name
  • load (or not) the project in Visual Basic, or the destination folder once you saved it

vbreformer1

Fixed issue on Import Table use

Fixed issue on Font properties in property editor and GUI edition

Fixed issue on saving settings

Fixed issue on default language setting (French was setup by default, now replaced by English language).

Fixed issue on VBReFormer setup packages for x64 Windows operating system

Fixed issue at loading some ActiveX libraries (“Run-time error 339; Component `MSCOMCT2.OCX or one of its dependencies not correctly registered. “)

Fixed issue on resource viewer

Fixed issue on re-opening a VB6 application / library previously edited with VBReFormer Pro

Fixed issue on resource image preview, export, and replacement

Fixed issue on false negative detection of VBReFormer by antivirus or browsers as malicious software

Fixed “Object not found” exception at opening some executable

Fixed “About” dialog

VBCompTester discontinued: Use VBReFormer Free Edition instead

You all know that Visual Basic 6 allows you to choose between Native Code and P-Code compilation.

Because one of the most recurrent questions of my customers was if VBReFormer Pro will support decompilation of their application, due to the simple fact they don’t know if it was compiled in Native or P-Code, I’ve made a tool called “VBCompTester”, some years ago, which show you if a binary file (.exe, .dll, .ocx, etc.) was compiled using Visual Basic 5 / 6 and with what compilation mode (native or P-Code ?).

I have also made this tools because VBReFormer Free edition was not supporting decompilation at all, while VBReFormer Pro does. Then, you were not able to know, by using the free version, if the Pro one will support your application.

But the past year I decided to make VBReFormer Free and VBReFormer Professional from the same wood in order to give a real idea of VBReFormer Professional capabilities by using the free version.

Then, since June 2014, the both version of VBReFormer, free and pro, have the same features, but limited in the case of the Free edition.

Here are the main limitation of the Free Edition:

decompilation engine will not show name of code-inside object property in Free Edition. It will show something like “Me.[PROPERTY NOT VISIBLE IN FREE EDITION]” or “Me. [METHOD NOT VISIBLE IN FREE EDITION](param1, param2, param3)” in free edition; the feature of edition of GUI interface is not supported in Free Edition.

Since the Free Edition can now be used has a demonstration version of the Professional Edition of VBReFormer, I decided to discontinue the tool VBCompTester.

You can, and I advise you to use VBReFormer Free edition in order to know if your binary is made with Native or PCode option.

If you want to know more about the difference between the both compilation modes, you can read the following article: The truth about Native Code VS P-Code.

See you very very soon with a new version of VBReFormer which is gonna be the most powerful version I have made. 🙂

VBReFormer 6.2 Released with support of Unicode System & +11000 Win32 APIs

I’m delighted to announce that we’ve released VBReFormer 6.2 Professional Edition.

New features and improvements in this release include:

– Support of Windows UNICODE settings & applications in disassembling, decompiling, and editing Visual Basic 5 & 6 applications ;

– Exclusive support of +9000 others Win32 APIs (up to a total of 11 000 APIs) ;

– Support of Left & Right properties for ActiveX / OLE related objects ;

– Support of GUI interface Font properties edition ;

– Improved support of If / Then / Else / End If, Select Case […], and Loop / While statements ;

– Improved support of GUI Code for ActiveX / OLE related objects.

 

This release also include major fix for issues :

– Fixed issue in saving edited Visual Basic application with UNICODE environment ;

– Fixed issue in recovering executable resource images ;

– Fixed issue in « Options » dialog, taking account of your choice about APIs related decompilation ;

– Fixed issue in adding a new property to a GUI object .

VBReFormer: CrackMe Sample #1

Now that VBReFormer is a well advanced decompiler for Visual Basic application, I was searching for some unsolved crackmes in order to made sample of decompiling for learning purpose.

The website Crackmes.de contains an impressive number of crackmes applications, a perfect source of samples.

For the first sample of CrackMe solving with VBReFormer Professional I decided to take “Step 2” from yudi (more informations).

I will show you, step by step, how it’s simple to solve the yudi’s Step 2 using VBReFormer Professional.

  • Running the application:

yudi's Step 2 (CrackMe) / Screenshot 1

We can see that a serial is generated using the name of the user.

How the serial is generated? See the following step.

  • Now we just open the “Step 2.exe” file with VBReFormer Professional and getting the following result:

VBReFormer VB decompiler screenshot 1

  • We will now take a look to the first method loaded on Visual Basic application.

VBReFormer VB decompiler screenshot 2

We can see on this capture that the “Label4” visibility is set to False (not visible) at the beginning of the application.

Take a look to that control in the resource editor of VBReFormer and you will agree that it’s the control that show the message “Registered user!”

VBReFormer VB decompiler screenshot 3

We now need to know where the “Label4” control visibility is set to true, and what does the “Timer1” control.

  • The analysis of the Timer1 control is interesting but not very useful for the following of this tutorial.

VBReFormer VB decompiler screenshot 4

We can see here that the “Timer1_Timer” function is called every second by “Timer1” control in order to check that no debuggers, and if one is running, to close it.

We can note that it also close any MessageBox windows.

  • Now we are looking for the code under the “Try” button which check if the key match with the name.

That “Try” button is the “Command1” button in VBReFormer:

VBReFormer VB decompiler screenshot 5

Then just look to the Command1_Click() function in order to see the algorithm of key checking:

clip_image013

VBReFormer VB decompiler screenshot 6

The algorithm seems a little complicated for newbie, but complete and without any syntax and source code error from VBReFormer.

That’s a great thing for us; we will be able to test the application into the Visual Basic IDE later (to make a key generator for example).

By analyzing the code we can see the following:


 

This part of code is showing us that the key is generated from the Name, but also with the Date and the Time !

That’s meaning it’s almost impossible to generate a key that does not expire the following second.

  • In order to made the Key Generator, save the project with VBReFormer, and open it with Visual Basic 6.

When it’s opened into the Visual Basic IDE, remove the debugger watching functions and just keep the following:

o Command1_Click

o Command2_Click

Now remove the following conditions block from Command1_Click function:


 

These block are showing an alert when the “Name” field and when the “Key” field are empty, but it’s not usefull for a keygen.

At the end of the Command1_Click function we can see the serial check condition:


 

That code is checking that the serial (stored in var_pv19 variable) generated from the name with the algorithm is the same than the one entered in the “Serial” field (Text2.Text).

To show the generated serial, we just need to replace that condition block by the following line of code:

VBReFormer VB decompiler screenshot 7

You must also remove the following line of code which remove the content of the both fields:


 

After all change and simplifications, we have the following keygen code:


 

  • We now have to test our keygen:

yudi's Step 2 (CrackMe) / Screenshot 2

  • The first window is the windows of our KeyGen created from the original crackme, and the second window is the one of the original Crackme, with the key from the KeyGen.

The result is that our keygen work perfectly!

Just note that the use of date and time make your key valid for only 1 minute after having generated it.

Is it possible to bypass that limitation?

Yes it is ! In fact, to get the “Registered user!” message you even don’t need a key generator. By reading the code you can see that the operator used to perform a comparison between the both string key is the “Like” operator.

The “like” operator allows to comparate a string and a pattern…

Then you just can set “*” into the serial field and you will have a key which will be valid at anytime, with any name:

yudi's Step 2 (CrackMe) / Screenshot 3

 

Source code of the key generator can be downloaded here:

http://www.decompiler-vb.net/documentation/crackmes/step_2.zip

Enjoy it !

VBReFormer: How to alter a Visual Basic 6.0 application

One of the most exiting feature of VBReFormer is design edition mode for binaries Visual Basic applications.

I have done this webcast to show that we can easily edit and alter an executable written with Visual Basic 6 with help of my half-decompiler VBReFormer 2007 Professional Edition.

For more information about VBReFormer: http://www.decompiler-vb.net/.

[WEBCAST ERROR]

 

New release: VBReFormer 5.4 Professional

I’m proud to announce the release and availability of VBReFormer Professional 5.4 (for licensed users).

The updated version of VBReFormer can be downloaded from your client account!
http://www.decompiler-vb.net/account.aspx

What’s new in VBReFormer Professional 5.4 ?

1. The analysis engine for disassembling and decompiling has been modified to recover language structure information (in order to decompile If/End If/Do/Loop/While blocks).

Then VBReFormer is now able to decompile simple conditions block like If/End If and Do/Loop/While conditions block.

2. The event name from controls is now back and shown on the code.

3. Conditions with Variant type and floating points type (Single and Double) is now supported because we included lot of news Visual Basic Virtual Machine functions:

__vbaVarTstEq
__vbaVarTstGe
__vbaVarTstGt
__vbaVarTstLe
__vbaVarTstLt
__vbaVarTstNe

4. An important bugfix has been applied. The problem was that VBReFormer sometime crashed on loading application on Windows XP, and was not showing every code from Visual Basic objects (vb6.old library was not properly setup).

5. New preference setting: You can now choose if you want to show only assembly code, only Visual Basic code, or the both.