VBReFormer 6.2 Released with support of Unicode System & +11000 Win32 APIs

I’m delighted to announce that we’ve released VBReFormer 6.2 Professional Edition.

New features and improvements in this release include:

- Support of Windows UNICODE settings & applications in disassembling, decompiling, and editing Visual Basic 5 & 6 applications ;

- Exclusive support of +9000 others Win32 APIs (up to a total of 11 000 APIs) ;

- Support of Left & Right properties for ActiveX / OLE related objects ;

- Support of GUI interface Font properties edition ;

- Improved support of If / Then / Else / End If, Select Case […], and Loop / While statements ;

- Improved support of GUI Code for ActiveX / OLE related objects .

 

This feature also include major fix for issues :

- Fixed issue in saving edited Visual Basic application with UNICODE environment ;

- Fixed issue in recovering executable resource images ;

- Fixed issue in « Options » dialog, taking account of your choice about APIs related decompilation ;

 

- Fixed issue in adding a new property to a GUI object .

New website: Decompiler-VB.Net V3.0 Launch !

I’m very excited to have finally launched the new version of Decompiler-VB.Net website (V3.0) after a full year of development!

Yes, I finally decided to communicate after a long period of development and testing. It’s all been completely re-coded from the ground up, and definitelly yes, the new website is officially up!

Totally renovated and multi-language, it will allow me to fulfill your orders faster, to answer your questions more quickly and it will allow you to track and verify your orders and licenses more easily.

The new website is currently translated in French and English, but we plan to add many other languages. Italian, Spanish, and Chinese language will be soon available.

My goals with the new website were to make it faster, easier to navigate for users, and easier for us to manage and update.

The website will now be updated more regularly to improve your comfort by being clearer and more interactive.

 

Have fun and see you soon !

The truth about P-Code

Introduction

This article has been written to provide a better and essential information to users of decompilers since I got many complaints from customers of others Visual Basic decompilers because their application weren’t recovered by these decompilers.

The reason is, when you write a Visual Basic 6.0 application you may choose a P-Code or Native code compilation, then your application will be compiled to P-Code or Native code which are very different approaches of compilation, so the decompilation will be different too.

There is a question you may absolutely ask yourself when you need a decompiler for a specific application: Is my application compiled into native or P-Code mode ?

The main problem is that a lot of users got a P-Code decompiler in order to decompile their application, but released with Native Code…

In fact, P-Code decompiler are today almost useless because 90% of Visual Basic 6 application are released with Native Code mode. This article will explain first the difference between P-Code and Native code, and then explain why the rate of Native code application is so important compared to P-Code applications. I. P-Code Versus Native Code

When you write a line of code in the IDE, Visual Basic breaks it down into expressions and encodes the expressions into a preliminary format called op-codes. In other words, each line is partially precompiled as it is written. Some lines contain shared information that cannot be precompiled independently (mainly Dim statements and procedure definitions). This is why you have to restart if you change certain lines in break mode. The opcodes are compiled into p-code instructions when you compile (in the background if you have the Compile On Demand and Background Compile options set).

At run time, the p-code interpreter works through the program, decoding and executing p-code instructions. These p-code instructions are smaller than equivalent native code instructions, thus dramatically reducing the size of the executable program. But the system must load the p-code interpreter into memory in addition to the code, and it must decode each instruction.

It’s a different story with native code. You start with the same opcodes, but instead of translating to p-code instructions, the compiler translates to native instructions. Because you’re not going to be expecting an instant response while stepping through native code instructions in the IDE, the compiler can look at code from a greater distance; it can analyze blocks of code and find ways to eliminate inefficiency and duplication. The compiler philosophy is that, since you compile only once, you can take as long as you want to analyze as much code as necessary to generate the best results possible.

These two approaches create a disjunction. How can you guarantee that such different ways of analyzing code will generate the same results? Well, you can’t. In fact, if you look at the Advanced Optimizations dialog box (available from the Compile tab of the Project Properties dialog box) you’ll see a warning: "Enabling the following optimizations might prevent correct execution of your program." This might sound like an admission of failure, but welcome to the real world of compilers. Users of other compiled languages understand that optimization is a bonus. If it works, great. If not, turn it off.

On the other hand, very few developers are going to be used to the idea of working in an interpreter during development but releasing compiled code. Most compilers have a debug mode for fast compiles and a release mode for fast code. Visual Basic doesn’t worry about fast compiles because it has a no-compile mode that is faster than the fastest compiler. You get the best of both worlds, but it’s going to take a little while for people to really trust the compiler to generate code that they can’t easily see and debug.

Source : http://vb.mvps.org/hardcore/html/p-codeversusnativecode.htm II. Proportion of P-Code application in the world

The amount of P-Code developed application is very small compared to Native Code developed application (90% of Visual Basic 6 applications are compiled with Native Code setting -default setting in VB6-), that is one of the reason why I decided to develop VBReFormer more for Native Code than for P-Code.

The massive number of Visual Basic Native application compared to P-Code applications is probably more important due to the fact the default value in the compiler is set up to « Native Code », and of course because native application are almost fast than C++ applications contrary to P-Code applications.

Before choosing a decompiler you must know if it was released for Native application, or for P-Code applications, and if your application was released in P-Code or Native mode.

Note that P-Code is more easy to decompile than Native Code because of it’s high level property.

VBReFormer: CrackMe Sample #1

Now that VBReFormer is a well advanced decompiler for Visual Basic application, I was searching for some unsolved crackmes in order to made sample of decompiling for learning purpose.

The website Crackmes.de contains an impressive number of crackmes applications, a perfect source of samples.

For the first sample of CrackMe solving with VBReFormer Professional I decided to take “Step 2” from yudi (more informations).

I will show you, step by step, how it’s simple to solve the yudi’s Step 2 using VBReFormer Professional.

Running the application:

We can see that a serial is generated using the name of the user.

How the serial is generated? See the following step.

Now we just open the “Step 2.exe” file with VBReFormer Professional and getting the following result:

We will now take a look to the first method loaded on Visual Basic application.

We can see on this capture that the “Label4” visibility is set to False (not visible) at the beginning of the application.

Take a look to that control in the resource editor of VBReFormer and you will agree that it’s the control that show the message “Registered user!”

We now need to know where the “Label4” control visibility is set to true, and what does the “Timer1” control.

The analysis of the Timer1 control is interesting but not very useful for the following of this tutorial.

We can see here that the “Timer1_Timer” function is called every second by “Timer1” control in order to check that no debuggers, and if one is running, to close it.

We can note that it also close any MessageBox windows.

Now we are looking for the code under the “Try” button which check if the key match with the name.

That “Try” button is the “Command1” button in VBReFormer:

Then just look to the Command1_Click() function in order to see the algorithm of key checking:

The algorithm seems a little complicated for newbie, but complete and without any syntax and source code error from VBReFormer.

That’s a great thing for us; we will be able to test the application into the Visual Basic IDE later (to make a key generator for example).

By analyzing the code we can see the following:

Set var_pv2 = Me.Text1() var_pv3 = var_pv2.Text() var_pv10 = (var_pv3) var_pv11 = (Date$) & (" ") var_pv12 = (var_pv11) & (Time$) var_pv13 = (var_pv12)

This part of code is showing us that the key is generated from the Name, but also with the Date and the Time !

That’s meaning it’s almost impossible to generate a key that does not expire the following second.

In order to made the Key Generator, save the project with VBReFormer, and open it with Visual Basic 6.

When it’s opened into the Visual Basic IDE, remove the debugger watching functions and just keep the following:

o Command1_Click

o Command2_Click

Now remove the following conditions block from Command1_Click function:

If (var_num8) Then     var_pv6 = ("Hey")     var_pv7 = ("need something")     var_pv9 = MsgBox(var_pv7, 4160, var_pv6) End If

These block are showing an alert when the “Name” field and when the “Key” field are empty, but it’s not usefull for a keygen.

At the end of the Command1_Click function we can see the serial check condition:

Set var_pv2 = Me.Text2() var_pv3 = var_pv2.Text() var_pv21 = (var_pv3) var_pv22 = ((var_pv19 Like var_pv21)) If (((var_pv22) = (True))) Then     Set var_pv2 = Me.Label4()     var_pv2.Visible() = True End If

That code is checking that the serial (stored in var_pv19 variable) generated from the name with the algorithm is the same than the one entered in the “Serial” field (Text2.Text).

To show the generated serial, we just need to replace that condition block by the following line of code:

You must also remove the following line of code which remove the content of the both fields:

Set var_pv2 = Me.Text1() var_pv2.Text() = "" Set var_pv2 = Me.Text2() var_pv2.Text() = "" Set var_pv2 = Me.Text1()

After all change and simplifications, we have the following keygen code:

Private Sub Command1_Click()     var_pv10 = Text1.Text     var_pv13 = Date$ & " " & Time$     For var_pv14 = 1 To Len(var_pv13) Step 1         If IsNumeric(Mid$(var_pv13, CLng(var_pv14), 1)) Then             var_pv15 = Asc(Mid$(var_pv13, CLng(var_pv14), 1))             If var_pv14 <= Len(var_pv10) Then                 var_pv16 = Str(Asc(Mid$(var_pv10, CLng(var_pv14), 1)))                 var_pv16 = Right$(var_pv16, 1)                 var_pv16 = Val(var_pv16)             End If

            var_pv18 = var_pv18 & Chr$(CLng(var_pv15 + 17 + var_pv16))             var_pv18 = var_pv18 & Chr$(CLng(var_pv15 + 17 + var_pv16 * 2))         End If     Next var_pv14

    For var_pv14 = 1 To 24 Step 4         var_pv19 = var_pv19 & Mid$(var_pv18, CLng(var_pv14), 4) & "-"     Next var_pv14

    var_pv20 = Len(var_pv19) - 1     var_pv19 = Mid$(var_pv19, 1, var_pv20)     Text2.Text = var_pv19 End Sub

We now have to test our keygen:

The first window is the windows of our KeyGen created from the original crackme, and the second window is the one of the original Crackme, with the key from the KeyGen.

The result is that our keygen work perfectly!

Just note that the use of date and time make your key valid for only 1 minute after having generated it.

Is it possible to bypass that limitation?

Yes it is ! In fact, to get the “Registered user!” message you even don’t need a key generator. By reading the code you can see that the operator used to perform a comparison between the both string key is the “Like” operator.

The “like” operator allows to comparate a string and a pattern…

Then you just can set “*” into the serial field and you will have a key which will be valid at anytime, with any name:

 

Source code of the key generator can be downloaded here:

http://www.decompiler-vb.net/documentation/crackmes/step_2.zip

Enjoy it !

VBReFormer: How to alter a Visual Basic 6.0 application

English:

One of the most exiting feature of VBReFormer is design edition mode for binaries Visual Basic applications.

I have done this webcast to show that we can easily edit and alter an executable written with Visual Basic 6 with help of my half-decompiler VBReFormer 2007 Professional Edition.

For more information about VBReFormer: http://www.decompiler-vb.net/.

French:

L'une des plus importante fonction de VBReFormer est la possibilité d'éditer le design de vos applications Visual Basic même une fois compilé.

J'ai donc réalisé ce petit webcast pour montrer que l'on peut facilement éditer un exécutable écrit en Visual Basic 6 avec l'aide de mon semi-décompilateur VBReFormer 2007 Professional Edition.

Pour plus de renseignements à propos de VBReFormer: http://www.decompiler-vb.net/ .

D'ailleurs, pour ceux que la traduction d'applications intéresse, je vous conseille d'aller visiter le site de la communauté des traducteurs francophones (http://www.toutfr.com/) qui est une communauté de passionnés très sympathique .

VBReFormer - Decompiler for Visual Basic
Visual Basic decompiler, VBReFormer VB decompiler, VBReFormer VB decompiler, VBReFormer
VB decompiler, VBReFormer VB decompiler, VBReFormer VB decompiler, VBReFormer
VB decompiler, VBReFormer VB decompiler, VBReFormer VB decompiler, VBReFormer
You lost the source code of your Visual Basic application ?
BLOG | FEED
Read more...

VBReFormer is a powerful and essential recovery tool for Visual Basic application.

Decompiler, disassembler and design editor at the same time, VBReFormer is an essential tool for professionals and companies who work with older versions of their Visual Basic 5/6 applications.

VBReFormer will help you to rewrite your application by recovering all necessary information, design code and partial native Visual Basic code of your application.