VB6 TypeInfo


Author: David Zimmer
Date: 10.06.22 - 5:59pm



So I am on the hunt for type info for private classes.

Someone asked about getting the function offset for a private class function which would be a COM Vtable. VB6 objects all support IDispatch which means they support IDispatch.GetIdsOfName so at least the method names, dispatchID, and vtable layout must be available for dynamic lookup and execution.

Technically using ITypeInfo you can query the layout and get all the information you need. You can find a sample project here. A C++ implementation to dump entire function prototypes is here.

So If you load a vb6 COM object from an ActiveX dll the ITypeInfo implementation comes from oleaut32.dll and is based on the full type library compiled into the dll.

When you are running your code in the vb6 IDE, you get a full ITypeInfo interface from vba6.dll

However when you are running a compiled exe, with an internal private vb6 class, now you get a partial ITypeInfo implementation from msvbvm60.dll. And guess what..IType->GetTypeAttr and GetFuncDesc return not implemented. Awesome.

Sooo now what? The information is still in there I promise you, they just havent exposed it. So now we would have to reach into some internal structures if we want it.

There is another way. This clever code actually returns a fake COM object that the compiler believes is the expected internal type. The ASM thunk will calculate what offset in its fake vtable was called by the compiler for the desired method and reveal it to you. Its cool, but intricate.

Honestly I dont even want to use callbacks from class function pointers. VB6 creators didnt want us to. It can be done but your out in unsupported land.

The real reason I want to explore this information is to make vbdec disassembler better and get the type info for it.

So I started digging. I saw that p32Dasm can show eventnames,args and private class function names/args. I knew it had to be tied to IDisp type information buried in the binary. If you search for known test strings you will find them. But how to find the links within the binary structures.

Since they are type info, we can catch their access in a debugger if you are using IDispatch such as through the vb6 callbyname function.

Turns out they are linked through sub structures below CodeObject.ObjInfo.PrivateObj I still have some more digging to do to understand all the variations and field meanings but it is a fun puzzle anyway.

In other news, I added a new node to the vbdec treeview for IDC Structs. This node will generate all of the main structures for vb internal types, and then set the appropriate offsets as that structure type so you can walk them all visually in IDA and explore them. Only took about 6hrs labor which is great. It will be a huge help when exploring disassemblies. I will release an update tonight or tomorrow.

In other news part 2. when calling add_struc_member IDC function..I wanted some of the fields to show as offsets to other structures instead of just 32bit numbers. This allows IDA to pull in any sub structure names set at that address. The docs are not helpful. Google didnt help much either.

I did find one great post though. So if you manually alter a structure to set the member type exactly as you want it through the UI which supports a ton of variations. Then you can dump the types to IDC and voila you get the magical IDC constants you need to replicate the output. I Thanks buddy your a god send!

Thats it for this post. over and out.




Comments: (1)

On 10.31.22 - 2:04pm Dave wrote:
I ended up releasing a new article on this.

 
Leave Comment:
Name:
Email: (not shown)
Message: (Required)
Math Question: 29 + 56 = ? followed by the letter: U 



About Me
More Blogs
Main Site
Posts: (year)
2023 (3)
     PublicBytes struct
     DispCallFunc
     VB6 Class Instances
2022 (6)
     VB6 Implements
     vbdec remote scripting
     VB6 Stubs BS
     VB6 TypeInfo
     VB6 VTable Layout
     Yara isPCode rule
2021 (4)
     VB6 Hijacking
     rtcTypeName
     VB6 Gosub
     VB App object
2020 (6)
     AutoIT versions
     IDA JScript 2
     Using VB6 Obj files from C
     Vb6 PCode Internals
     Yara Corrupt Imports
     Yara Undefined values
2019 (6)
     Yara WorkBench
     SafeArrayGetVartype
     vb6 API and call backs
     PrintFile
     ImpAdCallNonVirt
     UConnect Disable Cell Modem
2017 (5)
     IDA python over IPC
     dns wildcard blocking
     64bit IDA Plugins
     anterior lines
     misc news/updates
2016 (4)
     KANAL Mod
     Decoders again
     CDO.Message Breakpoints
     SysAnalyzer Updates
2015 (6)
     SysAnalyzer and Site Updates
     crazy decoder
     ida js w/dbg
     flash patching #2
     JS Graphing
     packet reassembly
2014 (5)
     Delphi IDA Plugin
     scdbg IDA integration
     API Hash Database
     Winmerge plugin
     IDACompare Updates
2013 (9)
     Guest Post @ hexblog
     TCP Stream Reassembly
     SysAnalyzer Updates
     Apilogger Video
     Shellcode2Exe trainer
     scdbg updates
     IDA Javascript w/IDE
     Rop Analysis II
     scdbg vrs ROP
2012 (13)
     flash patching
     x64 Hooks
     micro hook
     jmp api+5 *2
     SysAnalyzer Updates
     InjDll runtime config
     C# Asm/Dsm Library
     Shellcode Hook Detection
     Updates II
     findDll
     Java Hacking
     Windows 8
     Win7 x64
2011 (19)
     Graphing ideas
     .Net Hacking
     Old iDefense Releases
     BootLoaders
     hll shellcode
     ActionScript Tips
     -patch fu
     scdbg ordinal lookup
     scdbg -api mode
     Peb Module Lists
     scdbg vrs Process Injection
     GetProcAddress Scanner
     scdbg fopen mode
     scdbg findsc mode
     scdbg MemMonitor
     demo shellcodes
     scdbg download
     api hashs redux
     Api hash gen
2010 (11)
     Retro XSS Chat Codes
     Exe as DLL
     Olly Plugins
     Debugging Explorer
     Attach to hidden process
     JS Refactoring
     Asm and Shellcode in CSharp
     Fancy Return Address
     PDF Stream Dumper
     Malcode Call API by Hash
     WinDbg Cheat Sheet
2009 (1)
     GPG Automation