vbdec backstory

Author: David Zimmer
Date: 05.15.24 - 10:40am

so someone was asking why I spent so much time on vbdec, here is a little backstory.

VB6 is my favorite programming language, not because its amazing, it isnt, but because it has the best power to weight ratio and GUI support. I have written about this in other places so wont bore you here.

Reversing VB has always been a chore. I was never happy with existing tools especially around pcode executables. Malware guys love dark alcoves to hide in. I never had time to commit to reversing vb because it didnt pop up that often so always had focus my efforts on things of immediate use.

Basically I would work a full time job, then come home and work a second full time job writing all of the research tools that fill these pages. After ~18 years of that my arms finally threw a hissy fit and I had to take some time off.

During this unpaid leave i decided I wanted a fun research project and circled back to something that had been on my bucket list for 20yrs, namely reversing VB.

Its not something common in malware anymore, but it let me research the inner workings and magic of the language I love. I spent about a year almost full time reversing the runtime, file format, pcode etc. It was fun. Endless types of puzzles to unravel and watch.

vbdec is my magnifying glass into the vb6 file format. Between it and the papers I have published it can reveal pretty much everything I know about vb6.

VBdec gives detailed information dumps and lets you explore pretty much all aspects of the file format. It can also generate detailed IDA scripts to add this information into your idbs. Scripting and command line support also lets you use it as a library to bulk analyze samples and build databases to search. (This was super handy in testing vbdec on large sample sets)

While probably not much use to industry anymore, it was still a great project and a lot of fun to work on. It also uncovered some very interesting aspects of VB6 along the way.

As for now, I am back under employment agreement and can not work on it at the moment. Given that vb reversing is not very common anymore, its probably at its final version. I will probably release it open source some day.

If vbdec has been helpful to you feel free to drop me a line or a comment below, I always enjoy hearing stories about how my tools are helping people.