Results 1 to 4 of 4

Thread: Finding Entry Point for VB6 Program

  1. #1

    Finding Entry Point for VB6 Program

    Hi,

    Analyzing a virus written in VB6.

    Used this: http://www.reteam.org/papers/e46.pdf as a reference to find the entry point of code section (Original Entry Point).

    as mentioned in the PDF referenced above, the StartofCode is surrounded by a signature, E9E9E9 followed by a few 0xCC bytes and then the code and at the end again, 9E9E9E.

    in my case, I get:

    E9E9E9CCCCCCCC9E9E9E

    the code is missing

    here is the code:

    Code:
    E9
    E9
    E9
    E9
    INT3
    INT3
    INT3
    INT3
    INT3
    INT3
    INT3
    INT3
    INT3
    INT3
    INT3
    INT3 <<< code should have started after this point
    9E
    9E
    9E
    9E
    how do I find the entry point in this case so that I can step through the code in debugger?

  2. #2

    As Above

    Why don't you get 'VB Decompiler' and examine the same?

    VB Code is 'generally' not meant to be disassembled, but decompiled.

    Have Phun
    Blame Microsoft, get l337 !!

  3. #3
    I tried to decompile it using DeDe software which is for VB. However, it could not find any Forms and code.

    I am going to try VBDecompiler Lite now.

  4. #4
    <script>alert(0)</script> disavowed's Avatar
    Join Date
    Apr 2002
    Posts
    1,281
    DeDe is for Delphi, not for VB.

Similar Threads

  1. Different Entry Points - IDA and Olly 2.01
    By live_dont_exist in forum The Newbie Forum
    Replies: 8
    Last Post: April 5th, 2012, 09:21
  2. How to change the Disasm Entry?
    By FirefoxXP in forum OllyDbg Support Forums
    Replies: 4
    Last Post: September 27th, 2005, 05:23
  3. Error Entry Point Alert con Olly
    By gallegoortiz in forum OllyDbg Support Forums
    Replies: 1
    Last Post: July 18th, 2005, 10:10
  4. Entry point outside of the code?
    By Zov in forum OllyDbg Support Forums
    Replies: 7
    Last Post: September 29th, 2004, 08:39
  5. Finding Armadillo Entry Point???
    By Bubbleman in forum Advanced Reversing and Programming
    Replies: 8
    Last Post: March 5th, 2001, 18:24

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •