Understand VB6 disassemble code

问题

I have an old VB executable that has been used for a long time in my project. The current implementation of the application contains a debug window that's not needed any more.

Of course, the source code was lost and can not be modified. My idea is to modify the HEX code of the instance that's opening the annoying debug window.

For that purpose, I use VB Decompiler by DotFix software, and I suppose that I found the code responsible for that instance. Unfortunately, I can't understand how it works.

Let's see the disassemble code:

  loc_8F420C: var_8A = 0
  loc_8F4219: If (Len(var_88) = &H30) Then
  loc_8F4225:   Call {3014B1BF-8A2C-23D7-B50400C24F280C20}.Method_arg_12 (var_88)
  loc_8F4233:   Call {3014B1BF-8A2C-23D7-B50400C24F280C20}.Method_arg_16 (var_108)
  loc_8F423D:   If CBool(var_108) Then
  loc_8F424D:     Me.Global.Unload Me
  loc_8F4258:   Else
  loc_8F425A:     var_8A = &HFF    
                  ...
  loc_8F43B0:   End If
  loc_8F43B3: Else

At the first sight var_108 seems a bool variable that is the one setting the debug window. Can I implicitly put in loc_8F423D: If CBool(false/true) Then to stop this window from launching?

Can anyone explain to me what are those Call {#######-####-####-################}.Method_arg_## from above?

PEiD detect compiler:
Microsoft Visual Basic 5.0 / 6.0 [Overlay]

Part 2: It took me a long time to get the new idea - the right one, possibly. Let's take a look at the assembly code:

004F420C: 70   FStI2 var_8A <- loc_8F420C: var_8A = 0

Looks like loc_8F4219: If (Len(var_88) = &H30) Then

004F420F: 6C   ILdRf var_88
004F4212: 4A   FnLenStr Len()
004F4213: F5   LitI4: 48 (0x30)

Let's find the next code snippets:

004F4218: C7   EqI4 =
004F4219: 1C   BranchF 004F43B3

Our Call methods looks like :

004F421C: 6C   ILdRf var_88 < - (var_88) from Call
004F421F: 22   ImpAdLdPr
004F4222: 58   MemLdPr
004F4225: 0D   VCallHresult  var_88.vtable[12] <- Method_arg_12
004F422A: 04   FLdRfVar var_108 <- (var_108) possible CALL/BACK
004F422D: 22   ImpAdLdPr
004F4230: 58   MemLdPr
004F4233: 0D   VCallHresult  var_108.vtable[16] <- Method_arg_16
004F4238: 6C   ILdRf var_108 <- (var_108) 70% sure is RESPONSE(true/false)

And now the most interesting parts of that annoying P-Code&Assembly, we find the if instance that verifies if the Debug Windows is needed. If we look at P-Code we can see that if has the form:

loc_8F423D:   If CBool(var_108) Then
loc_8F424D:     Me.Global.Unload Me
loc_8F4258:   Else
loc_8F425A:     var_8A = &HFF

And now look at the Address - if is true execute address 00F424D / 8F424D else jump outside to 004F4258

004F423B: FC52 CBoolI4
004F423D: 1C   BranchF 004F4258
004F4240: 6C   ILdRf param_8
004F4243: FD9C FStAdNoPop
004F4247: 05   ImpAdLdRf
004F424A: 24   NewIfNullPr GLOBAL
004F424D: 0D   VCallHresult Global._Unload(object As IDispatch)
004F4252: 1A   FFree1Ad var_90
004F4255: 1E   Branch 004F43B0
004F4258: loc_004F423D
004F4258: F4   LitI2_Byte: 255 (True)

Possibly, if I change the 004F423D: 1C BranchF 004F4258 so that it points to another address 004F424D, logically that might do the trick.

004F423D: 1C BranchF 004F424D

Now I'm trying to find that address with OllyDbg - to test if that helps. If I succeed I will write part 3.

Does anyone have some other ideas?

来源：https://stackoverflow.com/questions/28318338/understand-vb6-disassemble-code

标签

vb6

disassembly