Reverse engineering a VB6/Winsock/ADO application

Question

I used several Disassemblers/Debuggers/Decompilers to reverse a VB6 application which connects to a remote database using msado26.tlb and mswinsck.ocx

I understood that the connection should be done using a COM calls through msvbm60.dll.

It has been told that functions like: emphasized text__vbaObjSet,__vbaLateIdCallLd,__vbaHresultCheckObj,__vbaNew2, should be used with the proper CLSID pushed/passed as argument to the call.

However, I couldn't find where exactly this call is made.

My question is:

Which "sequence of disassembly instructions". would be a call to the winsock or the ADO library?

What information are you looking to discover? You could always create a trivial vb6 exe that instantiated an ado object and then look at the runtime calls it makes. — Alex K., May 14 '16 at 17:25
Do you know anything about the back end database? If it is something like SQL server then it may be easier to put a trace on that too see what the app is doing with the DB. — OldBoyCoder, May 15 '16 at 06:22

score 0 · Answer 1 · answered May 14 '16 at 13:32

0

Just put breakpoints on these functions then inspect the stack and registers for the passed parameters and try to compare the eventual HEX values with the CLSID you are looking for.

answered May 14 '16 at 13:32

Mohamed YOUNES

69
8

vbaNew2 is probably the only one that would get a CLSID, the other calls are likely going to be dealing with the instantiated object. – OldBoyCoder May 14 '16 at 19:14
And bear in mind that the call stack is likely to be different for late bound versus early bound. Sounds fun. – OldBoyCoder May 14 '16 at 19:15
so what would be the solution? – Mohamed YOUNES May 14 '16 at 22:19

Reverse engineering a VB6/Winsock/ADO application

1 Answers1