elhacker.net cabecera Bienvenido(a), Visitante. Por favor Ingresar o Registrarse
¿Perdiste tu email de activación?.

 

 


Tema destacado: Guía actualizada para evitar que un ransomware ataque tu empresa


+  Foro de elhacker.net
|-+  Programación
| |-+  Programación General
| | |-+  .NET (C#, VB.NET, ASP)
| | | |-+  Programación Visual Basic (Moderadores: LeandroA, seba123neo)
| | | | |-+  [VB6] Alternativa funciones del VB6 [MSVBVM60 - API]
0 Usuarios y 1 Visitante están viendo este tema.
Páginas: [1] Ir Abajo Respuesta Imprimir
Autor Tema: [VB6] Alternativa funciones del VB6 [MSVBVM60 - API]  (Leído 7,750 veces)
STARZ

Desconectado Desconectado

Mensajes: 34



Ver Perfil
[VB6] Alternativa funciones del VB6 [MSVBVM60 - API]
« en: 21 Junio 2012, 01:40 am »

Leyendo un post de hace unos dias de Karcrack en donde explicaba brevemente como obtener el LocaleID con una API de MSVBVM60 indocumentada (en el buen sentido de la palabra) me puse a investigar un poco sobre esta dll fundamental para el VB6. Ya habia notado que Karcrack la habia usado para su Invoke con la funcion Zombie y Addref, etc.
Googleando un poco encontre sitios en donde ya la habian debuggeado:

http://andrewl.dreamhosters.com/archive/67162323.txt
http://www.decompiler-vb.net/documentation/MSVBVM60%20vs%20VBReFormer.pdf

Me intereso muchisimo el tema, aunque no se como usarlas  :huh: Si se fijan, existen varias que son interesantes:

__vbaFileOpen
__vbaFileClose

rtcGetYear
__vbaWriteFile
rtcRemoveDir
rtcKillFiles
rtcFileCopy

rtcSetFileAttr
__vbaEnd
rtcShell
rtcSendKeys
rtcDoEvents
rtcSplit

(en negrita aquellas funciones que son algo detectadas por los AVs y que por ende estaria bueno trabajar sobre ellas)

Esta ultima la pude plasmar en una linda funcion  ;-)
Código
  1. 'Alternativa a End
  2. Private Declare Sub Chau Lib "MSVBVM60.dll" Alias "__vbaEnd" ()
  3.  
  4. Private Sub Form_Load()
  5. MsgBox "Me voy a cerrar solito :)"
  6. Chau
  7. End Sub
  8.  
  9. 'Nota: no funciona en la IDE, solo compilado
  10.  

No se si a alguien le interesa, supongo que Karcrack que esta mas experimentado en el tema me/nos podria dar una manito. Estaria genial si me ayudan a crear todas las otras o mas funciones/subs.


« Última modificación: 21 Junio 2012, 16:59 pm por STARZ » En línea

STARZ

Desconectado Desconectado

Mensajes: 34



Ver Perfil
Re: [VB6] [Idea] Alternativa a OPEN, CLOSE y END
« Respuesta #1 en: 21 Junio 2012, 02:04 am »

Aca otro ejemplo facilito
Código
  1. 'Alternativa a Beep
  2. Private Declare Sub bip Lib "MSVBVM60.dll" Alias "rtcBeep" ()
  3.  
  4. Private Sub Form_load()
  5. bip
  6. End Sub


En línea

The Swash

Desconectado Desconectado

Mensajes: 194


Programmer


Ver Perfil WWW
Re: [VB6] [Idea] Alternativa a OPEN, CLOSE y END
« Respuesta #2 en: 21 Junio 2012, 02:41 am »

Hola,

Hombre, creo que funciones como OPEN y CLOSE llaman a varias de las funciones mencionadas.
Que lo confirme Karcrack (:

Un saludo,
Iván Portilla.
En línea

STARZ

Desconectado Desconectado

Mensajes: 34



Ver Perfil
Funciones alternativas
« Respuesta #3 en: 21 Junio 2012, 16:56 pm »

Seguí investigando y por suerte ya me habían ganado de mano, ninguna solucionaba las funciones que había posteado arriba, como "__vbaFileOpen" ; "__vbaFileClose" ; "rtcKillFiles" ; "rtcFileCopy", pero algo es algo

'Asc$() Alternative function:
Código
  1. 'Asc$() Alternative function
  2. 'MSVBVM60.rtcAnsiValueBstr
  3. Public Declare Function rtcAnsiValueBstr Lib "msvbvm60" (ByVal d As String) As Integer
  4.  
  5. Public Function Alternative_Asc(ByVal InputStr As String) As Integer
  6.        Alternative_Asc = rtcAnsiValueBstr(StrConv(InputStr, vbUnicode))
  7. End Function
  8.  


'Chr$() Alternative function:
Código
  1. 'Chr$() Alternative function
  2. 'MSVBVM60.rtcBstrFromAnsi
  3. Public Declare Function rtcBstrFromAnsi Lib "msvbvm60" (ByVal d As Integer) As String
  4.  
  5. Public Function Alternative_Chr(ByVal InputInt As Integer) As String
  6.        Alternative_Chr = StrConv(rtcBstrFromAnsi(InputInt), vbFromUnicode)
  7. End Function
  8.  


'FileLen() Alternative function:
Código
  1. 'FileLen() Alternative function
  2. 'MSVBVM60.rtcFileLen
  3. Public Declare Function rtcFileLen Lib "msvbvm60" (ByVal ptr As Long) As Long
  4.  
  5. Public Function Alternative_FileLen(ByVal FilePath As String) As Long
  6.        Alternative_FileLen = rtcFileLen(StrPtr(FilePath))
  7. End Function
  8.  


'Mid$() Aletrnative function:
Código
  1. 'Mid$() Aletrnative function
  2. 'MSVBVM60.rtcMidCharBstr
  3.  
  4. Private Type VBvariant
  5.        iType As Long
  6.        reserved As Long
  7.        lLen As Long
  8. End Type
  9.  
  10. Public Declare Function rtcMidCharBstr Lib "msvbvm60" (ByVal sStr As String, ByVal Pos As Integer, ByVal iLen As Long) As String
  11.  
  12. Public Function Alternative_Mid(ByVal sStr As String, ByVal Pos As Integer, ByVal iLen As Long) As String
  13.        Dim VBv As VBvariant
  14.        VBv.iType = 2
  15.        VBv.lLen = iLen
  16.        Alternative_Mid = StrConv(rtcMidCharBstr(StrConv(sStr, vbUnicode), Pos, VarPtr(VBv.iType)), vbFromUnicode)
  17. End Function
  18.  


'StrConv() Alternative function
Código
  1. 'StrConv() Alternative function
  2. 'MSVBVM60.rtcStrConvVar2
  3. 'MSVBVM60.__vbaVar2Vec
  4. Type WeirdType
  5.        Ptr1 As Long 'Holded data type
  6.        Ptr2 As Long 'Address of last called function/api
  7.        Ptr3 As Long 'ptr to converted data
  8.        Ptr4 As Long 'ptr to VbVariant var
  9. End Type
  10. 'MSVBVM60
  11. Declare Function vbaVar2Vec Lib "MSVBVM60" Alias "__vbaVar2Vec" (ByRef ptr() As Byte, ByRef Des As WeirdType) As Long
  12. Declare Function rtcStrConvVar2 Lib "MSVBVM60" (ByRef Des As WeirdType, ByRef Source As Variant, ByVal ConvType As Long, ByVal DontKnowIt As Long) As Long
  13.  
  14. Public Function Alternative_StrConv(ByVal Value As Variant, ByVal o As VbStrConv) As Variant
  15.        Dim e1 As WeirdType
  16.        Dim Arr() As Byte
  17.        Arr = Value
  18.        Value = Arr
  19.        rtcStrConvVar2 e1, Value, o, &H0
  20.        vbaVar2Vec Arr, e1
  21.        Alternative_StrConv = Arr
  22. End Function
  23.  


'Hex$() Alternative function:
Código
  1. 'Hex$() Alternative function
  2. 'MSVBVM60.rtcHexBstrFromVar
  3. Public Type VBvariant
  4.        iType As Long
  5.        Reserved As Long
  6.        Value As Long
  7. End Type
  8.  
  9. Public Declare Function rtcHexBstrFromVar Lib "MSVBVM60" (ByRef VarPtr As VBvariant) As String
  10.  
  11. Public Function Alternative_Hex(ByVal Value As Long) As String
  12. Dim VbV As VBvariant
  13. VbV.iType = 2
  14. VbV.Value = Value
  15. Alternative_Hex = StrConv(rtcHexBstrFromVar(VbV), vbFromUnicode)
  16. End Function
  17.  


'Split() Alternative function:
Código
  1. 'Split() Alternative function
  2. 'Coded By hamavb
  3.  
  4. 'MSVBVM60.rtcSplit
  5. 'MSVBVM60.__vbaAryCopy
  6. Public Type WeirdType
  7.                e1 As Long
  8.                e2 As Long
  9.                e3 As Long
  10.                e4 As Long
  11. End Type
  12. Public Declare Function rtcSplit Lib "MSVBVM60" (ByRef aa As WeirdType, ByVal ExpressionPtr As Long, ByRef sep As Variant, ByVal zz As Long, ByVal zzz As Long) As Long
  13. Public Declare Function vbaAryCopy Lib "MSVBVM60" Alias "__vbaAryCopy" (ByRef lType() As String, ByVal aa As Long) As Long
  14. Public Function Alternative_Split(ByVal Exp As String, ByVal sep As Variant, Optional ByVal Limit As Integer = -1, Optional ByVal Compare As VbCompareMethod = vbBinaryCompare) As Variant
  15.                Dim aa As WeirdType
  16.                Dim f() As String
  17.                rtcSplit aa, StrPtr(Exp), sep, Limit, Compare
  18.                vbaAryCopy f, VarPtr(aa.e3)
  19.                For i = LBound(f) To UBound(f)
  20.                        f(i) = StrConv(f(i), vbFromUnicode)
  21.                Next i
  22.                Alternative_Split = f
  23. End Function
  24.  


'String$() Alternative function:
Código
  1. 'String$() Alternative function
  2. 'Coded by hamavb
  3. 'MSVBVM60.rtcStringBstr
  4. Public Declare Function rtcStringBstr Lib "MSVBVM60" (ByVal Longeur As Long, ByRef VbV As Variant) As String
  5.  
  6. Public Function Alternative_String(ByVal iLen As Long, ByVal Char As Variant) As String
  7.                Alternative_String = StrConv(rtcStringBstr(iLen, Char), vbFromUnicode)
  8. End Function
  9.  


'Replace() Alternative function:
Código
  1. 'Replace() Alternative function
  2. 'Coded By hamavb
  3. 'MSVBVM60.rtcReplace
  4.  
  5. Public Declare Function rtcReplace Lib "MSVBVM60" (ByVal expression As String, ByVal Find As String, ByVal Replace As String, ByVal Start As Long, ByVal Count As Long, ByVal CompareMthd As Long) As String
  6.  
  7. Public Function Alternative_Replace(ByVal expression As String, ByVal Find As String, ByVal Replace As String, Optional ByVal Start As Long = 1, Optional ByVal Count As Long = -1, Optional ByVal CompareMthd As VbCompareMethod = vbBinaryCompare) As String
  8.        Alternative_Replace = StrConv(rtcReplace(StrConv(expression, vbUnicode), StrConv(Find, vbUnicode), StrConv(Replace, vbUnicode), Start, Count, CompareMthd), vbFromUnicode)
  9. End Function
  10.  


'StrReverse() Alternative function:
Código
  1. 'StrReverse() Alternative function
  2. 'MSVBVM60.rtcStrReverse
  3. Public Declare Function rtcStrReverse Lib "MSVBVM60" (ByVal sStr As String) As String
  4. Public Function Alternative_StrReverse(ByVal sStr As String) As String
  5.        Alternative_StrReverse = StrConv(rtcStrReverse(StrConv(sStr, vbUnicode)), vbFromUnicode)
  6. End Function
  7.  


'Len() Alternative Function:
Código
  1. 'Len() Alternative Function
  2. 'MSVBVM60.vbaLenBstr
  3. Public Declare Function vbaLenBstr Lib "msvbvm60" Alias "__vbaLenBstr" (ByVal ptr As Long) As Long
  4.  
  5. Public Function Alternative_Len(ByVal sStr As String) As Long
  6.        Alternative_Len = vbaLenBstr(StrPtr(sStr))
  7. End Function
  8.  


'Space$() Alternative Function:
Código
  1. 'Space$() Alternative Function
  2. 'MSVBVM60.rtcSpaceBstr
  3. Public Declare Function rtcSpaceBstr Lib "MSVBVM60" (ByVal Longeur As Long) As String
  4.  
  5. Public Function Alternative_Space(ByVal iLen As Long) As String
  6.        Alternative_Space = StrConv(rtcSpaceBstr(iLen), vbFromUnicode)
  7. End Function
  8.  


'Left$() Alternative Function:
Código
  1. 'Left$() Alternative Function
  2. 'MSVBVM60.rtcLeftCharBstr
  3. Public Declare Function rtcLeftCharBstr Lib "MSVBVM60" (ByVal sStr As String, ByVal iLen As Integer) As String
  4.  
  5. Public Function Alternative_Left(ByVal sStr As String, ByVal iLen As Integer)
  6.        Alternative_Left = StrConv(rtcLeftCharBstr(StrConv(sStr, vbUnicode), iLen), vbFromUnicode)
  7. End Function
  8.  


'Right$() Alternative Function:
Código
  1. 'Right$() Alternative Function
  2. 'MSVBVM60.rtcRightCharBstr
  3. Public Declare Function rtcRightCharBstr Lib "MSVBVM60" (ByVal sStr As String, ByVal iLen As Integer) As String
  4.  
  5. Public Function Alternative_Right(ByVal sStr As String, ByVal iLen As Integer)
  6.        Alternative_Right = StrConv(rtcRightCharBstr(StrConv(sStr, vbUnicode), iLen), vbFromUnicode)
  7. End Function
  8.  


'InStr Alternative function:
Código
  1. 'InStr Alternative function
  2. 'MSVBVM60.__vbaInStr
  3. Public Declare Function InStr Lib "MSVBVM60" Alias "__vbaInStr" (Optional ByVal Start As Long = -1, Optional ByVal Exp As String = "", Optional ByVal Find As String = "", Optional ByVal Compare As VbCompareMethod = vbBinaryCompare) As Long
  4.  
  5. Public Function Alternative_InStr(Optional ByVal Start As Long = -1, Optional ByVal Exp As String = "", Optional ByVal Find As String = "", Optional ByVal Compare As VbCompareMethod = vbBinaryCompare) As Long
  6.        Alternative_InStr = InStr(Start, Exp, Find, Compare)
  7. End Function
  8.  


'InStrRev Alternative function:
Código
  1. 'InStrRev Alternative function
  2. 'MSVBVM60.rtcInStrRev
  3. Public Declare Function InStrRev Lib "MSVBVM60" Alias "rtcInStrRev" (ByVal Exp As String, ByVal Find As String, Optional ByVal Start As Long = -1, Optional ByVal Compare As VbCompareMethod = vbBinaryCompare) As Long
  4.  
  5. Public Function Alternative_InStrRev(ByVal Exp As String, ByVal Find As String, Optional ByVal Start As Long = -1, Optional ByVal Compare As VbCompareMethod = vbBinaryCompare) As Long
  6.        Alternative_InStrRev = InStrRev(StrConv(Exp, vbUnicode), StrConv(Find, vbUnicode), Start, Compare)
  7. End Function
  8.  


'Ubound Alternative Function:
Código
  1. 'Ubound Alternative Function
  2. 'MSVBVM60.__vbaUbound
  3. Public Declare Function iUBound Lib "MSVBVM60" Alias "__vbaUbound" (ByVal ptr As Long, ByVal Exp As Long) As Long
  4. Public Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Long, ByVal Length As Long)
  5.  
  6. Public Function Alternative_UBound(vbv As Variant) As Long
  7.        Dim a As Long
  8.        Dim aa As Long
  9.        a = VarPtr(vbv) + &H8
  10.        CopyMemory aa, ByVal a, &H4
  11.        CopyMemory a, ByVal aa, &H4
  12.        Alternative_UBound = iUBound(&H1, a)
  13. End Function
  14.  


'Lbound Alternative Function:
Código
  1. 'Lbound Alternative Function
  2. 'MSVBVM60.__vbaLbound
  3. Public Declare Function iLBound Lib "MSVBVM60" Alias "__vbaLbound" (ByVal ptr As Long, ByVal Exp As Long) As Long
  4. Public Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Long, ByVal Length As Long)
  5.  
  6. Public Function Alternative_LBound(vbv As Variant) As Long
  7.        Dim a As Long
  8.        Dim aa As Long
  9.        a = VarPtr(vbv) + &H8
  10.        CopyMemory aa, ByVal a, &H4
  11.        CopyMemory a, ByVal aa, &H4
  12.        Alternative_LBound = iLBound(&H1, a)
  13. End Function
  14.  


'Alternative_CLng Function:
Código
  1. 'Alternative_CLng Function
  2. 'MSVBVM60.__vbaI4Str
  3. Declare Function vbaI4Str Lib "msvbvm60" Alias "__vbaI4Str" (ByVal sStr As String) As Long
  4.  
  5. Public Function Alternative_Clng(ByVal expression As Variant) As Long
  6.        Dim Exp As String
  7.        Exp = expression
  8.        Alternative_Clng = vbaI4Str(StrConv(Exp, vbUnicode))
  9. End Function
  10.  


'Alternative_CInt Function:
Código
  1. 'Alternative_CInt Function
  2. 'MSVBVM60.__vbaI2Str
  3. Declare Function vbaI2Str Lib "msvbvm60" Alias "__vbaI2Str" (ByVal sStr As String) As Long
  4.  
  5. Public Function Alternative_CInt(ByVal expression As Variant) As Long
  6.        Dim Exp As String
  7.        Exp = expression
  8.        Alternative_CInt = vbaI2Str(StrConv(Exp, vbUnicode))
  9. End Function
  10.  


'Alternative_Environ Function:
Código
  1. 'Alternative_Environ Function
  2. 'MSVBVM60.rtcEnvironBstr
  3. Private Declare Function rtcEnvironBstr Lib "MSVBVM60" (ByVal ItemPtr As Long) As String
  4. Function Alternative_Environ(ByVal Item As Variant) As String
  5.        Alternative_Environ = StrConv(rtcEnvironBstr(Item), vbFromUnicode)
  6. End Function
  7.  


'Alternativa a Environ (versión de Kracrack):
Código
  1. 'Alternativa a Environ (versión de Kracrack)
  2. Option Explicit
  3. Private Type environstruct
  4.    k       As Long '8
  5.    null    As Long '0
  6.    envstr  As Long 'StrPtr(str)
  7. End Type
  8.  
  9. 'MSVBVM60
  10. Private Declare Function rtcEnvironBstr Lib "MSVBVM60" (ByRef struct As environstruct) As String
  11.  
  12. Private Sub Form_Load()
  13.    Dim es  As environstruct
  14.  
  15.    With es
  16.        .k = 8
  17.        .envstr = StrPtr("TMP")
  18.    End With
  19.  
  20.    MsgBox StrConv(rtcEnvironBstr(es), vbFromUnicode)
  21. End Sub


'Alternatime_Trim Function:
Código
  1. 'Alternatime_Trim Function
  2. 'MSVBVM60.rtcTrimBstr
  3. Private Declare Function rtcTrimBstr Lib "MSVBVM60" (ByVal ItemPtr As String) As String
  4. Function Alternatime_Trim(ByVal StrItem As String) As String
  5.        Alternatime_Trim = StrConv(rtcTrimBstr(StrConv(StrItem, vbUnicode)), vbFromUnicode)
  6. End Function
  7.  


'Alternatime_LTrim Function:
Código
  1. 'Alternatime_LTrim Function
  2. 'MSVBVM60.rtcLeftTrimBstr
  3. Private Declare Function rtcLeftTrimBstr Lib "MSVBVM60" (ByVal ItemPtr As String) As String
  4. Function Alternatime_LTrim(ByVal StrItem As String) As String
  5.        Alternatime_LTrim = StrConv(rtcLeftTrimBstr(StrConv(StrItem, vbUnicode)), vbFromUnicode)
  6. End Function
  7.  


'Alternatime_RTrim Function:
Código
  1. 'Alternatime_RTrim Function
  2. 'MSVBVM60.rtcRightTrimBstr
  3. Private Declare Function rtcRightTrimBstr Lib "MSVBVM60" (ByVal ItemPtr As String) As String
  4. Function Alternatime_RTrim(ByVal StrItem As String) As String
  5.        Alternatime_RTrim = StrConv(rtcRightTrimBstr(StrConv(StrItem, vbUnicode)), vbFromUnicode)
  6. End Function
  7.  


'Obtener localeID (por karcrack):
Código
  1. 'Obtener localeID (por karcrack)
  2. Private Declare Function rtcGetHostLCID Lib "MSVBVM60" () As Long
  3. Private Sub Form_Load()
  4.   MsgBox rtcGetHostLCID
  5. End Sub
  6.  

fuentes:
http://foro.elhacker.net/programacion_visual_basic/vbundocumented_obtener_localeid_de_forma_nativa-t362448.0.html
http://foro.elhacker.net/programacion_visual_basic/rtcenvironbstr_declare_help-t355859.0.html
http://www.imsecure.org/forum/topic/41106-alternative-functions/page__st__0
En línea

Páginas: [1] Ir Arriba Respuesta Imprimir 

Ir a:  

Mensajes similares
Asunto Iniciado por Respuestas Vistas Último mensaje
msvbvm60 y dll, ocx
Programación Visual Basic
irra_b 8 3,589 Último mensaje 11 Octubre 2005, 19:40 pm
por {_The_Alwar_}
problema con msvbvm60.dll
Programación Visual Basic
ZEALOT 0 1,776 Último mensaje 16 Enero 2006, 21:17 pm
por ZEALOT
Programas en VB6 sin msvbvm60.dll
Programación Visual Basic
trojanX 3 2,208 Último mensaje 30 Septiembre 2007, 23:07 pm
por Tengu
Alguna manera de deshacerse de msvbvm60.dll?
Programación Visual Basic
demoniox12 6 5,229 Último mensaje 17 Noviembre 2008, 20:24 pm
por demoniox12
[Pauscal] Funciones indocumentada de MSVBVM60
Programación General
Yuki 0 2,374 Último mensaje 1 Diciembre 2015, 20:36 pm
por Yuki
WAP2 - Aviso Legal - Powered by SMF 1.1.21 | SMF © 2006-2008, Simple Machines