VB Decompiler Forum Index VB Decompiler
Hosted by TheAutomaters.com
 
  MemberlistMemberlist
 

RACEVB6 update

 
   VB Decompiler Forum Index -> Utilities & User Contributions
Author Message
sarge
Moderator


Joined: 24 Sep 2002
Posts: 194

Posted: Sat Jun 02, 2007 10:58 am     Post subject: RACEVB6 update

RACE is now up to version 3.7. It can be found at RACEVB6.COM.

RACE is a freeware VB6 PCode analyzer. Some of its functions include:
--------------------
Actual graphic images from various FORMSs and CONTROLs.
The properties of those FORMs and CONTROLs.
The PROJECT properties.
A list of VB6 modules and their count.
The name of the StartUp module.
Whether the StartUp module is a FORM module or a BASIC module.
A list of EXTERNALly used modules.
Compile code type (Native or Pseudo).
Data offset (file location) of the properties (under "OPTIONS" menu).
Active events for each control.
Token data (P-Code only) of the events and procedures (under "OPTIONS" menu).
Textual description of the actual PCode operations
Creation of individual form/module files for use in VB6 IDE environment
Much, much more.
---------------------

The 3.7 updates are:
Improved declaration delineation and unused API detection
Updated/corrected many opcodes
Added new opcodes
Added intrinsic control methods-by-name
Updated EventCount display for external libraries

Thanks
Sarge
Back to top
sarge
Moderator


Joined: 24 Sep 2002
Posts: 194

Posted: Sat Jun 02, 2007 7:03 pm     Post subject: Update #2

Found a minor bug in 3.7. Please discard it and download version 3.8.

Thanks
Sarge
Back to top
cw2k
New User


Joined: 26 Sep 2007
Posts: 2

Posted: Sun Sep 30, 2007 1:16 am     Post subject: Fixing Error #237

When I tested/started Race with 'RaceEx6_3_8.exe' the first time I got
Code:
Error #237
R.A.C.E. cannot analyze itself.

Data currently displayed in "...Details" window will not be saved.
so what !!! Why?

To make it short the workaround first

Search and replace in 'RaceEx6_3_8.exe' these Unicode strings:
frmRace-> frmMace ;you should get 5 strings replaced
frmPass-> frmMess ;you should get 1 string replaced
basRace-> basMace ;you should get 2 string replaced <- new in Version 4.4
... save and done!

(btw I used Winhex but for sure you already have a hexeditor, don't you? )
__________________________________________________________

Background:

I opened 'RaceEx6_3_8.exe' in Darker's P32Dasm VB6 Decompiler and searched for ' 237 ' to see what's up with Error #237.
And landed here:

000D6763: 6B FLdI2 var_88
000D6766: F4 LitI2_Byte: 255 0xFF (True)
000D6768: C6 EqI2 =
000D6769: 1C BranchF 000D6775
000D676C: F3 LitI2: 237 0xED
000D676F: EB CR8I2 Int(number)
000D6770: 9C FMemStFPR8
000D6775: loc_000D6769
000D6775: 14 ExitProc

scrolled up and found a For-Loop that checks for certain strings...
For i=1 To ...
    "frmPassword"
    "frmRaceAbout"
    "frmRaceDone"
    "frmRaceError"
    "frmRaceMain"
    "frmRacePCode"
    "basRaceMain"
    "basRaceOpCode"

next

...well I hope that's enough to get da background. Hehe







Apprenix 01:
frmPassword - So what is that for?



Exploring 'frmPassword OKButton_Click()' (+compared with CancelButton_Click) will show that 'MemVar_63E948' is the Var the entered Password will stored in.


Searching for 'MemVar_63E948' give a hit in frmRaceMain.frm
Private Sub fmeProjectData_MouseDown(Button As Integer, Shift As Integer, X As Single, Y As Single)

when clicking X must be between 310..350 and Y 90..135.

In the upper left corner there is
_____________
|'File Options ...'
|Project Data
~~~~~~~~~~~~
when you click on the 'o' "Project Data" you get a password box.
There you should enter: "XYZZY" to make 'MemVar_63E960'=True(-1)

But what does MemVar_63E960?
Well again search& you'll find. Unfortunately there is only one other reference to it in frmRaceMain.frm!Load_Form() to initialize it with false(0). So it's not linked to any functionality, yet.

Now it's only about to speculate for what that backdoor should will be used in future releases or in was used recent releases?


Last edited by cw2k on Fri Sep 10, 2010 2:26 pm; edited 1 time in total
Back to top
sarge
Moderator


Joined: 24 Sep 2002
Posts: 194

Posted: Sun Sep 30, 2007 10:45 pm     Post subject:

You wrote:
"Search and replace in 'RaceEx6_3_8.exe' these Unicode strings:
frmRace-> frmMace ;you should get 5 strings replaced
frmPass-> frmMess ;you should get 1 string replaced
... save and done!
(btw I used Winhex but for sure you already have a hexeditor, don't you? )
__________________________________________________________

Background:

I opened 'RaceEx6_3_8.exe' in Darker's P32Dasm VB6 Decompiler and searched for ' 237 ' to see what's up with Error #237.
And landed here:

000D6763: 6B FLdI2 var_88
000D6766: F4 LitI2_Byte: 255 0xFF (True)
000D6768: C6 EqI2 =
000D6769: 1C BranchF 000D6775
000D676C: F3 LitI2: 237 0xED
000D676F: EB CR8I2 Int(number)
000D6770: 9C FMemStFPR8
000D6775: loc_000D6769
000D6775: 14 ExitProc

scrolled up and found a For-Loop that checks for certain strings...
For i=1 To ...

"frmPassword"
"frmRaceAbout"
"frmRaceDone"
"frmRaceError"
"frmRaceMain"
"frmRacePCode"

next

...well I hope that's enough to get da background. Hehe
"
Well, that's all true...just not sure why you seem to think it is some kind of victory. If you're good enough to do what you did (PS, yes I use "HexEdit"), then RACE's output should be a big assist to you in your various efforts. Good luck.

"XYZZY" turns on the debugger within RACE. That particular password should be obvious to, and was chosen in honor of, those whose legacy extends back far enough. If you're interesed, you can of course look up the background on the 'net.

Also, I am VERY glad to see that you are a "real person". We've been getting a lot of 'bot reqistrations, and it's been a real pain to try to weed them out. So, welcome, welcome, welcome.

Sarge
Back to top
darbelo
New User


Joined: 15 Jan 2008
Posts: 2

Posted: Fri Jan 25, 2008 4:19 am     Post subject:

[="sarge":21sqsaqe]
"XYZZY" turns on the debugger within RACE. That particular password should be obvious to, and was chosen in honor of, those whose legacy extends back far enough. If you're interesed, you can of course look up the background on the 'net.
[/:21sqsaqe]

I like it, but a '' MsgBox("Nothing happens") '' would be a cooler easter egg, if you ask me. Useless, but cooler. And maybe just a bit truer to its origin.
Back to top
sarge
Moderator


Joined: 24 Sep 2002
Posts: 194

Posted: Sun Jan 27, 2008 1:42 pm     Post subject:

I like it:
"And maybe just a bit truer to its origin."
You don't know how happy/excited/nostalgic a statement like that makes me. So, did you look it up, or are you a genuine, card-carrying member of that generation, like I am?

And, I actually DID use that as a password in a commercial program, or even maybe two!

Thanks for the memories,
Sarge
Back to top
darbelo
New User


Joined: 15 Jan 2008
Posts: 2

Posted: Wed Feb 20, 2008 8:24 am     Post subject: Re:

[="sarge":2fcw81qq]So, did you look it up, or are you a genuine, card-carrying member of that generation, like I am?
[/:2fcw81qq]

Well, neither. I'm too young to have played the original on the PDP-10, but I have an interest in the history of computer games and have played this particular classic before (In several of it's incarnations). And while I am 'obviously a rank amateur', I keep a copy installed on my debian box and play it every once in a while. And I did insert a variation of the "Nothing happens" egg on an app that I delivered to a client.
Back to top
sarge
Moderator


Joined: 24 Sep 2002
Posts: 194

Posted: Wed Feb 27, 2008 5:58 pm     Post subject: Re: RACEVB6 update

Update to 4.2
Thanks
Sarge
Back to top
sarge
Moderator


Joined: 24 Sep 2002
Posts: 194

Posted: Sat May 17, 2008 7:09 am     Post subject: Re: RACEVB6 update

RACE is now updated to version 4.3 @ http://www.RACEVB6.com.

That site also has a link to PS2 homebrew.

Thanks
Sarge
Back to top
sarge
Moderator


Joined: 24 Sep 2002
Posts: 194

Posted: Mon Jun 09, 2008 1:23 pm     Post subject: Re: RACEVB6 update

And now up to 4.4

Corrected some old opcodes
Added new opcodes
Corrected typos in HELP display

Sarge
Back to top
_aLfa_
Site Admin


Joined: 21 Sep 2002
Posts: 233
Location: Aveiro, Portugal

Posted: Thu Jul 17, 2008 10:01 pm     Post subject: Re: RACEVB6 update

Way to go Sarge (;
_________________
One thing only I know, and that is that I know nothing. (Socrates)
Back to top
sarge
Moderator


Joined: 24 Sep 2002
Posts: 194

Posted: Wed Jul 23, 2008 4:53 pm     Post subject: Re: RACEVB6 update

Thanks; don't know if you like RACE, or the PS2 stuff.

Incidently, RACE 6.0 is actually an existing program, but not released. It creates a script file that can be read into a popular commercial debugger/disassembler; when executed, all the GUI items (forms, controls, etc) are explained in labels and comments with things like "FormName", "Height" etc, while the actual PCocde (with it's opcodes and parameters) is defined and explained complete with memory and/or string references, etc. It makes tracing a VB6 PCode program significantly easier when single-stepping.

Just something I sort of wanted try my hand at....there are more debuggers/disassemblers out there that are worthy of consideration, and I think I'd like to make RACE compatible with their plugins, too.

"Learn while experimenting and having fun"...no, wait....maybe that should be "Experiment and having fun while learning"

Sarge
Back to top
_aLfa_
Site Admin


Joined: 21 Sep 2002
Posts: 233
Location: Aveiro, Portugal

Posted: Thu Jul 24, 2008 10:40 pm     Post subject: Re: RACEVB6 update

That sounds really nice. o:
I hope you send me some beta or test version some day, hehe (;

Keep up the good work!
_________________
One thing only I know, and that is that I know nothing. (Socrates)
Back to top
vbgamer45
Regular user


Joined: 07 Jul 2004
Posts: 93
Location: 127.0.0.1

Posted: Sat Jul 26, 2008 3:14 am     Post subject: Re: RACEVB6 update

Great stuff glad to see this is still being worked on.
Back to top
napalm
Site Admin


Joined: 11 Dec 2003
Posts: 18
Location: UK

Posted: Wed Jul 30, 2008 1:02 am     Post subject: Re: RACEVB6 update

Indeed, nice work sarge.

Napalm
_________________
~Napalm~

"With insomnia, you're never really asleep;
you're never really awake."
Fight Club - 1999 - [url:hdzph3dx]http://www.imdb.com/title/tt0137523/[/url:hdzph3dx]
Back to top
   VB Decompiler Forum Index -> Utilities & User Contributions All times are GMT
Page 1 of 1

 
You can post new topics in this forum
You can reply to topics in this forum
You can edit your posts in this forum
You can delete your posts in this forum
You can vote in polls in this forum


Powered by phpBB © 2001, 2005 phpBB Group