Undocumented Function using VBA6.Dll

Re: Undocumented Function using VBA6.Dll

Quote:

Originally Posted by smkperu

Hello The Trick,

Yes as suggested I can use MessageBox API for this rtcMsgBox API.But there are many exported functions like this in msvbvm60.dll as you said for which I may not be knowing equivalent in c and therefore for using them we have to use
them directly like rtcMsgBox.

Thanks

Ask about a specific function.

Re: Undocumented Function using VBA6.Dll

Quote:

Originally Posted by smkperu

...functions like this in msvbvm60.dll ... for which I may not be knowing equivalent in c

The background behind 'the tricks' question above is,
that nearly all the functions of msvbvm60.dll are covered already by "system-layer-Dlls",
like User32, Ole32, OleAut32...

For example the VB6-Format(...)-Function is contained in oleaut32.dll, described here:
https://docs.microsoft.com/en-us/win...auto-varformat
(along with a whole lot of other "Variant-Conversion-Functions", when you look at the left-hand-side of that MSDN-Page).

And as for the few functions wich are not covered - like e.g. GetMem4,
come on - you're working in C...
"copying 4 Bytes around" should be a childsplay using a bit of "C-Pointer-voodoo".

Olaf

Re: Undocumented Function using VBA6.Dll

Quote:

Originally Posted by The trick

Ask about a specific function.

Hello The Trick,
In msvbvm60.dll I have seen export functions like

EbLoadRunTime
EbCreateContext

Can these type of functions along with coinitialize which you showed in c code of help to initialize STA, runtime and project context. as you said You need to initialize STA, runtime and project context. so that we can make the rtcMsgBox to run without using VB AX dll.

Thanks

Re: Undocumented Function using VBA6.Dll

Quote:

Originally Posted by smkperu

...so that we can make the rtcMsgBox to run without using VB AX dll.

As said, it is easy to use the MS MessageBox-API instead of rtcMsgBox in your C-App...

This sounds more and more like "just another hacking-attempt" to me.

Olaf

Re: Undocumented Function using VBA6.Dll

Quote:

Originally Posted by smkperu

Hello The Trick,
In msvbvm60.dll I have seen export functions like

EbLoadRunTime
EbCreateContext

Can these type of functions along with coinitialize which you showed in c code of help to initialize STA, runtime and project context. as you said You need to initialize STA, runtime and project context. so that we can make the rtcMsgBox to run without using VB AX dll.

Thanks

No, they can't.

Re: Undocumented Function using VBA6.Dll

Quote:

Originally Posted by The trick

No, they can't.

Hello The Trick,

There are many fumctions in msvbvm60.dll as follows as per DEPENDS utility as follows:

Code:

ThunRTMain VBDllUnRegisterServer VBDllCanUnloadNow VBDllRegisterServer VBDllGetClassObject UserDllMain DllRegisterServer DllUnregisterServer __vbaAryLock __vbaBoolErrVar __vbaRedimVar2 __vbaStrErrVarCopy __vbaVarLateMemCallLd __vbaVarLateMemCallLdRf __vbaVarLateMemCallSt __vbaVarLateMemSt __vbaVarLateMemStAd __vbaAryVarVarg __vbaFpCDblR4 __vbaFpCDblR8 __vbaFpCSngR4 __vbaFpCSngR8 __vbaFpCmpCy __vbaFpCy __vbaFpI2 __vbaFpI4 __vbaFpR4 __vbaFpR8 __vbaFpUI1 __vbaFreeObj __vbaFreeStr __vbaFreeVar __vbaFreeVarg __vbaI2Abs __vbaI2I4 __vbaI2Sgn __vbaI4Abs __vbaI4Sgn __vbaStrCopy __vbaStrMove __vbaUI1I2 __vbaUI1I4 __vbaUI1Sgn __vbaVarCopy __vbaVarDup __vbaVarMove __vbaVarVargNofree __vbaVarZero __vbaVargParmRef __vbaVargVar __vbaVargVarCopy __vbaVargVarMove __vbaVargVarRef DLLGetDocumentation DllCanUnloadNow DllGetClassObject _CIatan _CIcos _CIexp _CIlog _CIsin _CIsqrt _CItan __vbaAptOffset __vbaAryConstruct2 __vbaAryConstruct __vbaAryCopy __vbaAryDestruct __vbaAryMove __vbaAryRebase1Var __vbaAryRecCopy __vbaAryRecMove __vbaAryUnlock __vbaAryVar __vbaBoolStr __vbaBoolVar __vbaBoolVarNull __vbaCVarAryUdt __vbaCastObj __vbaCastObjVar __vbaCheckType __vbaCheckTypeVar __vbaChkstk __vbaCopyBytes __vbaCopyBytesZero __vbaCyAbs ProcCallEngine DllFunctionCall __vbaCyAdd __vbaCyErrVar CopyRecord __vbaCyFix __vbaCyForInit __vbaCyForNext __vbaCyI2 TipGetAddressOfPredeclaredInstance __vbaCyI4 __vbaCyInt __vbaCyMul MethCallEngine __vbaCyMulI2 __vbaCySgn __vbaCyStr __vbaCySub __vbaCyUI1 __vbaCyVar __vbaDateR4 __vbaDateR8 __vbaDateStr __vbaDateVar __vbaDerefAry __vbaDerefAry1 __vbaEnd __vbaErase __vbaEraseKeepData __vbaEraseNoPop __vbaError __vbaErrorOverflow __vbaExceptHandler __vbaExitEachAry TipSetOption __vbaExitEachColl __vbaExitEachVar __vbaExitProc __vbaFPException __vbaFPFix __vbaFPInt TipUnloadProject __vbaFailedFriend __vbaFileClose TipCreateInstanceProject2 EbResetProject EbGetHandleOfExecutingProject __vbaFileCloseAll __vbaFileLock __vbaFileOpen __vbaFileSeek __vbaFixstrConstruct __vbaForEachAry __vbaForEachCollAd __vbaForEachCollObj __vbaForEachCollVar __vbaForEachVar __vbaFreeObjList __vbaFreeStrList __vbaFreeVarList __vbaGenerateBoundsError __vbaGet3 __vbaGet4 __vbaGetFxStr3 __vbaGetFxStr4 __vbaGetOwner3 __vbaGetOwner4 __vbaGosub __vbaGosubFree __vbaGosubReturn __vbaHresultCheck __vbaHresultCheckNonvirt __vbaHresultCheckObj __vbaI2Cy __vbaI2ErrVar __vbaI2ForNextCheck __vbaI2Str __vbaI2Var __vbaI4Cy EbResetProjectNormal TipUnloadInstance __vbaI4ErrVar EbLibraryLoad EbLibraryUnload __vbaI4ForNextCheck EbLoadRunTime __vbaI4Str __vbaI4Var EbCreateContext EbDestroyContext EbSetContextWorkerThread __vbaInStr __vbaInStrB __vbaInStrVar __vbaInStrVarB __vbaInputFile __vbaLateIdCall __vbaLateIdCallLd EbGetErrorInfo __vbaLateIdCallSt __vbaLateIdNamedCall __vbaLateIdNamedCallLd __vbaLateIdNamedCallSt __vbaLateIdNamedStAd __vbaLateIdSt __vbaLateIdStAd __vbaLateMemCall __vbaLateMemCallLd __vbaLateMemCallSt __vbaLateMemNamedCall __vbaLateMemNamedCallLd __vbaLateMemNamedCallSt EbIsProjectOnStack TipCreateInstanceEx GetMem2 GetMem4 GetMem8 GetMemStr GetMemVar GetMemObj PutMem2 PutMem4 PutMem8 PutMemStr PutMemVar PutMemObj SetMemVar SetMemObj GetMemNewObj PutMemNewObj SetMemNewObj GetMem1 PutMem1 GetMemEvent PutMemEvent SetMemEvent __vbaLateMemNamedStAd __vbaLateMemSt __vbaLateMemStAd __vbaLbound __vbaLdZeroAry __vbaLenBstr __vbaLenBstrB __vbaLenVar __vbaLenVarB __vbaLineInputStr __vbaLineInputVar __vbaLsetFixstr __vbaLsetFixstrFree __vbaMidStmtBstr __vbaMidStmtBstrB __vbaMidStmtVar __vbaMidStmtVarB __vbaNameFile __vbaNew2 __vbaNew __vbaNextEachAry __vbaNextEachCollAd __vbaNextEachCollObj __vbaNextEachCollVar __vbaNextEachVar __vbaObjAddref __vbaObjIs __vbaObjSet __vbaObjSetAddref __vbaObjVar __vbaOnError __vbaOnGoCheck __vbaPowerR8 __vbaPrintFile __vbaPrintObj __vbaPut3 __vbaPut4 __vbaPutFxStr3 __vbaPutFxStr4 __vbaPutOwner3 __vbaPutOwner4 __vbaR4Cy __vbaR4ErrVar __vbaR4ForNextCheck __vbaR4Sgn __vbaR4Str __vbaR4Var __vbaR8Cy __vbaR8ErrVar __vbaR8FixI2 __vbaR8FixI4 __vbaR8ForNextCheck __vbaR8IntI2 __vbaR8IntI4 __vbaR8Sgn __vbaR8Str __vbaR8Var __vbaRaiseEvent __vbaRecAnsiToUni __vbaRecAssign __vbaRecDestruct __vbaRecDestructAnsi __vbaRecUniToAnsi __vbaRedim __vbaRedimPreserve __vbaRedimPreserveVar __vbaRedimPreserveVar2 __vbaRedimVar __vbaRefVarAry __vbaResume __vbaRsetFixstr __vbaRsetFixstrFree __vbaSetSystemError __vbaStopExe __vbaStr2Vec __vbaStrAryToAnsi __vbaStrAryToUnicode __vbaStrBool EVENT_SINK_QueryInterface EVENT_SINK_AddRef EVENT_SINK_Release EVENT_SINK_GetIDsOfNames EVENT_SINK_Invoke __vbaStrCat __vbaStrCmp __vbaStrComp __vbaStrCompVar __vbaStrCy BASIC_CLASS_QueryInterface BASIC_CLASS_AddRef BASIC_CLASS_Release BASIC_CLASS_GetIDsOfNames BASIC_CLASS_Invoke __vbaStrDate __vbaStrFixstr __vbaStrI2 __vbaStrI4 __vbaStrLike BASIC_DISPINTERFACE_GetTICount BASIC_DISPINTERFACE_GetTypeInfo __vbaStrR4 __vbaStrR8 __vbaStrTextCmp __vbaStrTextLike __vbaStrToAnsi __vbaStrToUnicode __vbaStrUI1 __vbaStrVarCopy Zombie_QueryInterface Zombie_AddRef Zombie_Release Zombie_GetTypeInfoCount Zombie_GetTypeInfo Zombie_GetIDsOfNames Zombie_Invoke __vbaStrVarMove __vbaStrVarVal __vbaUI1Cy EVENT_SINK2_AddRef EVENT_SINK2_Release __vbaUI1ErrVar __vbaUI1Str __vbaUI1Var __vbaUbound __vbaUdtVar __vbaUnkVar __vbaVar2Vec __vbaVarAbs __vbaVarAdd __vbaVarAnd __vbaVarCat __vbaVarCmpEq __vbaVarCmpGe __vbaVarCmpGt __vbaVarCmpLe __vbaVarCmpLt __vbaVarCmpNe __vbaVarDateVar __vbaVarDiv __vbaVarEqv __vbaVarErrI4 __vbaVarFix __vbaVarForInit __vbaVarForNext __vbaVarIdiv __vbaVarImp __vbaVarIndexLoad __vbaVarIndexLoadRef __vbaVarIndexLoadRefLock __vbaVarIndexStore __vbaVarIndexStoreObj __vbaVarInt __vbaVarLike __vbaVarLikeVar __vbaVarMod __vbaVarMul __vbaVarNeg __vbaVarNot __vbaVarOr __vbaVarPow __vbaVarSetObj __vbaVarSetObjAddref __vbaVarSetUnk __vbaVarSetUnkAddref __vbaVarSetVar __vbaVarSetVarAddref __vbaVarSub __vbaVarTextCmpEq __vbaVarTextCmpGe __vbaVarTextCmpGt __vbaVarTextCmpLe __vbaVarTextCmpLt __vbaVarTextCmpNe __vbaVarTextLike __vbaVarTextLikeVar __vbaVarTextTstEq __vbaVarTextTstGe __vbaVarTextTstGt __vbaVarTextTstLe __vbaVarTextTstLt __vbaVarTextTstNe __vbaVarTstEq __vbaVarTstGe __vbaVarTstGt __vbaVarTstLe __vbaVarTstLt __vbaVarTstNe __vbaVarXor __vbaVargObj __vbaVargObjAddref rtcLeftBstr rtcLeftVar rtcRightBstr rtcRightVar rtcAnsiValueBstr rtcLowerCaseBstr rtcLowerCaseVar rtcTrimBstr rtcTrimVar rtcLeftTrimBstr rtcLeftTrimVar rtcRightTrimBstr rtcRightTrimVar rtcSpaceBstr rtcSpaceVar rtcUpperCaseBstr rtcUpperCaseVar rtcKillFiles rtcChangeDir rtcMakeDir rtcRemoveDir rtcChangeDrive rtcBeep rtcGetTimer rtcStrFromVar rtcBstrFromAnsi rtcPackDate rtcPackTime rtcGetDateValue rtcGetTimeValue rtcGetDayOfMonth rtcGetHourOfDay rtcGetMinuteOfHour rtcGetMonthOfYear rtcGetPresentDate rtcGetSecondOfMinute rtcSetDateVar rtcSetDateBstr rtcSetTimeVar rtcSetTimeBstr rtcGetDayOfWeek rtcGetYear rtcFileReset rtcFileAttributes rtcIsArray rtcIsDate rtcIsEmpty rtcIsError rtcIsNull rtcIsNumeric rtcIsObject rtcVarType rtDecFromVar rtcFileWidth rtcInputCount rtcInputCountVar rtcFileSeek rtcFileLocation rtcFileLength rtcEndOfFile rtcHexBstrFromVar rtcHexVarFromVar rtcOctBstrFromVar rtcOctVarFromVar rtcFileCopy rtcFileDateTime rtcFileLen rtcGetFileAttr rtcSetFileAttr rtcR8ValFromBstr rtcSin rtcCos rtcTan rtcAtn rtcExp rtcLog rtcRgb rtcQBColor rtcMacId rtcTypeName rtcIsMissing rtcRandomNext rtcRandomize rtcMsgBox rtcInputBox rtcAppActivate rtcDoEvents rtcSendKeys rtcShell rtcArray __vbaVargUnk __vbaVargUnkAddref __vbaVerifyVarObj rtcGetErl rtcStringBstr rtcStringVar rtcVarBstrFromAnsi rtcGetDateBstr rtcGetDateVar rtcGetTimeBstr rtcGetTimeVar rtcVarStrFromVar rtcSqr rtcIMEStatus rtcLeftCharBstr rtcLeftCharVar rtcRightCharBstr rtcRightCharVar rtcInputCharCount rtcInputCharCountVar rtcStrConvVar __vbaWriteFile rtcGetHostLCID rtcCreateObject rtcGetObject rtcAppleScript rtcMidBstr rtcMidVar rtcInStr rtcMidCharBstr rtcMidCharVar rtcInStrChar rtBstrFromErrVar rtBoolFromErrVar rtCyFromErrVar rtI2FromErrVar rtI4FromErrVar rtR4FromErrVar rtR8FromErrVar rtcDateFromVar rtcVarFromVar rtcCVErrFromVar VarPtr rtcDir rtcCurrentDirBstr rtcCurrentDir rtcFreeFile rtcCompareBstr rtcBstrFromFormatVar rtcBstrFromError rtcVarFromError rtcLenCharVar rtcLenVar rtcFixVar rtcAbsVar rtcIntVar rtcSgnVar _adj_fdiv_m16i rtcVarFromFormatVar rtcDateAdd rtcDateDiff rtcDatePart rtcPartition rtcChoose rtcEnvironVar rtcEnvironBstr rtcSwitch rtcCommandBstr rtcCommandVar rtcSLN rtcSYD rtcDDB rtcIPMT rtcPPMT rtcPMT rtcPV rtcFV rtcNPer rtcRate rtcImmediateIf rtcIRR rtcMIRR rtcNPV rtcErrObj rtUI1FromErrVar rtcVarDateFromVar _adj_fdiv_m32 rtcGetSetting rtcSaveSetting rtcDeleteSetting rtcGetAllSettings rtcByteValueBstr rtcBstrFromByte rtcVarBstrFromByte rtcCharValueBstr rtcBstrFromChar rtcVarBstrFromChar rtcSetCurrentCalendar rtcGetCurrentCalendar _adj_fdiv_m32i rtcFormatNumber rtcFormatCurrency rtcFormatPercent rtcFormatDateTime rtcWeekdayName rtcMonthName rtcFilter rtcInStrRev rtcJoin rtcSplit rtcReplace rtcStrReverse rtcRound rtcCallByName rtcCreateObject2 rtcStrConvVar2 _adj_fdiv_m64 _adj_fdiv_r _adj_fdivr_m16i _adj_fdivr_m32 _adj_fdivr_m32i _adj_fdivr_m64 _adj_fpatan _adj_fprem _adj_fprem1 _adj_fptan _allmul ... TipInvokeMethod2 ... TipInvokeMethod ... IID_IVbaHost EbGetObjConnectionCounts ... ... ... ... ... CreateIExprSrvObj ... EbGetVBAObject

They start with rtc or Eb or _ or VBDll or DLLGet or Get or Tip etc.

For GetMemX there is c rtlmovememory.

For rtcMsgBox there is c MessageBox. etc

For DLLGetxxx there is c DLLGetxxx

For Eb ???

For VBDll ???

For Tip ???
For _ ???

So there are different types of exports.

Is there any other way that I could manually init STA,project context,runtime ie simulate the vb AX dll functionality so that I can use export functions of msvbvm60.dll if I know the declaration of the export function.

Thanks

Re: Undocumented Function using VBA6.Dll

Quote:

Originally Posted by smkperu

For GetMemX there is c rtlmovememory.

You don't need any equvalent in C.

Quote:

Originally Posted by smkperu

For rtcMsgBox there is c MessageBox. etc

No. rtcMsgBox has different behavior when you have unattended execution option in a project.

Quote:

Originally Posted by smkperu

For Eb ???

For VBDll ???

For Tip ???
For _ ???

You don't need the most of functions outside VB6-application especially in C.

Quote:

Originally Posted by smkperu

Is there any other way that I could manually init STA,project context,runtime ie simulate the vb AX dll functionality so that I can use export functions of msvbvm60.dll if I know the declaration of the export function.

Yes, there is a way to do manual initialization but i don't see reason to show it. This question looks like bunch of messages which i regularly get from script-kiddie-malware-developers which want to "bypass AV" etc. So if you want i help you to solve your issue you should explain (clear) why you want to use that method.

Re: Undocumented Function using VBA6.Dll

Hello The Trick,

For initializing project instead of using separate VB Ax Dll can we use the same msvbvm60.dll for
initializing STA and create a VB6 AxDll object so that overhead may be reduced.

Thanks.

Re: Undocumented Function using VBA6.Dll

Quote:

Originally Posted by smkperu

Hello The Trick,

For initializing project instead of using separate VB Ax Dll can we use the same msvbvm60.dll for
initializing STA and create a VB6 AxDll object so that overhead may be reduced.

Thanks.

Dear smkperu,

If you want to use msvbvm60.dll instead of a new activex dll there are two ways to initialize project:

1. Identifying a multiuse class from msvbvm60.dll activex dll and creating its instance using cocreateinstance after calling coinitialize just as shown by Trick in his C code.

or

2. Getting the VBHeader(EXEProjectInfo) structure from the msvbvm60.dll thru its module instance which you already have thru LoadLibrary("msvbvm60.dll") and calling VBDllGetClassObject( by passing the VBHeader as one of input parameters to it ) after calling coinitialize in same C code.

I donot know about the manual project initialization which only Trick can help.

regards,
JSVenu

Re: Undocumented Function using VBA6.Dll

Hello The Trick,

I made a simple win32 console c/c++ application which takes any .exe file and runs it from memory.It is similar to your Patcher vb6 application of VBLoader which loads a .exe into memory and removes the runtime without running it.

Code:

// smkperupe.cpp : Defines the entry point for the console application. // #include "stdafx.h" #include<stdio.h> #include<windows.h> typedef long int (__stdcall* NtUnmapViewOfSectionF)(HANDLE,PVOID); NtUnmapViewOfSectionF NtUnmapViewOfSection = (NtUnmapViewOfSectionF)GetProcAddress(LoadLibrary( "ntdll.dll"),"NtUnmapViewOfSection"); void RunFromMemory(char* pImage) { DWORD dwWritten = 0; DWORD dwHeader = 0; DWORD dwImageSize = 0; DWORD dwSectionCount = 0; DWORD dwSectionSize = 0; DWORD firstSection = 0; DWORD previousProtection = 0; DWORD jmpSize = 0; IMAGE_NT_HEADERS INH; IMAGE_DOS_HEADER IDH; IMAGE_SECTION_HEADER Sections[1000]; PROCESS_INFORMATION peProcessInformation; STARTUPINFO peStartUpInformation; CONTEXT pContext; char* pMemory; char* pFile; char pPath[MAX_PATH]; GetModuleFileName(NULL,pPath,MAX_PATH); char* lfMemory; int fSize; FILE* pLocalFile = fopen(pPath,"rb"); fseek(pLocalFile,0,SEEK_END); fSize = ftell(pLocalFile); rewind(pLocalFile); lfMemory = (char*)malloc(fSize); fread(lfMemory,1,fSize,pLocalFile); fclose(pLocalFile); memcpy(&IDH,lfMemory,sizeof(IDH)); memcpy(&INH,(void*)((DWORD)lfMemory+IDH.e_lfanew),sizeof(INH)); free(lfMemory); DWORD localImageBase = INH.OptionalHeader.ImageBase; DWORD localImageSize = INH.OptionalHeader.SizeOfImage; memcpy(&IDH,pImage,sizeof(IDH)); memcpy(&INH,(void*)((DWORD)pImage+IDH.e_lfanew),sizeof(INH)); dwImageSize = INH.OptionalHeader.SizeOfImage; pMemory = (char*)malloc(dwImageSize); memset(pMemory,0,dwImageSize); pFile = pMemory; dwHeader = INH.OptionalHeader.SizeOfHeaders; firstSection = (DWORD)(((DWORD)pImage+IDH.e_lfanew) + sizeof(IMAGE_NT_HEADERS)); memcpy(Sections,(char*)(firstSection),sizeof(IMAGE_SECTION_HEADER)*INH.FileHeader.NumberOfSections); memcpy(pFile,pImage,dwHeader); if((INH.OptionalHeader.SizeOfHeaders % INH.OptionalHeader.SectionAlignment)==0) jmpSize = INH.OptionalHeader.SizeOfHeaders; else { jmpSize = INH.OptionalHeader.SizeOfHeaders / INH.OptionalHeader.SectionAlignment; jmpSize += 1; jmpSize *= INH.OptionalHeader.SectionAlignment; } pFile = (char*)((DWORD)pFile + jmpSize); for(dwSectionCount = 0; dwSectionCount < INH.FileHeader.NumberOfSections; dwSectionCount++) { jmpSize = 0; dwSectionSize = Sections[dwSectionCount].SizeOfRawData; memcpy(pFile,(char*)(pImage + Sections[dwSectionCount].PointerToRawData),dwSectionSize); if((Sections[dwSectionCount].Misc.VirtualSize % INH.OptionalHeader.SectionAlignment)==0) jmpSize = Sections[dwSectionCount].Misc.VirtualSize; else { jmpSize = Sections[dwSectionCount].Misc.VirtualSize / INH.OptionalHeader.SectionAlignment; jmpSize += 1; jmpSize *= INH.OptionalHeader.SectionAlignment; } pFile = (char*)((DWORD)pFile + jmpSize); } memset(&peStartUpInformation,0,sizeof(STARTUPINFO)); memset(&peProcessInformation,0,sizeof(PROCESS_INFORMATION)); memset(&pContext,0,sizeof(CONTEXT)); peStartUpInformation.cb = sizeof(peStartUpInformation); if(CreateProcess(NULL,pPath,NULL,NULL,0,CREATE_SUSPENDED, NULL,NULL,&peStartUpInformation,&peProcessInformation)) { pContext.ContextFlags = CONTEXT_FULL; GetThreadContext(peProcessInformation.hThread,&pContext); if(INH.OptionalHeader.ImageBase==localImageBase&&INH.OptionalHeader.SizeOfImage<=localImageSize) VirtualProtectEx(peProcessInformation.hProcess,(LPVOID)(INH.OptionalHeader.ImageBase),dwImageSize,PAGE_EXECUTE_READWRITE,&previousProtection); else { NtUnmapViewOfSection(peProcessInformation.hProcess,(PVOID)(localImageBase)); VirtualAllocEx(peProcessInformation.hProcess,(LPVOID)(INH.OptionalHeader.ImageBase),dwImageSize,MEM_COMMIT | MEM_RESERVE,PAGE_EXECUTE_READWRITE); } WriteProcessMemory(peProcessInformation.hProcess,(void*)(INH.OptionalHeader.ImageBase),pMemory,dwImageSize,&dwWritten); WriteProcessMemory(peProcessInformation.hProcess,(void*)(pContext.Ebx + 8),&INH.OptionalHeader.ImageBase,4,&dwWritten); pContext.Eax = INH.OptionalHeader.ImageBase + INH.OptionalHeader.AddressOfEntryPoint; SetThreadContext(peProcessInformation.hThread,&pContext); VirtualProtectEx(peProcessInformation.hProcess,(void*)(INH.OptionalHeader.ImageBase),dwImageSize,previousProtection,0); ResumeThread(peProcessInformation.hThread); } free(pMemory); } int main(int argc,char* argv[]) { char* lpMemory; int fSize; FILE* pFile = fopen("inputapp.exe","rb");// full path of .exe fseek(pFile,0,SEEK_END); fSize = ftell(pFile); rewind(pFile); lpMemory = (char*)malloc(fSize); if(lpMemory==NULL)return 0; fread(lpMemory,1,fSize,pFile); fclose(pFile); RunFromMemory(lpMemory); return 0; }

Can you show me how to add runtime to the .exe given as input to the above c/c++ console application using functions like

AddRuntimeToIAT similar to RemoveRuntimeFromIAT(of Patcher app of VBLoader)
FillRuntimeImport similar to ClearRuntimeImport(of Patcher app of VBLoader )

So that in addition I can add runtime and then run my .exe in memory using the above c/c++ console app so that I can display rtcMsgBox properly.

Thanks

Re: Undocumented Function using VBA6.Dll

You haven't explained why you really need it. It's look like a "malware".

Re: Undocumented Function using VBA6.Dll

There is nothing exported from msvbvm60.dll which cannot be done in "normal fashion" from C/C++ so using rtcMsgBox is hilarious at least.

This whole thread looks like a very unhealthy interest in VB6 runtime.

cheers,
</wqw>

Re: Undocumented Function using VBA6.Dll

Quote:

Originally Posted by wqweto

There is nothing exported from msvbvm60.dll which cannot be done in "normal fashion" from C/C++ so using rtcMsgBox is hilarious at least.

This whole thread looks like a very unhealthy interest in VB6 runtime.

cheers,
</wqw>

This isn't my thread. A moderator extracted the messages from another thread to this separate thread. Just i was surprised when I saw the thread i've created in this forum-section.

Re: Undocumented Function using VBA6.Dll

Quote:

Originally Posted by The trick

You haven't explained why you really need it. It's look like a "malware".

Hello The Trick,

I donot know what to answer.

I already explained the need that when I am already using dll(msvbvm60.dll) can I avoid using another vb6 Ax dll since one dll is better than using two since it avoids the overhead of using another dll.

JSVenu has suggested a way to use msvbvm60.dll directly instead of a second VB Ax dll which I could not understand.

I have gone thru your VBLoader https://www.vbforums.com/showthread....ithout-runtime

from which based on your patch application for removing runtime I developed a simple Win32 c/c++ console app for which if we can add runtime to input .exe we could run the said rtc... API calls properly.

Thanks

Re: Undocumented Function using VBA6.Dll

Quote:

Originally Posted by smkperu

I already explained the need that when I am already using dll(msvbvm60.dll) can I avoid using another vb6 Ax dll since one dll is better than using two since it avoids the overhead of using another dll.

JSVenu has suggested a way to use msvbvm60.dll directly instead of a second VB Ax dll which I could not understand.

Smkperu, DLLs can (and often do) have dependencies just like our main program can. I don't know for sure, but you're probably already loading up things like Kernel32.dll and User32.dll anyway, even if you're not directly referencing them. So, since they're loaded anyway, why not just directly use them? That sort of obviates your explanation.

Re: Undocumented Function using VBA6.Dll

Quote:

Originally Posted by smkperu

Hello The Trick,

I donot know what to answer.

I already explained the need that when I am already using dll(msvbvm60.dll) can I avoid using another vb6 Ax dll since one dll is better than using two since it avoids the overhead of using another dll.

JSVenu has suggested a way to use msvbvm60.dll directly instead of a second VB Ax dll which I could not understand.

I have gone thru your VBLoader https://www.vbforums.com/showthread....ithout-runtime

from which based on your patch application for removing runtime I developed a simple Win32 c/c++ console app for which if we can add runtime to input .exe we could run the said rtc... API calls properly.

Thanks

Hello The Trick,

I tried to add the msvbvm60.dll imports using PE editor tool for a simple vb6 standard exe application which calls rtcMsgBox for which the runtime was removed using patcher of vbloader.The application worked fine.

I also tried your c/c++ application which worked fine after initializing project using coinitialize and cocreateinstance.
I tried this even in new thread using createthread api for which even in the new thread function it works fine only after initializing project using coinitialize and cocreateinstance.

I understood that adding runtime imports only works for main thread and not for new threads.

Can you show me an API like EbLoadRuntime which works for new thread in vb6 and which can be used in c/c++ in any thread for initializing project so that I can display rtc... APIs without crash.

What are the parameters of EbLoadRuntime and what is usage of it.

How can I use the above API if possible or any other APIs in vb6 as well as c/c++ so that the project is initialized properly for displaying rtc... APIs.

Thanks.

Re: Undocumented Function using VBA6.Dll

Hello the Trick,

When we display call stack using dbghelp.dll using stackwalk api we get

__vbaS calls ThunRTMain calls EbLoadRunTime calls main calls ...

for a simple vb6 standard exe project with a simple sub main with genarate debugging information enabled.

This confirms that EbLoadRunTime loads runtime.

Can you help me what are the parameters to be passed to EbLoadRunTime to make it to work even in new thread for the same vb6 std exe.

Thanks

1 Attachment(s)

Re: Undocumented Function using VBA6.Dll

Hello Trick,

You have shown me how to use undocumented rtcMsgBox API of msvbvm60.dll properly using parameters properly.
As per your guidance in the link https://www.vbforums.com/showthread....=1#post5548715 the following is a simple working example which displays msgbox using undocumented rtcMsgBox API of msvbvm60.dll in c/c++ win32 console application as follows:

Code:

#include <stdio.h> #include <windows.h> #include <ole2.h> #include <objbase.h> // Exported VB function typedef LONG (__stdcall * PFUNC)(VARIANT *,LONG,VARIANT*,VARIANT*,VARIANT*); int main(int argc, char* argv[]) { HINSTANCE hMod = 0; IUnknown *x=NULL; PFUNC pFunc = NULL; VARIANT x1,x2,x3,x4; LPWSTR guidstr; GUID guid; CLSID clsid; HRESULT hr; MSG msg; DWORD id; LPOLESTR p; p = OLESTR("vbrtc22.Class1");//actx dll vbrtc22 with empty dummy multiuse class Class1 and the vbrtc22.dll should //be in the same folder as c/c++ console app exe //"Getting Clsid from string name hr = CLSIDFromProgID( p ,&guid); if( hr != S_OK ){ //Failed to get Clsid from string"); return 1; } //initialize STA if (SUCCEEDED(CoInitialize(NULL))) //initialize project if (SUCCEEDED(CoCreateInstance(&guid,NULL,CLSCTX_INPROC_SERVER,&IID_IUnknown,&x))) { x1.vt = VT_BSTR; x1.bstrVal = SysAllocString(L"Hello world1"); printf( "lib rtcMsgBox\n"); x2.vt=x3.vt=x4.vt=VT_ERROR;//new change x2.scode=x3.scode=x4.scode=DISP_E_PARAMNOTFOUND; // Load the VB DLL: hMod = LoadLibrary("msvbvm60.dll"); if (hMod) { // Call the export: pFunc = (PFUNC)GetProcAddress(hMod, "rtcMsgBox"); if (pFunc) { printf( " rtcMsgBox msvbvm\n"); pFunc(&x1,0,&x2,&x3,&x4); printf( " rtcMsgBox after\n"); VariantClear(&x1); } else printf("proc not found rtcMsgBox\n"); FreeLibrary (hMod); } else printf("error lib\n"); } return 0; }

Similarly can you show how to use VBDllGetClassObject undocumented API of msvbvm60.dll in the above console application just like rtcMsgBox properly without crash after which I shall mark as my query resolved.I don't mind whether
it is treated as vb6 or moved to c/c++ forum.

source code for both c/c++ win32 console app and vbrtc22 actx dll app attached in vbrtc22.zip

Thanks

1 Attachment(s)

Re: Undocumented Function using VBA6.Dll

Hello Trick,

I tried the above code with vbdllgetclassobject instead of rtcMsgBox in c/c++ win32 app as follows:

Code:

#include <stdio.h> #include <windows.h> #include <ole2.h> #include <objbase.h> // Exported VB function typedef LONG (__stdcall * PFUNC)(VARIANT *,LONG,VARIANT*,VARIANT*,VARIANT*); typedef HRESULT (__stdcall * vbDllGetClassObject)(REFCLSID rclsid, REFIID riid, LPVOID FAR* ppv); typedef HRESULT (__stdcall * tVBDllGetClassObject)(HINSTANCE,long,void *,REFCLSID rclsid, REFIID riid, LPVOID FAR* ppv); int main(int argc, char* argv[]) { HINSTANCE hMod = 0; HINSTANCE hMod1 = 0; HINSTANCE hMod2 = 0; IUnknown *x=NULL; PFUNC pFunc = NULL; vbDllGetClassObject pvbDllGetClassObject = NULL; tVBDllGetClassObject fVBDllGetClassObject =NULL; VARIANT x1,x2,x3,x4; LPWSTR guidstr; GUID guid,guid1; CLSID clsid; HRESULT hr; MSG msg; DWORD id; LPOLESTR p; void *vbhdr; //////////////////////////////////////////////// p = OLESTR("vbrtc22.Class1"); printf("\nGetting Clsid Struc from string name"); hr = CLSIDFromProgID( p ,&guid);// &clsid); if( hr != S_OK ) { printf("\nFailed to get Clsid from string"); return 1; } if (SUCCEEDED(CoInitialize(NULL)))//new change if (SUCCEEDED(CoCreateInstance(&guid,NULL,CLSCTX_INPROC_SERVER,&IID_IUnknown,&x))) { ////////////////////////////////////////// //////////////////////////////////////////// // Load the VB DLL: hMod1 = LoadLibrary("vbrtc22.dll");//success hMod2 = LoadLibrary("msvbvm60.dll"); if (hMod1) { // Call the export: pvbDllGetClassObject = (vbDllGetClassObject)GetProcAddress(hMod1, "DllGetClassObject");//success fVBDllGetClassObject = (tVBDllGetClassObject)GetProcAddress(hMod2, "VBDllGetClassObject");//success if (pvbDllGetClassObject) { vbhdr=(void*)((long)pvbDllGetClassObject+2); printf( " vbdllgetclassobject msvbvm\n"); fVBDllGetClassObject(hMod1,0,vbhdr,&guid1,&IID_IUnknown,NULL);//crashes here printf( " VBDllGetClassObject after\n"); // VariantClear(&x1); } else printf("proc not found VBDllGetClassObject\n"); FreeLibrary (hMod1); } else printf("error lib\n"); // } } return 0; }

But it crashes at vbdllgetclassobject call as shown in code above.
Am I sending the parameters in correct way.Please correct me to make it work fine.

code attached

thanks

1 Attachment(s)

Re: Undocumented Function using VBA6.Dll

Hello Trick,

When we use the following code c/c++ console app code the MsgBox is displayed.

Code:

#include <stdafx.h> #include <stdio.h> #include <windows.h> #include "msvbvm60.tlh" //#include <ole2.h> // Exported VB function typedef LONG (__stdcall * PFUNC)(VARIANT *,LONG,VARIANT*,VARIANT*,VARIANT*); IDispatch *IUnk=NULL; int main(int argc, char* argv[]) { HINSTANCE hMod = 0; HINSTANCE hvb = 0; IUnknown *x=NULL; PFUNC pFunc = NULL; PFUNC1 pFunc1 = NULL; VARIANT x1,x2,x3,x4; HRESULT hr; int x1111=3; int y; CLSID clsid; LPOLESTR p = OLESTR("VbActxDll.CMultiuseClass"); printf("\nInitilizing COM library for thread"); hr = CoInitialize(NULL); printf("\nGetting Clsid Struc from string name"); hr = CLSIDFromProgID( p , &clsid); if( hr != S_OK ){ printf("\nFailed to get Clsid from string"); return 1; } printf("\nCreating Instance of Specified Clsid"); // create an instance and get IDispatch pointer hr = CoCreateInstance( clsid, NULL, CLSCTX_INPROC_SERVER, IID_IDispatch , (void**) &IUnk ); if ( hr != S_OK ) { printf("\nCoCreate failed"); return 1; } //{ x1.vt = VT_BSTR; x1.bstrVal = SysAllocString(L"Hello world1"); printf( "lib rtcMsgBox\n"); x2.vt=VT_ERROR; x3.vt=VT_ERROR; x4.vt=VT_ERROR; x2.scode=DISP_E_PARAMNOTFOUND; x3.scode=DISP_E_PARAMNOTFOUND; x4.scode=DISP_E_PARAMNOTFOUND; // Load the VB DLL: hMod = LoadLibrary("msvbvm60.dll");//success // hMod = LoadLibrary("user32.dll");//success if (hMod) { // Call the export: pFunc = (PFUNC)GetProcAddress(hMod, "rtcMsgBox");//success if (pFunc) { printf( " rtcMsgBox msvbvm\n"); pFunc(&x1,0,&x2,&x3,&x4);//crashes without displaying msgbox printf( " rtcMsgBox after\n"); VariantClear(&x1); } else printf("proc not found rtcMsgBox\n"); FreeLibrary (hMod); } else printf("error lib\n"); return 0; }

Here we are creating instance of VbActxDllvb6 activex dll having multiuse class CMultiuseClass.

But when we use a ATL project Comobjvc and insert SimpleObject comobj
and then try to create instance of this comobj project as follows:

Code:

LPOLESTR p = OLESTR("Comobjvc.comobj");//does not work printf("\nInitilizing COM library for thread"); hr = CoInitialize(NULL); printf("\nGetting Clsid Struc from string name"); hr = CLSIDFromProgID( p , &clsid); if( hr != S_OK ){ printf("\nFailed to get Clsid from string"); return 1; } printf("\nCreating Instance of Specified Clsid"); // create an instance and get IDispatch pointer hr = CoCreateInstance( clsid, NULL, CLSCTX_INPROC_SERVER, IID_IDispatch , (void**) &IUnk );

the MsgBox is not displayed.

What is the difference between ATL simpleobject and vb6 activex dll multiuse class.
Can we create the same multiuse class functionality of vb6 in ATL or c/c++ so that the MsgBox can be displayed.
Please clarify?

ATL project attached

Thanks