Page 2 of 2 FirstFirst 12
Results 41 to 60 of 60

Thread: Undocumented Function using VBA6.Dll

  1. #41

  2. #42
    PowerPoster
    Join Date
    Jun 2013
    Posts
    7,454

    Re: Undocumented Function using VBA6.Dll

    Quote Originally Posted by smkperu View Post
    ...functions like this in msvbvm60.dll ... for which I may not be knowing equivalent in c
    The background behind 'the tricks' question above is,
    that nearly all the functions of msvbvm60.dll are covered already by "system-layer-Dlls",
    like User32, Ole32, OleAut32...

    For example the VB6-Format(...)-Function is contained in oleaut32.dll, described here:
    https://docs.microsoft.com/en-us/win...auto-varformat
    (along with a whole lot of other "Variant-Conversion-Functions", when you look at the left-hand-side of that MSDN-Page).

    And as for the few functions wich are not covered - like e.g. GetMem4,
    come on - you're working in C...
    "copying 4 Bytes around" should be a childsplay using a bit of "C-Pointer-voodoo".

    Olaf

  3. #43
    Addicted Member
    Join Date
    Dec 2021
    Posts
    144

    Re: Undocumented Function using VBA6.Dll

    Quote Originally Posted by The trick View Post
    Ask about a specific function.
    Hello The Trick,
    In msvbvm60.dll I have seen export functions like

    EbLoadRunTime
    EbCreateContext

    Can these type of functions along with coinitialize which you showed in c code of help to initialize STA, runtime and project context. as you said You need to initialize STA, runtime and project context. so that we can make the rtcMsgBox to run without using VB AX dll.

    Thanks

  4. #44
    PowerPoster
    Join Date
    Jun 2013
    Posts
    7,454

    Re: Undocumented Function using VBA6.Dll

    Quote Originally Posted by smkperu View Post
    ...so that we can make the rtcMsgBox to run without using VB AX dll.
    As said, it is easy to use the MS MessageBox-API instead of rtcMsgBox in your C-App...

    This sounds more and more like "just another hacking-attempt" to me.

    Olaf

  5. #45

  6. #46
    Addicted Member
    Join Date
    Dec 2021
    Posts
    144

    Re: Undocumented Function using VBA6.Dll

    Quote Originally Posted by The trick View Post
    No, they can't.
    Hello The Trick,


    There are many fumctions in msvbvm60.dll as follows as per DEPENDS utility as follows:


    Code:
    ThunRTMain
    VBDllUnRegisterServer
    VBDllCanUnloadNow
    VBDllRegisterServer
    VBDllGetClassObject
    UserDllMain
    DllRegisterServer
    DllUnregisterServer
    __vbaAryLock
    __vbaBoolErrVar
    __vbaRedimVar2
    __vbaStrErrVarCopy
    __vbaVarLateMemCallLd
    __vbaVarLateMemCallLdRf
    __vbaVarLateMemCallSt
    __vbaVarLateMemSt
    __vbaVarLateMemStAd
    __vbaAryVarVarg
    __vbaFpCDblR4
    __vbaFpCDblR8
    __vbaFpCSngR4
    __vbaFpCSngR8
    __vbaFpCmpCy
    __vbaFpCy
    __vbaFpI2
    __vbaFpI4
    __vbaFpR4
    __vbaFpR8
    __vbaFpUI1
    __vbaFreeObj
    __vbaFreeStr
    __vbaFreeVar
    __vbaFreeVarg
    __vbaI2Abs
    __vbaI2I4
    __vbaI2Sgn
    __vbaI4Abs
    __vbaI4Sgn
    __vbaStrCopy
    __vbaStrMove
    __vbaUI1I2
    __vbaUI1I4
    __vbaUI1Sgn
    __vbaVarCopy
    __vbaVarDup
    __vbaVarMove
    __vbaVarVargNofree
    __vbaVarZero
    __vbaVargParmRef
    __vbaVargVar
    __vbaVargVarCopy
    __vbaVargVarMove
    __vbaVargVarRef
    DLLGetDocumentation
    DllCanUnloadNow
    DllGetClassObject
    _CIatan
    _CIcos
    _CIexp
    _CIlog
    _CIsin
    _CIsqrt
    _CItan
    __vbaAptOffset
    __vbaAryConstruct2
    __vbaAryConstruct
    __vbaAryCopy
    __vbaAryDestruct
    __vbaAryMove
    __vbaAryRebase1Var
    __vbaAryRecCopy
    __vbaAryRecMove
    __vbaAryUnlock
    __vbaAryVar
    __vbaBoolStr
    __vbaBoolVar
    __vbaBoolVarNull
    __vbaCVarAryUdt
    __vbaCastObj
    __vbaCastObjVar
    __vbaCheckType
    __vbaCheckTypeVar
    __vbaChkstk
    __vbaCopyBytes
    __vbaCopyBytesZero
    __vbaCyAbs
    ProcCallEngine
    DllFunctionCall
    __vbaCyAdd
    __vbaCyErrVar
    CopyRecord
    __vbaCyFix
    __vbaCyForInit
    __vbaCyForNext
    __vbaCyI2
    TipGetAddressOfPredeclaredInstance
    __vbaCyI4
    __vbaCyInt
    __vbaCyMul
    MethCallEngine
    __vbaCyMulI2
    __vbaCySgn
    __vbaCyStr
    __vbaCySub
    __vbaCyUI1
    __vbaCyVar
    __vbaDateR4
    __vbaDateR8
    __vbaDateStr
    __vbaDateVar
    __vbaDerefAry
    __vbaDerefAry1
    __vbaEnd
    __vbaErase
    __vbaEraseKeepData
    __vbaEraseNoPop
    __vbaError
    __vbaErrorOverflow
    __vbaExceptHandler
    __vbaExitEachAry
    TipSetOption
    __vbaExitEachColl
    __vbaExitEachVar
    __vbaExitProc
    __vbaFPException
    __vbaFPFix
    __vbaFPInt
    TipUnloadProject
    __vbaFailedFriend
    __vbaFileClose
    TipCreateInstanceProject2
    EbResetProject
    EbGetHandleOfExecutingProject
    __vbaFileCloseAll
    __vbaFileLock
    __vbaFileOpen
    __vbaFileSeek
    __vbaFixstrConstruct
    __vbaForEachAry
    __vbaForEachCollAd
    __vbaForEachCollObj
    __vbaForEachCollVar
    __vbaForEachVar
    __vbaFreeObjList
    __vbaFreeStrList
    __vbaFreeVarList
    __vbaGenerateBoundsError
    __vbaGet3
    __vbaGet4
    __vbaGetFxStr3
    __vbaGetFxStr4
    __vbaGetOwner3
    __vbaGetOwner4
    __vbaGosub
    __vbaGosubFree
    __vbaGosubReturn
    __vbaHresultCheck
    __vbaHresultCheckNonvirt
    __vbaHresultCheckObj
    __vbaI2Cy
    __vbaI2ErrVar
    __vbaI2ForNextCheck
    __vbaI2Str
    __vbaI2Var
    __vbaI4Cy
    EbResetProjectNormal
    TipUnloadInstance
    __vbaI4ErrVar
    EbLibraryLoad
    EbLibraryUnload
    __vbaI4ForNextCheck
    EbLoadRunTime
    __vbaI4Str
    __vbaI4Var
    EbCreateContext
    EbDestroyContext
    EbSetContextWorkerThread
    __vbaInStr
    __vbaInStrB
    __vbaInStrVar
    __vbaInStrVarB
    __vbaInputFile
    __vbaLateIdCall
    __vbaLateIdCallLd
    EbGetErrorInfo
    __vbaLateIdCallSt
    __vbaLateIdNamedCall
    __vbaLateIdNamedCallLd
    __vbaLateIdNamedCallSt
    __vbaLateIdNamedStAd
    __vbaLateIdSt
    __vbaLateIdStAd
    __vbaLateMemCall
    __vbaLateMemCallLd
    __vbaLateMemCallSt
    __vbaLateMemNamedCall
    __vbaLateMemNamedCallLd
    __vbaLateMemNamedCallSt
    EbIsProjectOnStack
    TipCreateInstanceEx
    GetMem2
    GetMem4
    GetMem8
    GetMemStr
    GetMemVar
    GetMemObj
    PutMem2
    PutMem4
    PutMem8
    PutMemStr
    PutMemVar
    PutMemObj
    SetMemVar
    SetMemObj
    GetMemNewObj
    PutMemNewObj
    SetMemNewObj
    GetMem1
    PutMem1
    GetMemEvent
    PutMemEvent
    SetMemEvent
    __vbaLateMemNamedStAd
    __vbaLateMemSt
    __vbaLateMemStAd
    __vbaLbound
    __vbaLdZeroAry
    __vbaLenBstr
    __vbaLenBstrB
    __vbaLenVar
    __vbaLenVarB
    __vbaLineInputStr
    __vbaLineInputVar
    __vbaLsetFixstr
    __vbaLsetFixstrFree
    __vbaMidStmtBstr
    __vbaMidStmtBstrB
    __vbaMidStmtVar
    __vbaMidStmtVarB
    __vbaNameFile
    __vbaNew2
    __vbaNew
    __vbaNextEachAry
    __vbaNextEachCollAd
    __vbaNextEachCollObj
    __vbaNextEachCollVar
    __vbaNextEachVar
    __vbaObjAddref
    __vbaObjIs
    __vbaObjSet
    __vbaObjSetAddref
    __vbaObjVar
    __vbaOnError
    __vbaOnGoCheck
    __vbaPowerR8
    __vbaPrintFile
    __vbaPrintObj
    __vbaPut3
    __vbaPut4
    __vbaPutFxStr3
    __vbaPutFxStr4
    __vbaPutOwner3
    __vbaPutOwner4
    __vbaR4Cy
    __vbaR4ErrVar
    __vbaR4ForNextCheck
    __vbaR4Sgn
    __vbaR4Str
    __vbaR4Var
    __vbaR8Cy
    __vbaR8ErrVar
    __vbaR8FixI2
    __vbaR8FixI4
    __vbaR8ForNextCheck
    __vbaR8IntI2
    __vbaR8IntI4
    __vbaR8Sgn
    __vbaR8Str
    __vbaR8Var
    __vbaRaiseEvent
    __vbaRecAnsiToUni
    __vbaRecAssign
    __vbaRecDestruct
    __vbaRecDestructAnsi
    __vbaRecUniToAnsi
    __vbaRedim
    __vbaRedimPreserve
    __vbaRedimPreserveVar
    __vbaRedimPreserveVar2
    __vbaRedimVar
    __vbaRefVarAry
    __vbaResume
    __vbaRsetFixstr
    __vbaRsetFixstrFree
    __vbaSetSystemError
    __vbaStopExe
    __vbaStr2Vec
    __vbaStrAryToAnsi
    __vbaStrAryToUnicode
    __vbaStrBool
    EVENT_SINK_QueryInterface
    EVENT_SINK_AddRef
    EVENT_SINK_Release
    EVENT_SINK_GetIDsOfNames
    EVENT_SINK_Invoke
    __vbaStrCat
    __vbaStrCmp
    __vbaStrComp
    __vbaStrCompVar
    __vbaStrCy
    BASIC_CLASS_QueryInterface
    BASIC_CLASS_AddRef
    BASIC_CLASS_Release
    BASIC_CLASS_GetIDsOfNames
    BASIC_CLASS_Invoke
    __vbaStrDate
    __vbaStrFixstr
    __vbaStrI2
    __vbaStrI4
    __vbaStrLike
    BASIC_DISPINTERFACE_GetTICount
    BASIC_DISPINTERFACE_GetTypeInfo
    __vbaStrR4
    __vbaStrR8
    __vbaStrTextCmp
    __vbaStrTextLike
    __vbaStrToAnsi
    __vbaStrToUnicode
    __vbaStrUI1
    __vbaStrVarCopy
    Zombie_QueryInterface
    Zombie_AddRef
    Zombie_Release
    Zombie_GetTypeInfoCount
    Zombie_GetTypeInfo
    Zombie_GetIDsOfNames
    Zombie_Invoke
    __vbaStrVarMove
    __vbaStrVarVal
    __vbaUI1Cy
    EVENT_SINK2_AddRef
    EVENT_SINK2_Release
    __vbaUI1ErrVar
    __vbaUI1Str
    __vbaUI1Var
    __vbaUbound
    __vbaUdtVar
    __vbaUnkVar
    __vbaVar2Vec
    __vbaVarAbs
    __vbaVarAdd
    __vbaVarAnd
    __vbaVarCat
    __vbaVarCmpEq
    __vbaVarCmpGe
    __vbaVarCmpGt
    __vbaVarCmpLe
    __vbaVarCmpLt
    __vbaVarCmpNe
    __vbaVarDateVar
    __vbaVarDiv
    __vbaVarEqv
    __vbaVarErrI4
    __vbaVarFix
    __vbaVarForInit
    __vbaVarForNext
    __vbaVarIdiv
    __vbaVarImp
    __vbaVarIndexLoad
    __vbaVarIndexLoadRef
    __vbaVarIndexLoadRefLock
    __vbaVarIndexStore
    __vbaVarIndexStoreObj
    __vbaVarInt
    __vbaVarLike
    __vbaVarLikeVar
    __vbaVarMod
    __vbaVarMul
    __vbaVarNeg
    __vbaVarNot
    __vbaVarOr
    __vbaVarPow
    __vbaVarSetObj
    __vbaVarSetObjAddref
    __vbaVarSetUnk
    __vbaVarSetUnkAddref
    __vbaVarSetVar
    __vbaVarSetVarAddref
    __vbaVarSub
    __vbaVarTextCmpEq
    __vbaVarTextCmpGe
    __vbaVarTextCmpGt
    __vbaVarTextCmpLe
    __vbaVarTextCmpLt
    __vbaVarTextCmpNe
    __vbaVarTextLike
    __vbaVarTextLikeVar
    __vbaVarTextTstEq
    __vbaVarTextTstGe
    __vbaVarTextTstGt
    __vbaVarTextTstLe
    __vbaVarTextTstLt
    __vbaVarTextTstNe
    __vbaVarTstEq
    __vbaVarTstGe
    __vbaVarTstGt
    __vbaVarTstLe
    __vbaVarTstLt
    __vbaVarTstNe
    __vbaVarXor
    __vbaVargObj
    __vbaVargObjAddref
    rtcLeftBstr
    rtcLeftVar
    rtcRightBstr
    rtcRightVar
    rtcAnsiValueBstr
    rtcLowerCaseBstr
    rtcLowerCaseVar
    rtcTrimBstr
    rtcTrimVar
    rtcLeftTrimBstr
    rtcLeftTrimVar
    rtcRightTrimBstr
    rtcRightTrimVar
    rtcSpaceBstr
    rtcSpaceVar
    rtcUpperCaseBstr
    rtcUpperCaseVar
    rtcKillFiles
    rtcChangeDir
    rtcMakeDir
    rtcRemoveDir
    rtcChangeDrive
    rtcBeep
    rtcGetTimer
    rtcStrFromVar
    rtcBstrFromAnsi
    rtcPackDate
    rtcPackTime
    rtcGetDateValue
    rtcGetTimeValue
    rtcGetDayOfMonth
    rtcGetHourOfDay
    rtcGetMinuteOfHour
    rtcGetMonthOfYear
    rtcGetPresentDate
    rtcGetSecondOfMinute
    rtcSetDateVar
    rtcSetDateBstr
    rtcSetTimeVar
    rtcSetTimeBstr
    rtcGetDayOfWeek
    rtcGetYear
    rtcFileReset
    rtcFileAttributes
    rtcIsArray
    rtcIsDate
    rtcIsEmpty
    rtcIsError
    rtcIsNull
    rtcIsNumeric
    rtcIsObject
    rtcVarType
    rtDecFromVar
    rtcFileWidth
    rtcInputCount
    rtcInputCountVar
    rtcFileSeek
    rtcFileLocation
    rtcFileLength
    rtcEndOfFile
    rtcHexBstrFromVar
    rtcHexVarFromVar
    rtcOctBstrFromVar
    rtcOctVarFromVar
    rtcFileCopy
    rtcFileDateTime
    rtcFileLen
    rtcGetFileAttr
    rtcSetFileAttr
    rtcR8ValFromBstr
    rtcSin
    rtcCos
    rtcTan
    rtcAtn
    rtcExp
    rtcLog
    rtcRgb
    rtcQBColor
    rtcMacId
    rtcTypeName
    rtcIsMissing
    rtcRandomNext
    rtcRandomize
    rtcMsgBox
    rtcInputBox
    rtcAppActivate
    rtcDoEvents
    rtcSendKeys
    rtcShell
    rtcArray
    __vbaVargUnk
    __vbaVargUnkAddref
    __vbaVerifyVarObj
    rtcGetErl
    rtcStringBstr
    rtcStringVar
    rtcVarBstrFromAnsi
    rtcGetDateBstr
    rtcGetDateVar
    rtcGetTimeBstr
    rtcGetTimeVar
    rtcVarStrFromVar
    rtcSqr
    rtcIMEStatus
    rtcLeftCharBstr
    rtcLeftCharVar
    rtcRightCharBstr
    rtcRightCharVar
    rtcInputCharCount
    rtcInputCharCountVar
    rtcStrConvVar
    __vbaWriteFile
    rtcGetHostLCID
    rtcCreateObject
    rtcGetObject
    rtcAppleScript
    rtcMidBstr
    rtcMidVar
    rtcInStr
    rtcMidCharBstr
    rtcMidCharVar
    rtcInStrChar
    rtBstrFromErrVar
    rtBoolFromErrVar
    rtCyFromErrVar
    rtI2FromErrVar
    rtI4FromErrVar
    rtR4FromErrVar
    rtR8FromErrVar
    rtcDateFromVar
    rtcVarFromVar
    rtcCVErrFromVar
    VarPtr
    rtcDir
    rtcCurrentDirBstr
    rtcCurrentDir
    rtcFreeFile
    rtcCompareBstr
    rtcBstrFromFormatVar
    rtcBstrFromError
    rtcVarFromError
    rtcLenCharVar
    rtcLenVar
    rtcFixVar
    rtcAbsVar
    rtcIntVar
    rtcSgnVar
    _adj_fdiv_m16i
    rtcVarFromFormatVar
    rtcDateAdd
    rtcDateDiff
    rtcDatePart
    rtcPartition
    rtcChoose
    rtcEnvironVar
    rtcEnvironBstr
    rtcSwitch
    rtcCommandBstr
    rtcCommandVar
    rtcSLN
    rtcSYD
    rtcDDB
    rtcIPMT
    rtcPPMT
    rtcPMT
    rtcPV
    rtcFV
    rtcNPer
    rtcRate
    rtcImmediateIf
    rtcIRR
    rtcMIRR
    rtcNPV
    rtcErrObj
    rtUI1FromErrVar
    rtcVarDateFromVar
    _adj_fdiv_m32
    rtcGetSetting
    rtcSaveSetting
    rtcDeleteSetting
    rtcGetAllSettings
    rtcByteValueBstr
    rtcBstrFromByte
    rtcVarBstrFromByte
    rtcCharValueBstr
    rtcBstrFromChar
    rtcVarBstrFromChar
    rtcSetCurrentCalendar
    rtcGetCurrentCalendar
    _adj_fdiv_m32i
    rtcFormatNumber
    rtcFormatCurrency
    rtcFormatPercent
    rtcFormatDateTime
    rtcWeekdayName
    rtcMonthName
    rtcFilter
    rtcInStrRev
    rtcJoin
    rtcSplit
    rtcReplace
    rtcStrReverse
    rtcRound
    rtcCallByName
    rtcCreateObject2
    rtcStrConvVar2
    _adj_fdiv_m64
    _adj_fdiv_r
    _adj_fdivr_m16i
    _adj_fdivr_m32
    _adj_fdivr_m32i
    _adj_fdivr_m64
    _adj_fpatan
    _adj_fprem
    _adj_fprem1
    _adj_fptan
    _allmul
    
    
    
    
    
    ...
    TipInvokeMethod2
    ...
    TipInvokeMethod
    ...
    IID_IVbaHost
    EbGetObjConnectionCounts
    ...
    ...
    ...
    ...
    
    
    
    ...
    CreateIExprSrvObj
    ...
    EbGetVBAObject
    They start with rtc or Eb or _ or VBDll or DLLGet or Get or Tip etc.

    For GetMemX there is c rtlmovememory.

    For rtcMsgBox there is c MessageBox. etc

    For DLLGetxxx there is c DLLGetxxx

    For Eb ???

    For VBDll ???

    For Tip ???
    For _ ???

    So there are different types of exports.

    Is there any other way that I could manually init STA,project context,runtime ie simulate the vb AX dll functionality so that I can use export functions of msvbvm60.dll if I know the declaration of the export function.

    Thanks

  7. #47

    Thread Starter
    PowerPoster
    Join Date
    Feb 2015
    Posts
    2,797

    Re: Undocumented Function using VBA6.Dll

    Quote Originally Posted by smkperu View Post
    For GetMemX there is c rtlmovememory.
    You don't need any equvalent in C.

    Quote Originally Posted by smkperu View Post
    For rtcMsgBox there is c MessageBox. etc
    No. rtcMsgBox has different behavior when you have unattended execution option in a project.

    Quote Originally Posted by smkperu View Post
    For Eb ???

    For VBDll ???

    For Tip ???
    For _ ???
    You don't need the most of functions outside VB6-application especially in C.

    Quote Originally Posted by smkperu View Post
    Is there any other way that I could manually init STA,project context,runtime ie simulate the vb AX dll functionality so that I can use export functions of msvbvm60.dll if I know the declaration of the export function.
    Yes, there is a way to do manual initialization but i don't see reason to show it. This question looks like bunch of messages which i regularly get from script-kiddie-malware-developers which want to "bypass AV" etc. So if you want i help you to solve your issue you should explain (clear) why you want to use that method.

  8. #48
    Addicted Member
    Join Date
    Dec 2021
    Posts
    144

    Re: Undocumented Function using VBA6.Dll

    Hello The Trick,

    For initializing project instead of using separate VB Ax Dll can we use the same msvbvm60.dll for
    initializing STA and create a VB6 AxDll object so that overhead may be reduced.

    Thanks.

  9. #49
    Hyperactive Member
    Join Date
    Apr 2015
    Posts
    356

    Re: Undocumented Function using VBA6.Dll

    Quote Originally Posted by smkperu View Post
    Hello The Trick,

    For initializing project instead of using separate VB Ax Dll can we use the same msvbvm60.dll for
    initializing STA and create a VB6 AxDll object so that overhead may be reduced.

    Thanks.
    Dear smkperu,

    If you want to use msvbvm60.dll instead of a new activex dll there are two ways to initialize project:

    1. Identifying a multiuse class from msvbvm60.dll activex dll and creating its instance using cocreateinstance after calling coinitialize just as shown by Trick in his C code.

    or

    2. Getting the VBHeader(EXEProjectInfo) structure from the msvbvm60.dll thru its module instance which you already have thru LoadLibrary("msvbvm60.dll") and calling VBDllGetClassObject( by passing the VBHeader as one of input parameters to it ) after calling coinitialize in same C code.

    I donot know about the manual project initialization which only Trick can help.

    regards,
    JSVenu

  10. #50
    Addicted Member
    Join Date
    Dec 2021
    Posts
    144

    Re: Undocumented Function using VBA6.Dll

    Hello The Trick,

    I made a simple win32 console c/c++ application which takes any .exe file and runs it from memory.It is similar to your Patcher vb6 application of VBLoader which loads a .exe into memory and removes the runtime without running it.

    Code:
    // smkperupe.cpp : Defines the entry point for the console application.
    //
    
    #include "stdafx.h"
    #include<stdio.h>
    #include<windows.h>
    
    typedef long int (__stdcall* NtUnmapViewOfSectionF)(HANDLE,PVOID);
    NtUnmapViewOfSectionF NtUnmapViewOfSection = (NtUnmapViewOfSectionF)GetProcAddress(LoadLibrary(  "ntdll.dll"),"NtUnmapViewOfSection");
    
    void RunFromMemory(char* pImage)
    {
    	DWORD dwWritten = 0;
    	DWORD dwHeader = 0; 
    	DWORD dwImageSize = 0;
    	DWORD dwSectionCount = 0;
    	DWORD dwSectionSize = 0;
    	DWORD firstSection = 0;
    	DWORD previousProtection = 0;
    	DWORD jmpSize = 0;
    
    	IMAGE_NT_HEADERS INH;
    	IMAGE_DOS_HEADER IDH;
    	IMAGE_SECTION_HEADER Sections[1000];
    
    	PROCESS_INFORMATION peProcessInformation;
    	STARTUPINFO peStartUpInformation;
    	CONTEXT pContext;
    
    	char* pMemory;
    	char* pFile;
    	char pPath[MAX_PATH];
    
    	
    		GetModuleFileName(NULL,pPath,MAX_PATH);
    		char* lfMemory;
    		int fSize;
    		FILE* pLocalFile = fopen(pPath,"rb");
    		fseek(pLocalFile,0,SEEK_END);
    		fSize = ftell(pLocalFile);
    		rewind(pLocalFile);
    		lfMemory = (char*)malloc(fSize);
    		fread(lfMemory,1,fSize,pLocalFile);
    		fclose(pLocalFile);
    		memcpy(&IDH,lfMemory,sizeof(IDH));
    		memcpy(&INH,(void*)((DWORD)lfMemory+IDH.e_lfanew),sizeof(INH));
    		free(lfMemory);
    	
    	DWORD localImageBase = INH.OptionalHeader.ImageBase;
    	DWORD localImageSize = INH.OptionalHeader.SizeOfImage;
    
    	memcpy(&IDH,pImage,sizeof(IDH));
    	memcpy(&INH,(void*)((DWORD)pImage+IDH.e_lfanew),sizeof(INH));
    		
    	dwImageSize = INH.OptionalHeader.SizeOfImage;
    	pMemory = (char*)malloc(dwImageSize);
    	memset(pMemory,0,dwImageSize);
    	pFile = pMemory;
    
    	dwHeader = INH.OptionalHeader.SizeOfHeaders;
    	firstSection = (DWORD)(((DWORD)pImage+IDH.e_lfanew) + sizeof(IMAGE_NT_HEADERS));
    	memcpy(Sections,(char*)(firstSection),sizeof(IMAGE_SECTION_HEADER)*INH.FileHeader.NumberOfSections);
    
    	memcpy(pFile,pImage,dwHeader);
    
    	if((INH.OptionalHeader.SizeOfHeaders % INH.OptionalHeader.SectionAlignment)==0)
    		jmpSize = INH.OptionalHeader.SizeOfHeaders;
    	else
    	{
    		jmpSize = INH.OptionalHeader.SizeOfHeaders / INH.OptionalHeader.SectionAlignment;
    		jmpSize += 1;
    		jmpSize *= INH.OptionalHeader.SectionAlignment;
    	}
    
    	pFile = (char*)((DWORD)pFile + jmpSize);
    
    	for(dwSectionCount = 0; dwSectionCount < INH.FileHeader.NumberOfSections; dwSectionCount++)
    	{
    		jmpSize = 0;
    		dwSectionSize = Sections[dwSectionCount].SizeOfRawData;
    		memcpy(pFile,(char*)(pImage + Sections[dwSectionCount].PointerToRawData),dwSectionSize);
    		
    		if((Sections[dwSectionCount].Misc.VirtualSize % INH.OptionalHeader.SectionAlignment)==0)
    			jmpSize = Sections[dwSectionCount].Misc.VirtualSize;
    		else
    		{
    			jmpSize = Sections[dwSectionCount].Misc.VirtualSize / INH.OptionalHeader.SectionAlignment;
    			jmpSize += 1;
    			jmpSize *= INH.OptionalHeader.SectionAlignment;
    		}
    		pFile = (char*)((DWORD)pFile + jmpSize);
    	}
    
    
    	memset(&peStartUpInformation,0,sizeof(STARTUPINFO));
    	memset(&peProcessInformation,0,sizeof(PROCESS_INFORMATION));
    	memset(&pContext,0,sizeof(CONTEXT));
    
    	peStartUpInformation.cb = sizeof(peStartUpInformation);
    	if(CreateProcess(NULL,pPath,NULL,NULL,0,CREATE_SUSPENDED, NULL,NULL,&peStartUpInformation,&peProcessInformation))
    	{
    		pContext.ContextFlags = CONTEXT_FULL;
    		GetThreadContext(peProcessInformation.hThread,&pContext);
    		if(INH.OptionalHeader.ImageBase==localImageBase&&INH.OptionalHeader.SizeOfImage<=localImageSize)
    			VirtualProtectEx(peProcessInformation.hProcess,(LPVOID)(INH.OptionalHeader.ImageBase),dwImageSize,PAGE_EXECUTE_READWRITE,&previousProtection);
    		else
    		{
    			NtUnmapViewOfSection(peProcessInformation.hProcess,(PVOID)(localImageBase));
                            VirtualAllocEx(peProcessInformation.hProcess,(LPVOID)(INH.OptionalHeader.ImageBase),dwImageSize,MEM_COMMIT | MEM_RESERVE,PAGE_EXECUTE_READWRITE);
    		}
    		WriteProcessMemory(peProcessInformation.hProcess,(void*)(INH.OptionalHeader.ImageBase),pMemory,dwImageSize,&dwWritten);
    		WriteProcessMemory(peProcessInformation.hProcess,(void*)(pContext.Ebx + 8),&INH.OptionalHeader.ImageBase,4,&dwWritten);
    		pContext.Eax = INH.OptionalHeader.ImageBase + INH.OptionalHeader.AddressOfEntryPoint;
    		SetThreadContext(peProcessInformation.hThread,&pContext);
    		VirtualProtectEx(peProcessInformation.hProcess,(void*)(INH.OptionalHeader.ImageBase),dwImageSize,previousProtection,0);
    		ResumeThread(peProcessInformation.hThread);
    	}
    	free(pMemory);
    }
    
    int main(int argc,char* argv[])
    {
    	char* lpMemory;
    	int fSize;
    	FILE* pFile = fopen("inputapp.exe","rb");// full path of  .exe
    	fseek(pFile,0,SEEK_END);
    	fSize = ftell(pFile);
    	rewind(pFile);
    	lpMemory = (char*)malloc(fSize);
    	if(lpMemory==NULL)return 0;
    	fread(lpMemory,1,fSize,pFile);
    	fclose(pFile);
    	RunFromMemory(lpMemory);	
    	return 0;
    }
    Can you show me how to add runtime to the .exe given as input to the above c/c++ console application using functions like

    AddRuntimeToIAT similar to RemoveRuntimeFromIAT(of Patcher app of VBLoader)
    FillRuntimeImport similar to ClearRuntimeImport(of Patcher app of VBLoader )

    So that in addition I can add runtime and then run my .exe in memory using the above c/c++ console app so that I can display rtcMsgBox properly.

    Thanks

  11. #51

  12. #52
    PowerPoster wqweto's Avatar
    Join Date
    May 2011
    Location
    Sofia, Bulgaria
    Posts
    6,203

    Re: Undocumented Function using VBA6.Dll

    There is nothing exported from msvbvm60.dll which cannot be done in "normal fashion" from C/C++ so using rtcMsgBox is hilarious at least.

    This whole thread looks like a very unhealthy interest in VB6 runtime.

    cheers,
    </wqw>

  13. #53

  14. #54
    Addicted Member
    Join Date
    Dec 2021
    Posts
    144

    Re: Undocumented Function using VBA6.Dll

    Quote Originally Posted by The trick View Post
    You haven't explained why you really need it. It's look like a "malware".
    Hello The Trick,

    I donot know what to answer.

    I already explained the need that when I am already using dll(msvbvm60.dll) can I avoid using another vb6 Ax dll since one dll is better than using two since it avoids the overhead of using another dll.

    JSVenu has suggested a way to use msvbvm60.dll directly instead of a second VB Ax dll which I could not understand.

    I have gone thru your VBLoader https://www.vbforums.com/showthread....ithout-runtime

    from which based on your patch application for removing runtime I developed a simple Win32 c/c++ console app for which if we can add runtime to input .exe we could run the said rtc... API calls properly.

    Thanks

  15. #55
    PowerPoster Elroy's Avatar
    Join Date
    Jun 2014
    Location
    Near Nashville TN
    Posts
    10,918

    Re: Undocumented Function using VBA6.Dll

    Quote Originally Posted by smkperu View Post
    I already explained the need that when I am already using dll(msvbvm60.dll) can I avoid using another vb6 Ax dll since one dll is better than using two since it avoids the overhead of using another dll.

    JSVenu has suggested a way to use msvbvm60.dll directly instead of a second VB Ax dll which I could not understand.
    Smkperu, DLLs can (and often do) have dependencies just like our main program can. I don't know for sure, but you're probably already loading up things like Kernel32.dll and User32.dll anyway, even if you're not directly referencing them. So, since they're loaded anyway, why not just directly use them? That sort of obviates your explanation.
    Any software I post in these forums written by me is provided "AS IS" without warranty of any kind, expressed or implied, and permission is hereby granted, free of charge and without restriction, to any person obtaining a copy. To all, peace and happiness.

  16. #56
    Addicted Member
    Join Date
    Dec 2021
    Posts
    144

    Re: Undocumented Function using VBA6.Dll

    Quote Originally Posted by smkperu View Post
    Hello The Trick,

    I donot know what to answer.

    I already explained the need that when I am already using dll(msvbvm60.dll) can I avoid using another vb6 Ax dll since one dll is better than using two since it avoids the overhead of using another dll.

    JSVenu has suggested a way to use msvbvm60.dll directly instead of a second VB Ax dll which I could not understand.

    I have gone thru your VBLoader https://www.vbforums.com/showthread....ithout-runtime

    from which based on your patch application for removing runtime I developed a simple Win32 c/c++ console app for which if we can add runtime to input .exe we could run the said rtc... API calls properly.

    Thanks

    Hello The Trick,

    I tried to add the msvbvm60.dll imports using PE editor tool for a simple vb6 standard exe application which calls rtcMsgBox for which the runtime was removed using patcher of vbloader.The application worked fine.

    I also tried your c/c++ application which worked fine after initializing project using coinitialize and cocreateinstance.
    I tried this even in new thread using createthread api for which even in the new thread function it works fine only after initializing project using coinitialize and cocreateinstance.

    I understood that adding runtime imports only works for main thread and not for new threads.

    Can you show me an API like EbLoadRuntime which works for new thread in vb6 and which can be used in c/c++ in any thread for initializing project so that I can display rtc... APIs without crash.

    What are the parameters of EbLoadRuntime and what is usage of it.

    How can I use the above API if possible or any other APIs in vb6 as well as c/c++ so that the project is initialized properly for displaying rtc... APIs.

    Thanks.

  17. #57
    Addicted Member
    Join Date
    Dec 2021
    Posts
    144

    Re: Undocumented Function using VBA6.Dll

    Hello the Trick,

    When we display call stack using dbghelp.dll using stackwalk api we get

    __vbaS calls ThunRTMain calls EbLoadRunTime calls main calls ...

    for a simple vb6 standard exe project with a simple sub main with genarate debugging information enabled.

    This confirms that EbLoadRunTime loads runtime.

    Can you help me what are the parameters to be passed to EbLoadRunTime to make it to work even in new thread for the same vb6 std exe.

    Thanks

  18. #58
    Addicted Member
    Join Date
    Dec 2021
    Posts
    144

    Re: Undocumented Function using VBA6.Dll

    Hello Trick,

    You have shown me how to use undocumented rtcMsgBox API of msvbvm60.dll properly using parameters properly.
    As per your guidance in the link https://www.vbforums.com/showthread....=1#post5548715 the following is a simple working example which displays msgbox using undocumented rtcMsgBox API of msvbvm60.dll in c/c++ win32 console application as follows:


    Code:
    #include <stdio.h>
    #include <windows.h>
    #include <ole2.h>
    #include <objbase.h>
    
    // Exported VB function
    typedef LONG (__stdcall * PFUNC)(VARIANT *,LONG,VARIANT*,VARIANT*,VARIANT*);
    
    int main(int argc, char* argv[])
    {
     	HINSTANCE hMod = 0;
    	IUnknown *x=NULL;
    	PFUNC pFunc = NULL;
    	VARIANT x1,x2,x3,x4;
    
        
         LPWSTR guidstr;
         GUID guid;
         CLSID      clsid;
         HRESULT	   hr;
         MSG msg;
         DWORD id;
         LPOLESTR   p;
    	
        
    	
         p = OLESTR("vbrtc22.Class1");//actx dll vbrtc22 with empty dummy multiuse class Class1 and the vbrtc22.dll should
                                      //be in the same folder as c/c++ console app exe
    
    	 //"Getting Clsid  from string name
    	 hr = CLSIDFromProgID( p ,&guid);
    
    	 if( hr != S_OK  ){
    		 //Failed to get Clsid from string");
    		 return 1;
    	 }
            //initialize STA
    	if (SUCCEEDED(CoInitialize(NULL)))
    
    	//initialize project
    	if (SUCCEEDED(CoCreateInstance(&guid,NULL,CLSCTX_INPROC_SERVER,&IID_IUnknown,&x)))
    	{
            x1.vt = VT_BSTR;
            x1.bstrVal = SysAllocString(L"Hello world1");
            
    
    	printf( "lib rtcMsgBox\n");
    
    
    	x2.vt=x3.vt=x4.vt=VT_ERROR;//new change
    	x2.scode=x3.scode=x4.scode=DISP_E_PARAMNOTFOUND;
    
    
    	// Load the VB DLL:
    	hMod = LoadLibrary("msvbvm60.dll");
    	
    
    	if (hMod)
    	{
    		// Call the export:
    		pFunc = (PFUNC)GetProcAddress(hMod, "rtcMsgBox");
    		
    
    		if (pFunc)
    		{
    			
    			printf( " rtcMsgBox msvbvm\n");
    			pFunc(&x1,0,&x2,&x3,&x4); 
    			printf( " rtcMsgBox after\n");
    			VariantClear(&x1);
    		
    		} else
    			printf("proc not found rtcMsgBox\n");
    
    		FreeLibrary (hMod);
    	} else
    		printf("error  lib\n");
    	}
    		
    	return 0;
    }




    Similarly can you show how to use VBDllGetClassObject undocumented API of msvbvm60.dll in the above console application just like rtcMsgBox properly without crash after which I shall mark as my query resolved.I don't mind whether
    it is treated as vb6 or moved to c/c++ forum.

    source code for both c/c++ win32 console app and vbrtc22 actx dll app attached in vbrtc22.zip

    Thanks
    Attached Files Attached Files

  19. #59
    Addicted Member
    Join Date
    Dec 2021
    Posts
    144

    Re: Undocumented Function using VBA6.Dll

    Hello Trick,

    I tried the above code with vbdllgetclassobject instead of rtcMsgBox in c/c++ win32 app as follows:


    Code:
    #include <stdio.h>
    #include <windows.h>
    #include <ole2.h>
    #include <objbase.h>
    
    // Exported VB function
    typedef LONG (__stdcall * PFUNC)(VARIANT *,LONG,VARIANT*,VARIANT*,VARIANT*);
    
    typedef HRESULT (__stdcall * vbDllGetClassObject)(REFCLSID rclsid, REFIID riid, LPVOID FAR* ppv);
    typedef HRESULT (__stdcall * tVBDllGetClassObject)(HINSTANCE,long,void *,REFCLSID rclsid, REFIID riid, LPVOID FAR* ppv);
    
    
    
    
    int main(int argc, char* argv[])
    {
     	HINSTANCE hMod = 0;
    	HINSTANCE hMod1 = 0;
    	HINSTANCE hMod2 = 0;
    	IUnknown *x=NULL;
    	PFUNC pFunc = NULL;
    	vbDllGetClassObject pvbDllGetClassObject  = NULL;
    	tVBDllGetClassObject fVBDllGetClassObject =NULL;
    	VARIANT x1,x2,x3,x4;
    
        
         LPWSTR guidstr;
         GUID guid,guid1;
         CLSID      clsid;
    	 HRESULT	   hr;
    	 MSG msg;
    	 DWORD id;
         LPOLESTR   p;
    
          void *vbhdr;
    
     	 ////////////////////////////////////////////////
    
    
    
    
    
    
    	
        p = OLESTR("vbrtc22.Class1");
    
    	 printf("\nGetting Clsid Struc from string name");
    	 hr = CLSIDFromProgID( p ,&guid);// &clsid);
    
    	 if( hr != S_OK  )
    	 {
    		 printf("\nFailed to get Clsid from string");
    		 return 1;
    	 }
    
    
    
    
    
    
    
    	if (SUCCEEDED(CoInitialize(NULL)))//new change
    	
    	if (SUCCEEDED(CoCreateInstance(&guid,NULL,CLSCTX_INPROC_SERVER,&IID_IUnknown,&x)))
    	{
    
    
    //////////////////////////////////////////
    
    
             ////////////////////////////////////////////
    
         	// Load the VB DLL:
    	hMod1 = LoadLibrary("vbrtc22.dll");//success
    	hMod2 = LoadLibrary("msvbvm60.dll");
    
    	if (hMod1)
    	{
    		// Call the export:
    		pvbDllGetClassObject = (vbDllGetClassObject)GetProcAddress(hMod1, "DllGetClassObject");//success
    		
    		fVBDllGetClassObject = (tVBDllGetClassObject)GetProcAddress(hMod2, "VBDllGetClassObject");//success
    	
    
    		if (pvbDllGetClassObject)
    		{
    			vbhdr=(void*)((long)pvbDllGetClassObject+2);
    			
    			printf( " vbdllgetclassobject msvbvm\n");
    			fVBDllGetClassObject(hMod1,0,vbhdr,&guid1,&IID_IUnknown,NULL);//crashes here
    			printf( " VBDllGetClassObject after\n");
    		//	VariantClear(&x1);
    		
    		} else
    			printf("proc not found VBDllGetClassObject\n");
    
    		FreeLibrary (hMod1);
    	} else
    		printf("error  lib\n");
    //	}
    
    
    
    
    
    	}
        
    	
    	return 0;
    }
    But it crashes at vbdllgetclassobject call as shown in code above.
    Am I sending the parameters in correct way.Please correct me to make it work fine.


    code attached

    thanks
    Attached Files Attached Files

  20. #60
    Addicted Member
    Join Date
    Dec 2021
    Posts
    144

    Re: Undocumented Function using VBA6.Dll

    Hello Trick,


    When we use the following code c/c++ console app code the MsgBox is displayed.

    Code:
    #include <stdafx.h>
    #include <stdio.h>
    #include <windows.h>
    #include "msvbvm60.tlh"
    //#include <ole2.h>
    // Exported VB function
    typedef LONG (__stdcall * PFUNC)(VARIANT *,LONG,VARIANT*,VARIANT*,VARIANT*);
    
    
    IDispatch *IUnk=NULL;
    int main(int argc, char* argv[])
    {
     	HINSTANCE hMod = 0;
    	HINSTANCE hvb = 0;
    	IUnknown *x=NULL;
    	PFUNC pFunc = NULL;
    	PFUNC1 pFunc1 = NULL;
    	VARIANT x1,x2,x3,x4;
    
        HRESULT hr;
        int x1111=3;
    	int y;
    
    CLSID      clsid;
    
    
    
    
    	
         LPOLESTR   p = OLESTR("VbActxDll.CMultiuseClass");
    	
    	 printf("\nInitilizing COM library for thread");
         hr = CoInitialize(NULL);
    
    	 printf("\nGetting Clsid Struc from string name");
    	 hr = CLSIDFromProgID( p , &clsid);
    
    	 if( hr != S_OK  ){
    		 printf("\nFailed to get Clsid from string");
    		 return 1;
    	 }
    
    	 printf("\nCreating Instance of Specified Clsid");
    	 // create an instance and get IDispatch pointer
    	 hr =  CoCreateInstance( clsid,
    							 NULL,
    							 CLSCTX_INPROC_SERVER,
    							 IID_IDispatch  ,
    							 (void**) &IUnk
    						   );
    
    	 if ( hr != S_OK )
    	 {
    	   printf("\nCoCreate failed");
    	   return 1;
    	 }
    	
    	//{
        x1.vt = VT_BSTR;
        x1.bstrVal = SysAllocString(L"Hello world1");
            
    
    	printf( "lib rtcMsgBox\n");
    	x2.vt=VT_ERROR;
    	x3.vt=VT_ERROR;
    	x4.vt=VT_ERROR;
    	x2.scode=DISP_E_PARAMNOTFOUND;
    		x3.scode=DISP_E_PARAMNOTFOUND;
    		x4.scode=DISP_E_PARAMNOTFOUND;
    
    
    	// Load the VB DLL:
    	hMod = LoadLibrary("msvbvm60.dll");//success
    	//	hMod = LoadLibrary("user32.dll");//success
    
    	if (hMod)
    	{
    
    
    
    
    		// Call the export:
    		pFunc = (PFUNC)GetProcAddress(hMod, "rtcMsgBox");//success
    		
    
    		if (pFunc)
    		{
    			
    			printf( " rtcMsgBox msvbvm\n");
    			pFunc(&x1,0,&x2,&x3,&x4);//crashes without  displaying msgbox 
    			printf( " rtcMsgBox after\n");
    			VariantClear(&x1);
    		
    		} else
    			printf("proc not found rtcMsgBox\n");
    
    		FreeLibrary (hMod);
    	} else
    		printf("error  lib\n");
    
    	return 0;
    }
    Here we are creating instance of VbActxDllvb6 activex dll having multiuse class CMultiuseClass.

    But when we use a ATL project Comobjvc and insert SimpleObject comobj
    and then try to create instance of this comobj project as follows:


    Code:
    LPOLESTR   p = OLESTR("Comobjvc.comobj");//does not work
    	
    	 printf("\nInitilizing COM library for thread");
         hr = CoInitialize(NULL);
    
    	 printf("\nGetting Clsid Struc from string name");
    	 hr = CLSIDFromProgID( p , &clsid);
    
    	 if( hr != S_OK  ){
    		 printf("\nFailed to get Clsid from string");
    		 return 1;
    	 }
    
    	 printf("\nCreating Instance of Specified Clsid");
    	 // create an instance and get IDispatch pointer
    	 hr =  CoCreateInstance( clsid,
    							 NULL,
    							 CLSCTX_INPROC_SERVER,
    							 IID_IDispatch  ,
    							 (void**) &IUnk
    						   );

    the MsgBox is not displayed.

    What is the difference between ATL simpleobject and vb6 activex dll multiuse class.
    Can we create the same multiuse class functionality of vb6 in ATL or c/c++ so that the MsgBox can be displayed.
    Please clarify?

    ATL project attached

    Thanks
    Attached Files Attached Files

Page 2 of 2 FirstFirst 12

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Click Here to Expand Forum to Full Width