Re: Re: Re: Task #3, KeyGen ready Saturday, 13-Mar-99 04:45:13 As way of a bit more explanation, P-Code could be viewed in a number of ways. It is between true assembly and 'traditional text'. It is a theoretical machine where the instructions must be interpreted by another program (in this case the DLL). If you trace the flow through the DLL you will find that it picks up a byte from the program itself, and then decides what to do. It may require further bytes to decide how to complete each 'instruction'. This is just how your processor is working normally. You can think of the dll as your processor, and the VB program as your assembly language. What we do not know in this case is the names of all of the assembly instructions (like mov,lea,push,pop,etc) which makes it a bit difficult. I understand that there is a book called 'A Hackers Guide to VB' which does give a high-level interpretation of the VB P-Code (at least for maybe VB5,etc). I have not been able to get hold of it (its out of print). In fact knowing these relationships can enable us to go further than a simple disassembly because the VB exe file contains a lot more information, enough for a complete decompilation. Anyway, how does the dll work ? Well the program jumps to it at the start (seen with any disassembler), then the dll takes over. It sets up a register as the 'instruction pointer', in this case ESI, and starts to interpret/emulate the instructions. So you'll see the interpreter looping through the same place all the time (fetch next instruction, execute,....). Most of this goes through a number of large jump tables, which are essentially a map of all the instructions to code that does something. So we would expect something like jmp somewhere in P-Code to be jmp_byte number and this would be interpreted by the dll as follows: pick up the jmp_byte, index into our instruction decoding table and jump to routine to interpret this instruction. Routine which interprets it says, get the next few bytes which are the offset to our jump, and add to ESI, our instruction pointer, or whatever. I don't think the mappings have changed too much since previous versions of dlls and I'll hopefully have some time to spend on it soon. Anyone have that book ? Cronos. Cronos |
Joseph's Thread (Joseph) (06-Mar-99 16:55:41) |