Hi,

Analyzing a virus written in VB6.

Used this: http://www.reteam.org/papers/e46.pdf as a reference to find the entry point of code section (Original Entry Point).

as mentioned in the PDF referenced above, the StartofCode is surrounded by a signature, E9E9E9 followed by a few 0xCC bytes and then the code and at the end again, 9E9E9E.

in my case, I get:

E9E9E9CCCCCCCC9E9E9E

the code is missing

here is the code:



how do I find the entry point in this case so that I can step through the code in debugger?

Why don't you get 'VB Decompiler' and examine the same?

VB Code is 'generally' not meant to be disassembled, but decompiled.

Have Phun

I tried to decompile it using DeDe software which is for VB. However, it could not find any Forms and code.

I am going to try VBDecompiler Lite now.

DeDe is for Delphi, not for VB.