Any thoughts or Comments appreciated

I have a visual basic program 5.0/6.0 that reads a data file in. I assume based on previous experience with the programmers style that the file done in records
i.e. open file as read len = 100 bytes

What I would like to know is what software is out there that can tell me how visual basic is reading the file in (len of records) and what integers/longs/currency etc are in each record. i.e the Type format

peterg70

Hi,
begin with filemon, if you didnt already, after use your brain and all the knowledge aquired with the tutorials that certainly you already studied.
I can say that reversing the app, analising its dead list, using a runtime debuger ..., is much more satisfacting that just running an app that prints all the information in a window full of icons, buttons and little flowers if you like!

Reverse it!

Smartcheck from Numega maybe?
Neviens.

Filemon, Regmon and particularly Smartcheck make VB reversing (especially for more "involved" protection schemes) much easier. Reading a VB dead listing will make you old before your time and IMHO would be a bloody waste of time. I don't think people should be discouraged from using tools that might actually increase their efficiency and supplement the information obtained from runtime debugging sessions (@ SL0rd). Reversers who have a basic understanding of how VB executables are structured have little to gain from a pedantic line by line examination of the muddled spaghetti-scratch-code misery that is disassembled VB. But that's just my opinion...

Filemon shows the length of access but doesn't indicate type i.e. reads in 260 length but what is that 260 made up of? Int,str,long etc.

Smartcheck (6.03) seems to go to more detail (Still playing with this).
Anyone know how to expand the following in smartcheck
Right$(String"D:\Progr....",long:1)
where the ... is what smartcheck does I want to see the whole line.

Regmon doesn't help in this case.

I have already done the Ollydbg route and found it a total nightmare especially as the main exe has timers shooting off etc. and visual basic as well.

peterg70

Two options:

I) The data file is a data file (that is, not plain text)
======================================

1. VB almost always calls through ODBC/ADO. You will need an ODBC spy for that

2. The data file can be, in most cases, compatible with some of the MS ACCESS/ MS EXCEL formats. Try importing them to that format to see what lies beneath.

3. Use TOAD (freeware/pro) to determine the table/relationships/routines, etc.

II) The data file is actually just multiple lines of records each.
=============================================

1. Copy the data file to another file (as backup)

2. From the original, remove all records, except the first line. Essentially, keep the first line and delete all others.

3. Start up any debugger and breakpoint on routines in the msvbvm60.dll and msvbvm50.dll that read text files (read up the docs on M$ site for alist of them). Alternatively, you can also find good breakpoints to place by running boundschecker/smartcheck etc OR, you may try reading the essay (in 2 parts) by Eternal Bliss, titled, (Compare Methods and Breakpoints0 - you'll get it easily if you google. The idea is, when a block of text is read, the debugger/smartcheck/boundschecker will tell you what PART of it is also being read. You can then figure out the length of each field in the record and the type.

4. The dirty way: Simply wait for the data file to be loaded in memory. BPM on read and you can check the data fields. Not working most of the time with XP combo because you have to be in the correct context, and you are not sure who's loading the data file.

Unfortunately, good programmers read the _entire_ line, and subsequently manipulate it so that the record fields are read. So do no depend entirely on the read aspect.

Have Phun

Thanks for the info

Actually I think its done by the Open File Command in Visual basic.
the file is opened for access Random

Is there any spys for the open Command in visual basic.?

the file is not a database or text file rather just data (mix of int,long,str) done as bytes.
peterg70

Sure, dasm VB is a disgrace! What I really want to say is that, its far more satisfacting (at least for me) discover such thing (like a record format ) with just the help of a runtime debugger or maybe a dead listing rather than using a final app that give all with just one click!

thanks for your post br00t_4_c