More Information

Yes, but i don't get any imported modules but msvbvmxx.dll.

True, you might get vbrun10.dll, vbrun20.dll, vbrun30.dll, vbrun40.dll, msvbvm50.dll or msvbvm60.dll. This means that the program is written and compiled in Visual Basic.

What happens in VB programs?

The Visual Basic Virtual Machine (the DLL that you get) is a thin layer between true libraries (like Kernel32.dll) and visual basic applications. When the application is calling a function (*any* function), the vb module translates the function in real world code and invokes the equivalent library.

So, what can we do?

If we insert the appropriate symbols in Hackman Debugger, then the debugger will skip the VB machine and reveal the real calls to you. How can we find these symbols? Dump the VB Virtual Machine and try to guess what each function is doing. For example, _vbacmpstr is a function that compares two strings.

Return