I have a program written in VB6 with a label that is updated every time I push a button:

When I push the "Hourglass" button, the 72 label goes up by 10. How can I find the part of the program that handles this so I can set a breakpoint and examine the assembly?

Also, if the answer involves searching for strings, how would I do it without (in case I have a future program that encrypts strings or something)?


A VB6 program might be compiled to P-Code and come with a P-Code-Interpreter packed into the .exe, or it might be compiled to assembly. How to proceed is very dependent on which of these executables you have:


As pointed out by @guntram-blohm, you first need to determine if your VB6 target is compiled as P-Code or as native. If it's P-Code, I cannot help. If it's native, what you need to do is known as differential debugging. You can do it without using plugins or external tools directly from IDA.

If by any chance you're running an old version of IDA that lacks that support, you can use MyNav, a tool I wrote for doing differential debugging as a replacement for BinNavi, a tool that you might be able to use if your target is a 32 bits one.

You might also want to take a look to this question: Trace assisted code identification?.

Your Answer

