Another hint to enable buttons under VB 6

I read a few tutorials (e.g. ashraf and COCOs) about enabling VB controls, but on this target,
no one works! The behavior of my VB application is slightly different. I give you an example:

I would like to enable the root button:

Therefore, I open the application in a HEX-Editor and search for the string “Root”:

You see properties of the inactive

button “Root”:

The Name „XPButton2“

The Label “Root”

After that, there is the, from the

beginning on, active button
“Expression”:

The Name „XPButton1“

The Label “Expression”

When you compare the two
button fields there is an important
difference, the string “enabled”!

In this case it is meant: enable the

inactive mode!

Now think on an old anti-debug

trick:

E.g. an application is testing

whether smartcheck is running or
not! It is possible to search for the
name of it “SMARTCHK” (or
something like that), when the
name is found, the application
closes! To solve this problem, we
alternating one char of the search-
string, like “SMERTCHK” and
the anti-debug is gone!

The same here, to disable “the

enabling of inactive mode”, I
changed the first char to c
cnabled
And the button is active now (the same method works for every button)!

GREETZ to:

SCG

lena151, Ricardo Narvaja, SnD, ARteam and all ethical cracker outside!