williballenthin / python-vb

analysis of visual basic code
39 stars 9 forks source link

parse "vb import table" #9

Open williballenthin opened 6 years ago

williballenthin commented 6 years ago

from the test sample, we see the following strings:

VBA6.DLL
__vbaVarTstGt
__vbaDateVar
__vbaFpI4
__vbaVarSetObjAddref
__vbaVarLateMemStAd
__vbaVarLateMemCallSt
__vbaLateMemCall
__vbaVarLateMemSt
__vbaVarSetVar
__vbaVarVargNofree
__vbaInStrVar
__vbaVarCmpGt
__vbaRedimPreserve
__vbaVarForNext
__vbaVarForInit

note: this is not the import table, which is found later in the binary. i think the import table contains a superset of the above strings. so, what is the above table for?