VBA Rubberducking - 2018-07-16 (page 2 of 2)

« first day (1501 days earlier) ← previous day

2:00 PM

@Hosch250 but the point is that in order for that to have been a problem, it had to allow arbitrary code execution from remote source in the first place. Why not simply disallow it OOB?

Mathieu Guindon

because help desks need VNC?

@Hosch250 In Linux, I get a prominent update notification that there is a critical security patch. I need to be able to install those updates. Nobody else. When an automatic Windows update breaks my system, that is no different than any other malware.

@MathieuGuindon then make user's consent mandatory.

Mathieu Guindon

@Comintern and the Linux user will install them.. Windows users, not so sure.

should be opt-in anyway

@MathieuGuindon Probably because they're conditioned that an update will break their software.

Mathieu Guindon

2:04 PM

> Allow Windows to hijack this machine and update whenever the F it likes and reboot when you're in the middle of something? Y/N

I want a single checkbox in the Windows installer that says "I am an IT professional and am capable of maintaining my system".

Mathieu Guindon

lol

@MathieuGuindon N => Ha ha, we were only kidding. Of course we are going to do whatever. Rebooting now

Mathieu Guindon

> That's good feedback, thank you.

@this No, not "from remote source".

2:07 PM

@this most people will click yes until the problem they're trying to solve is fixed. Facebook exploited the consent mechanisms. Alerts and opt-outs are likely to be ignored by most users

@MathieuGuindon Windows users don't even know how to close Excel, much less Vim...

@Hosch250 then from where? It must have had some access somehow.

@this From the local machine.

Malware was a thing before the internet.

@Hosch250 again that implies I allowed it to be downloaded or placed it there.

@this No it doesn't.

2:08 PM

@Hosch250 You're eating your cake and having it.

It implied something else put it there--like your malicious coworker, or the network.

@Hosch250 because I granted them access.

Don't grant access, no go. Simple as that.

@this Actually no, because they sat in the cubicle next to you and you were in the rest room.

Then I get what I deserve. In some places like banks, the rule is that they must lock the workstation before leaving.

@Hosch250 or you plugged in a malicious USB cable. It wasn't a USB drive, you thought, so how can it hurt me, but there was a microchip embedded in the connector.

Mathieu Guindon

2:10 PM

if you want a safe computer, buy a brick

@MathieuGuindon If you want a brick, buy my daughter's Lenovo

Mathieu Guindon

lol

worst piece of IT equipment I've ever experienced. And corporate types rave about them - I just don't get it. Even the Ctrl key isn't in the right place - that alone is enough to make me avoid them.

@ThunderFrame perhaps the "corporate types" are PHBs?

In which case, it's the best thing you can get them.

PHB? Philosopher?

2:14 PM

dilbert.com/strip/1995-04-03

2

Pointy-haired boss

Mathieu Guindon

bwahaha

I always find it sobering when I witness the lack of IT understanding of the average office worker/graduate, let alone the average person.

Mathieu Guindon

@ThunderFrame and this is why Windows updates, and why we can't have nice things :)

@MathieuGuindon that

The auto industry mostly got it right. I have airbags, seat belts (opt-in BTW), and other safety features, but my car has yet to come to a screeching halt on its own because I didn't fill the windshield washer tank.

Mathieu Guindon

2:20 PM

careful what you wish for. soon it'll come to a screeching halt on its own because a frog is crossing the street

@Comintern that's yet to come

This is why I don't drive a Tesla. (that and the fact that I'd be bankrupt afterwards)

@MathieuGuindon ironically, better that everyone's in a driverless car than driving themselves. At least here, they are awful drivers.

yakking on cell, drinking starbuck, screaming at the kids behind, riding the shoulder, and cursing at the jerk who cut them off (and the jerk is doing exactly the same things)

Nope, not safe.

@Comintern they did throw in some airbags to save your life, but they also included some shrapnel and arranged for it to target you head, in the event of usage. You didn't ask for that feature, but sometimes the bonuses are a nice surprise

That reminds me - I need to check my recall status. LOL

2:24 PM

@this Yeah, until the car goes "Ooops, got an update" while driving on the freeway.

...and that reminds me that I need to get the transmission software updated.

@Hosch250 Ha! At least it's not same thing as a general purpose OS, so it will have much less issues and more incentives from outside to get it right, so they don't get blamed for having assembled 100,000 metal murderers.

@this LOL - I'll try to remember that when the Cyberdyne Motors dealership opens in my city.

@this "much less issues". You are setting records for the funniest thing I've heard all year.

General purpose OSes are as secure as you will get. Because billions of consumer dollars are at stake with general purpose attacks.

They've been under attack for decades.

@Comintern it's all right. They made a little boo-hoo the first time but came through with Arnie who indirectly saves the humanity, so it all evens out.

@Hosch250 I'm glad to hear that I'm funny. :)

@Hosch250 That's a non sequitur, though. The point still remains that it's vulnerable because it runs code from untrusted source. A device that runs without any internet connection or remote access is much more secure simply because there's no access.

2:37 PM

@this Are you F**** kidding me?

First of all, auto-driving cars DO have internet access.

@Hosch250 Big mistake.

Heck, most non-auto-driving cars have internet access now.

The point being, if you want to have a secured device, especially one that's going to be responsible for human lives, you better not connect it to internet.

The whole concept of auto-driving cars is that they share information with each other and a centralized DB.

@Hosch250 That's news. Last time I read, it was them working independently, watching the road.

2:40 PM

Second, let me know when random Joe slips a USB cable in there in the parking lot and connects to it to install something. Only evidence is a broken window, or maybe your door was unlocked or your window cracked....

@this Nope.

Also, look up the Fiat recall from a few years back. Someone hijacked the whole car, from brakes to gas to ignition to seatbelt. And found all other Fiat's on the road to by figuring out its network system.

The only safe car is one from the 90s or so or older.

Probably early 2000s too, but at this point, those are mostly junk.

(Of course, that kind of safe doesn't mean safe in accidents :P)

@Hosch250 While that is always a possibility, that's pretty small in comparison to hijacking a whole network of cars. If you want to avoid that, then you have to not allow access to the critical components, ever. You can't plug in all possible holes but you can disable the access entirely.

You cannot hack an unreachable system, right?

@this I just said, there's a broken window. Maybe they steal a trifle just to make it look like a theft rather than an attack.

There are far too many possibilities for me to be comfortable with this.

Heck, this would be totally awesome for kidnapping adults. Lock the doors, disable the locks, drive away.

When the cops come, get into a high-speed chase.

@Hosch250 if that's the only way to hack a car, then that's better than being able to hack a car by logging into a terminal 1000 miles away, right?

Of course it's not as good as one that has no computer to hack at all. :)

2:57 PM

bah. and how do you patch bugs in the software of the car then?

the issue is not that cars shouldn't be connected at all, the issue is that currently the incentives for securing access to cars is skewed and that even with cars, physical access is a one-hit KO for any and all security measures in place

FWIW, my car has far more physical access by strangers than my laptop.

I park outside both at home and at work.

@Vogel612 the same way you patch firmware for non-internet-connected devices; usb cables or usb drive. That requires physical access. The hard part is ensuring that you don't connect directly to a computer that might itself be compromised.

@Hosch250 True. If it's going to be a thing, people would have to be "trained" to suspect compromise of the software in event of a break-in.

3:12 PM

[rubberduck-vba/Rubberduck] bclothier created comment on issue #4085: AutoComplete - Exit Function bug

> Reopening the issue because I don't think it is fixed even in latest `next`...

Given this line:

```
Dim prop As DAO.Property|
```

Typing `enter` yields:

```
Dim prop As DAO.Property
|
End Property
```

[rubberduck-vba/Rubberduck] bclothier reopened issue #4085: AutoComplete - Exit Function bug

@this An unreachable car does me no good what-so-ever.

3:43 PM

@this They don't even suspect compromise in the event of a breakin on their PC. What makes you think they well for a car?

They'll be "well, it starts, so I guess it is OK."...

I always lock my PC out of habit, but for some reason I can never remember to shut my sunroof...

@Comintern if the Immediate Window has unrestricted access to private variables and members, and it also has its own project, and thereby a TypeLib and a GUID, I wonder whether it's possible to add a reference to the Immediate Window project using References.AddFromGuid, and then any VBA project can automate the unrestricted access, and perhaps other Immediate Windows goodies?

@ThunderFrame IIRC, VBA projects don't get a GUID. They're all Guid.Empty

3:58 PM

@this hmm, maybe it isn't exposed via the TypeLib, but I remember seeing a GUID in the binary offsets from the TV_ITEM lParams.

@ThunderFrame O_O

@ThunderFrame 0_0 O_O !!

@this but then, it could have been any old GUID, and not necessarily a "Project" GUID

@FreeMan o_O 0-()!l|1 - hows' that fot a font fail?

I really need to fire up the Immediate Window typelib and see if I can abuse it.

If it has an event source, you might hear me cheering when I find it...

@ThunderFrame indeed! ?

@Comintern You can abuse, but isn't it @ThunderFrame's job to weaponize?

4:07 PM

@Inarion by the way, the Source Code Pro font has a dotted 0, which I've always found a little irksome, but I just found a fork of Source Code Pro called Office Code Pro that uses a Slashed 0. I'm yet to install it, but it might become my new favorite.

@FreeMan @ThunderFrame excels at weaponizing the VBA syntax.

Indeed!

I particularly enjoy the ones where it breaks the VBE's syntax highlighter.

@FreeMan I hold no illusions of exclusivity on dangerous ideas. @Comintern comes up with some pretty spirited efforts.

@Comintern minor syntax highlighter bug, but On Error Goto -1 highlights the - as a keyword, but not the 1

@ThunderFrame Does that function correctly with a negative line number?

4:11 PM

-1 is a feature

-1 is not a line number unless you enter it as hex

Sep 20 '16 at 0:05, by ThunderFrame

19

Q: Difference between 'on error goto 0' and 'on error goto -1' -- VBA

Can anyone find the difference between 'On error goto -1' and 'on error goto 0' in VBA? I've tried google and msdn, but I've had no luck.

Bonjour/Good afternoon. So I thought I was losing my marbles lately, which is odd since I thought I had none left. But today I finally realized it's RD that's losing my breakpoints (F9) when I use Refactor to change variable names. Is there a way to prevent this?

@ThunderFrame That's what I was referring to, but this doesn't work (unhandled error):

Sub Foo()
-1
    Debug.Print Erl
    If Erl = -1 Then
        Exit Sub
    End If
    On Error GoTo -1
    Debug.Print 1 / 0
End Sub

This one overflows Erl:

Sub Foo()
-1
    On Error Resume Next
    Debug.Print 1 / 0
    Debug.Print Erl '65535
End Sub

@spinjector Oooh, that's gonna be a #fun one.

hehe

#workingOnIt

#slowly

4:21 PM

I haven't looked into the VBIDE about this topic yet to see if "breakpointed" lines are listed somewhere. If so, RD could remember them, and then "re-F9" them after refactoring. I'd happily take a stab at this myself, but I have yet to create the Visual Studio setup needed to start pulling and hacking. I code all day long and when I get home my brain hurts and I just want to eat, drink, and be merry, lol.

Mathieu Guindon

thing is, nothing in the VBIDE API lets us "re-F9"

or know whether there's a breakpoint anywhere for that matter

...that we know of...

Boo.

Mathieu Guindon

mind you, nothing in the VBIDE API was giving us an abstract syntax tree either..

Hell, the VBIDE can't even tell you it's window handles.

4:24 PM

Hrrmmm...what about API calls to the code window and read the text and color..? Maybe it's RTF or something..?

Yea its funny when you get into the the code module objects, and it's all just raw text and referred to by line numbers. One would think it would be a bit more complex than that.

Problem with that is that the control for code panes is completely custom drawn. Check it out in spy++ sometime - there is simply nothing in the client area of the window.

Blergh. It would figure.

Mathieu Guindon

"So we're going to give you an API to make add-ins for our wonderful IDE"

"Oh but you won't have any handle on anything remotely useful for anything"

that said, losing breakpoints is one thing - we're also losing member attributes for the same reason (i.e. because we rewrite the whole module at once), and that has me more worried - because it can turn working code into broken code

RD 4 should offer an extended API. Something like "Rubberduck Visual Basic for Applications Extensibility Objects"

Mathieu Guindon

AUE API

"Actually Useful Extensibility API"

4:29 PM

Or even better, "Rubberduck Visual Basic for Applications Sensibility Objects".

I wonder if anyone's ever done an *** OLE pun.

Mathieu Guindon

lol

haha i like that one =-D

4:42 PM

@MathieuGuindon we could collect the bookmarks, by executing NextBookmark enough times that we iterate them all, and remember each line location, but that's intrusive for a large number of bookmarks. There's no equivalent for iterating breakpoints, but given the weird breaking on non-existent breakpoints behavior, it makes me wonder whether breakpoints become part of the p-code somehow. In which case, we might eventually be able to identify them.

Mathieu Guindon

idea: replace all breakpoints with Debug.Assert False

and now we know where they are!

</badidea>

Lol

@MathieuGuindon breakpoints != breakage points

Mathieu Guindon

#If IsDebugging Then
    Debug.Assert False
#End If

@ThunderFrame How do you inspect the instance pointer?

Mathieu Guindon

^ and now you can toggle them! see, not heavy-handed at all!

4:47 PM

But what if that's what a breakpoint is: insert a p-code instruction for Stop at that line?

Mathieu Guindon

@ThunderFrame IIUC it pretty much has to be pretty much exactly that

but we don't have the p-code do we?

@IvenBach ObjPtr(myclassInstance) gives you the pointer. The property and method pointers are arranged immediately after that.

@MathieuGuindon Wayne does.

:P

Mathieu Guindon

@Hosch250 I meant the mere mortals that we are though

@MathieuGuindon oh yes we do, the TypeLib can be cast to IPersistStorage and we can call the Save method. In that stream, is the live p-code followed by the compressed source code.

4:51 PM

@ThunderFrame I can do `?objptr(varName) and get the pointer. How do I see/view the pointers?

I'm missing the blatantly obvious.

Mathieu Guindon

@ThunderFrame hmm... so identifying breakpoints is just a matter of identifying the opcode for one?

for some values of "just"

I am reading the link you provided. If it's in there I've not gotten to that part.

Download HxD (a few hex editor) and open the Excel memory space. Goto the Address returned by ObjPtr and you'll see the next blocks of 4 bytes showing you the pointers to each member.

@MathieuGuindon That sounds like the basis for being able to continue a heavy debugging session from one day to the next. I smell a feature request...

or, even better, being able to save sets of breakpoints!

So, in simple terms, if your object pointer is 240, then memory address 244 contains the pointer for the instance's first member, and 248 the address for the second nember, etc. Depending upon the member/offset, instances can share the same pointers for members, as the state variables are kept in later addresses. So dic1.Add and dic2.Add have different object pointers for the dic1 and dic2 instances, they both share the same pointer for the Add method.

@MathieuGuindon I think so, assuming our assumptions about a breakpoint being something similar to a Stop opcode hold

Mathieu Guindon

5:02 PM

have a module with 2 members, DoSomething1 and DoSomething2, each with a single instruction; get the offset for DoSomething1, the offset for DoSomething2 - now you know the byte content of DoSomething1; add a breakpoint, collect the bytes again, compare

@ThunderFrame If this is the case, couldn't we eventually decouple the parser from the code panes entirely?

@IvenBach once you have the object pointer, add 4, and use CioyMemory to read the 32-bit value from that address, then the next, and so on. Then, armed with a member pointer, you can CopyMemory again to get the member's machine instructions

How do I open Excel's memory space?

Mathieu Guindon

@Comintern but then we have the problem of writing back to the panes...

@MathieuGuindon You're right. We should probably just get rid of them.

5:03 PM

@Comintern I really don't know. Wayne undoubtedly does, but it may be one of the secrets he's unwilling to divulge

Mathieu Guindon

@Comintern also, navigating: how do we know where in the code pane foo is?

@MathieuGuindon We pick a random spot.

Mathieu Guindon

we need a bugfix sprint, a 2.3 release, and then get the ball seriously rolling with Avalon

sprint/marathon

@IvenBach programmatically, from within Excel: using CooyMemory. Using a visual tool: use a good hex editor. But be aware, all you're going to get are a series of bytes. You need to be able to interpret those bytes to know what they're doing, or even where they end.

@MathieuGuindon meh. we need continuous bugfixing.

and I don't have the mental capacity left to do it, usually :(

I can move some pieces around, but that's about it, usually

5:06 PM

Same here. I spend my non-work computer time mindlessly playing video games :(

I have trouble even working through simplish bugs on my checkers game.

relatedly: TCP is ridiculously complicated once you get down to the details

Mathieu Guindon

food o'clock, bbl

@Vogel612 You studying that? It was one of my favorite classes in college.

@Comintern oops, sorry, I misread, I thought you were talking about decoupling the RD codepane from the debugger. But can we extract the source code from the IPersistStorage? Yes, we can. Can we inject into it? I have no idea.

@Hosch250 I kinda skipped all of my lectures this semester, because I knew the basics of it from my apprenticeship

5:07 PM

LOL.

that may have been a mistake, but I'm not sure how big a mistake it was

I'm just doing the assignment right now

Read the book, and you'll be fine.

If you have time, that is.

Uni exams are the first time I've been running low on time to complete

@ThunderFrame I would imagine that it would have to read it when it compiled. I can't imagine it does that from the code pane.

I don't think I'll ever need knowledge of how signals are transmitted on the wire, though. It helps to know the basics.

But I'm reasonably happy with the protocol-level abstraction

and it's probably more than most programmers ever get to use anyways, soo...

5:11 PM

@Vogel612 Sequenced electrical pulses carefully coordinated so they don't interfere with each other.

@Comintern the last time the VBE interprets the codepane is when you finish editing a line. Unless you open a project from different VBA version or bitness, then VBE will reinterpret the source code lines. Otherwise, once a line is entered, it is converted to p-code, and then everything is p-code until runtime, at which point is compiles to excode and runs in the VM

@Hosch250 AIUI it's a bit more complicated than that. Because you may be channel-multiplexing

@Vogel612 That's part of the careful coordination part :)

so what you need is various sinus waves to overlay onto one another to create rectangular waves

@ThunderFrame LOL @ "hotness" :)

5:12 PM

Yeah, we covered that just a bit. It was cool.

the physics of that is pretty cool and it's also used in quantum computing (from my limited understanding)

@FreeMan IKR, bitness != hotness

@Vogel612 chirality and all that jazz?

@ThunderFrame unless you're a bit hot?

apparently I'm one of today's lucky 10k

@Vogel612 Did you just win a trip to Nigeria?

5:16 PM

nope. i'm wikipedia-holing myself for chirality

@Comintern the IPersistStorage is the same format that is saved to disk inside the vbProject binary inside the host document. The format is: p-code headers (including identifier tables, etc), then p-code, then the compressed source. You can actually open the disk copy, remove all of the text, and then open the project and it will run just fine.

@Comintern a cast to IPersistStorage gives us the live p-code and compressed source-code. We can decompress the source-code quite easily. Wayne makes out that decoding the p-code is quite easy, but it's undocumented unless you're an Anti-Virus company with an NDA with MS. Because you can imagine the fun a Blackhat can have by making the source code look benign, but the p-code is evil.

But, for breakpoints at least, assuming they're stored in p-code, all we need to do is establish the opcode and determine the line (still a challenge), and we should be close.

@ThunderFrame Wasn't there a VB6 decompiler project out there somewhere?

:smack self (again) for never learning ASM:

There's a p-code interpreter in GitHub, but it's a WIP

And this is a semi decompiler for VB6 github.com/VBGAMER45/Semi-VB-Decompiler

This is the p-code one github.com/bontchev/pcodedmp

@Comintern IKR

Rubberduck.Reflection.Emit(byte[] pCode)

5:35 PM

@ThunderFrame I'm looking at stuff I don't understand. Don't have the time to figure it out right now. I am still interested in how the offset works and how to read where other members are.

Virtual method table

A virtual method table (VMT), virtual function table, virtual call table, dispatch table, vtable, or vftable is a mechanism used in a programming language to support dynamic dispatch (or run-time method binding). Whenever a class defines a virtual function (or method), most compilers add a hidden member variable to the class which points to an array of pointers to (virtual) functions called the virtual method table. These pointers are used at runtime to invoke the appropriate function implementations, because at compile time it may not yet be known if the base function is to be called or a derived...

Thx @Comintern. I'll be occupied with ThunderFrame's link for a while. I feel like I might be able to grok vTable stuff this time around. Be ready for questions when I do get to reading.

5:58 PM

@IvenBach The article earlier is helpful, but you have to read through the whole thing to stitch together the valuable pieces. I can't offer any shortcuts - indeed, all I can offer is a second, even longer thread, that is again necessary to read in it's entirity - vbforums.com/…

and this is useful too - vbforums.com/…

Thanks. If I can understand the content I'm willing to put effort into learning. I'm just a little slower than most at learning things.

there really isn't very much information out there about the layout of an instance in memory. I still don't understand how exactly interfaces are laid out.

At least you have that.

I still don't understand what I don't understand.

If you know what I mean.

@IvenBach you're attempting to understand pointer arithmetics and memory layouting

there are some smart guys on that site. here's hoping once RD penetrates the VB6 space, we'll get some contributions from them. I suspect they're unaware of some of the tricks RD is now using to access hidden detail.

6:02 PM

and that's royally complicated

^

there's things that you could make educated guesses about if you could put fully defined memory layout semantics onto the things you're looking at

But I'm not aware of any public documentation of said memory layouts

There's some guesses to be ventured that you're probably dealing with something that's similar to C++

but even that isn't really guaranteed, because C++ is dark magic

@Vogel612 there aren't that many people that need to know memory layout, compared to the number needing to know about COM, interop, compiler opportunities etc.

yeap

which means the little documentation available on it is usually rather arcane

@Vogel612 or empirical/academic

or all 3

6:23 PM

@ThunderFrame I always thought they were sequential from top to bottom of each module.

Mathieu Guindon

Occam's razor agrees

@Vogel612 Is that because everything has to be handled?

@Comintern no, public variables and properties before methods, and private public makes a difference too. the 2nd vbforums link probably explains it best, with post #37 in that thread being very detailed.

@IvenBach do elaborate?

No garbage collection, memory allocation, not sure what else. Everything needs to be done by the programmer. There's little to no abstraction? I'm vague on C++ stuff.

6:29 PM

yes, no, maybe

you can write your own garbage collector, though basically implies you're writing an abstraction over the usual memory allocator

memory allocation can be hidden in C++, it does support using new

there also is some basic rules about destructors, which free the memory previously used by the object

but you can also go full C and do most of what you allocate with malloc and free

that's not considered idiomatic c++ anymore, though.

I should reread those threads, and try to write up something more cohesive, and with a more robust example. I'm afraid that might still be full of holes and errors, but maybe I could get Wayne and others to check it - gah, if only I had the time....

@ThunderFrame Ahhhh... I thought you were talking about the user code vtables.

@Vogel612 Thanks. Each time I hear the same information it's making more sense. Long road ahead, but not as long as it was yesterday.

6:55 PM

3 different versions of a workbook need to at some point be reconciled into 1. #HHCIB :tear:

7:44 PM

@QHarr Pretty neat with the xlTrail addin. That is very much needed to keep myself form FUBARing too much.

Duck check: Can Git be made to work with a local repo IE on a network?

Yes.

~~Must~~ Will carve out more time to learn how.

8:01 PM

@IvenBach Glad it was useful.

Seeing the ability to drill down into the worksheet/module was something I want for my own addins.

« first day (1501 days earlier) ← previous day

Transcript for

Jul16

VBA Rubberducking

Discussions about VBA, the VBE, C#, COM interop and Rubberduck...

antlr com-interop parsing rubberduck vb6 vba whiskey-tango-foxtrot

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2018 Stack Exchange Inc; legal

mobile