How to enumerate all VB6 applications that exist on a server

2008-12-09T00:17:07Z

One of my coworkers sent out a email to my team asking if anyone knew of a tool that would find any VB6 (or older) based applications on a server. He has a customer that needs to do this for support compliance reasons. When such applications are found they want to ensure they have a plan to uplift.

In order to determine if an executable is a VB application, we need to determine if it depends on VBRUN.DLL. We can do this with dumpbin.exe by using the /DEPENDENTS option.

Let's take a look at the output from this command:

C:\>for %i in (%SystemRoot%\system32\notepad.exe) do dumpbin %i /DEPENDENTS         C:\>dumpbin C:\Windows\system32\notepad.exe /DEPENDENTS   Microsoft (R) COFF/PE Dumper Version 8.00.50727.42   Copyright (C) Microsoft Corporation.  All rights reserved.           Dump of file C:\Windows\system32\notepad.exe           File Type: EXECUTABLE IMAGE           Image has the following dependencies:             ADVAPI32.dll        KERNEL32.dll        GDI32.dll        USER32.dll        ...

As we can see, we do get the DLL details we are looking for. Now, we just need to create logic that can parse the results and provide use with the details we need. Our goal is to enumerate all the executables that have a dependency on VBRULL.DLL.

Sure, we could write some C# I/O code that reads the file line-by-line, caching the name of the executables while looping and when we find VBRUN.DLL, write the executable name to a text file. Using this approach is fine, but for our purposes all we need are the details in a text and how we get them is not that important to us.

We can accomplish this task with a little batch programming.

First, lets use NOTEPAD.EXE as our baseline for establishing a command/batch file that will provide the details we need. Let's not forget the power of the "for loop" batch command.

Let's start by writing a command that will enumerate all occurrences of executables in the "%SystemRoot%\system32\" directory and dumping all dependencies for each executable to individual files.

C:\>for %i in (%SystemRoot%\system32\notepad.exe) do dumpbin %i /DEPENDENTS         C:\>dumpbin C:\Windows\system32\notepad.exe /DEPENDENTS   Microsoft (R) COFF/PE Dumper Version 8.00.50727.42   Copyright (C) Microsoft Corporation.  All rights reserved.           Dump of file C:\Windows\system32\notepad.exe           File Type: EXECUTABLE IMAGE           Image has the following dependencies:             ADVAPI32.dll        KERNEL32.dll        GDI32.dll        USER32.dll        ...

Okay, so the purpose of using a "for loop" should be clear, but in this example I will restrict it by asking for a specific file "notepad.exe". So now that I have a working "for loop" that utilizes "dumpbin.exe" to dump the dependencies, we can more to our next step, which is dumping the results to a file, then parsing each file for the occurrence of "USER32.DLL" and then outputting the executable details to a "RESULTS.TXT" file.

To boil this down a bit, we really only need two steps.

for %%i in (%SystemRoot%\system32\notepad.exe) do dumpbin %%i /DEPENDENTS /OUT:%%i.VBTXTfor %%i in (%SystemRoot%\system32\*.VBTXT) do FINDSTR /I "USER32.DLL" %%i  %%i >>RESULTS.TXTNotepad RESULTS.TXT 

Pasting the above commands into a .CMD file and running will result in notepad opening the RESULTS.TXT, which will contain an enumeration of all executables that have a dependency on "USER32.DLL". This approach can easily be used to enumerate all executables that have a dependency on "VBRULL.DLL". Of course you will need to tweak it to make it more useful.

Regards - Rick

BIZTALK SERVER 2009 beta and RFID mobile public beta announced today

2008-12-08T23:03:03Z

This is a huge milestone for the BizTalk Server Product, as it's the fist public beta of BizTalk Server 2009 and it's available for download today! Read more about the features and highlights here. The updates in BTS 2009 enable greater scalability and reliability, new Hyper-V vitalization support and lots of advances in the latest developer tools. For all the features, read the following roadmap.

Also, we release the Enterprise Service Bus Guidance 2.0 today, which delivers updated prescriptive guidance for applying ESB usage patterns with improved itinerary processing, itinerary modeling using a visual domain-specific language (DSL) tools approach, a pluggable resolver-adapter pack and an enhanced ESB management portal.

Moss 2007 dispose issues, don't be a the victim

2008-11-13T21:39:08Z

SPDisposeCheck tool officially announced

Last year I leveraged a good friend and coworker (Roger Lamb) to help identify and resolve several issues with the recent release of a MOSS Portal for one of the top 4 accounting firms.

We were experiencing frequent IIS recycles and OOM's and memory fragmentation. During our efforts, Roger and Scott Harris pin pointed some of the issues to custom code that where SPSite and SPWeb objects were not being disposed of properly.

The work that Roger and Scott put into this effort, lead to Roger's great Dispose Patterns by example guidance, a must read for any SharePoint Developer. Roger took this a step further by leading a team to create the SPDisposeCheck tool. If you develop any custom code for SharePoint, keeping an eye on Roger's blog and checking out SPDisposeCheck are a must!

Rick's Debugging, Troubleshooting Tips and Experiences

How to enumerate all VB6 applications that exist on a server

BIZTALK SERVER 2009 beta and RFID mobile public beta announced today

Moss 2007 dispose issues, don't be a the victim