Forest Global Training Partners

Cyber Risks · Cisco Talos

Scripting the disassembler: Local agentic reverse engineering through vbdec’s live COM object model

Summary: Cisco Talos describes a technique in which vbdec, a VB6 disassembler, registers its parsed CVBProject object and main form in the Windows Running Object Table under the monikers vbdec.vbp and vbdec.frmMain when remote scripting is enabled, letting any process bind to the live object model. Talos paired this with an operator briefing file, 90 auto-generated class prototype definitions, and Claude Code run locally via cscript, which decompiled functions, emitted Graphviz call graphs, built a 600-plus-row SQLite database of PDFStreamDumper functions, and assembled an opcode database covering 1,165 dispatch slots in MSVBVM60.dll.

Why it matters: The agent and disassembler share one machine and file system, so sensitive binaries never leave the analyst's workstation and only model inference requests go out - a materially different exposure profile from uploading samples to a hosted service. The same ROT-plus-briefing pattern is presented as generalizable to any analysis tool that publishes its internal model, which means the capability surface of such tools decouples from their shipped feature list.

Read the original at Cisco Talos ↗

Topics
Malware
Related