VB Decompiler

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

[="Sarge":36buui6m]
'if Flag = 0x00000006
(ExampleCode)
{
23 2D FB FC FA A0 68 10 A7 38 08 00 2B 33 71 B5
}

Some comments about this Code:
1. It starts at $1B98, the first of a pair of <something>, the second entry
of the pair starts at $1BA8 and probably ends at $1BB7
3. Why is only one of the two indicated here (the $D34C address is in the
middle of text), but the pair is indicated at $1BBC? This may be a rhetorical question = if we figure out what it does, the question may be answered.

Note that this particular usage of the Declaration function is not the
same as the actual declaration call made in a module. In this high level
(Project level) table, all of the declarations in the entire exe are
"registered" (for lack of a better word) before they are used. In the
modules themselves, links (handles? reference numbers? addresses?) are used.

Sarge
[/:36buui6m]
AAARGGHHH F*CKING B*STARDS. I just wrote a huge reply to this Sarge, but Internet Explorer crashed so unfortunately you cannot have it.

Basically, it went:

@ Yeah, I agree with those (I cant be bothered to re-argue my points because they were so minor, its not worth the text hehe)

@ I treat your "ExampleCode" just as I would with the 07 - as strings for the moment, and then just ignore them.

@ I've been looking for that link from the pcode reference to this reference for ages, and still havent been able to find it. I did go into great depth of my methods, but now I cannot be bothered. If I find anything, i'll let you all know... (I was basically looking up the files, loading them and getting the EntryPoints of the functions and comparing to no avail)

@ At the moment, i've got another structure:
Private Type ExternalInfoFinal
LibraryName As String
FunctionName As String

EntryPoint As Long
DeclareString As String
End Type

That pulls all the information together, ready for when that link becomes apparent (?). .DecareString is obtained (at the moment), by loading a database file stolen from the win32api viewer program and gets the definitions from there. I was thinking about interfacing it to the real windows sdk header files and doing a conversion routine - that'd keep it really up to date, but its useless for the moment

PS.

Private Type ExternalHeader
Unknown1 As Integer ' 06 for internal VB one? 07 for real external?
Unknown2 As Integer
aExternalInfo As Long
End Type

Private Type ExternalInfo
aLibraryName As Long ' Null-terminated ansi string defining the name of the library
aFunctionName As Long ' Null-terminated ansi string defining the name of the function
End Type[/]

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Understood, and thanks for the effort. But don't kill yourself over it. As long as we keep/post what we know, even if it's only half the info, we're making progress. So make/post the struct info as you see fit, maybe with caveats....or not. Maybe someone else will give us so info (hint to the couple of you out there that I know probably know this!!)

As usual, I only want to make the info available; it seemed that there was no data whatsoever on the declaration stuff anyplace here, so I though I'd give it a starting point. We can, of course, continue on with other stuff, including more clean-up, while this particular subject simmers. But hey, its nearing holiday time, so let's not forget there's more to life than this [ but, not much more:) ]

I'll keep looking for the declaration link, of course, as you are.

Sarge

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

Sarge, can you make a new topic instead of adding to the "Requests and Changes" topic. Then add a link in that section to the new topic. I think that is the way that the "Requests and Changes" topic was intended Plus, its hell trying to split the topics and fix the user names etc. Oh, and Merry Christmas hehe

Ta very much,
moog

MrUnleaded · Posted: Wed Dec 18, 2002 4:26 pm Post subject: its a guid

[="moogman":302n1blx][="Sarge":302n1blx]
'if Flag = 0x00000006
(ExampleCode)
{
23 2D FB FC FA A0 68 10 A7 38 08 00 2B 33 71 B5
}

Some comments about this Code:
1. It starts at $1B98, the first of a pair of <something>, the second entry
of the pair starts at $1BA8 and probably ends at $1BB7
3. Why is only one of the two indicated here (the $D34C address is in the
middle of text), but the pair is indicated at $1BBC? This may be a rhetorical question = if we figure out what it does, the question may be answered.

[/:302n1blx][/:302n1blx]

i dont know if you guys realized but the above string of bytes is the GUID for VB6.olb
_________________
-MrU

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Well, I sort of half thought of something like that...the 23 is the number sign "#", which is alway a flag to me. But, I hadn't gotten that far with GUID's yet. Ok, then, so why would there be a reference to the OLB, rather than a reference to some operation inside the OLB? Maybe there's more info needed that we haven't found yet? Or doesn't it work that way?
(Just rhetorical, to start the juices flowing)

Cool, let's add it to our knowledge....oh, we already did!

Sarge