VB Decompiler

ionescu007 · Sometimes here Joined: 21 Aug 2004 Posts: 33

Well, I got bored with the same old VB structure definitions that have been around for ages (from that Italian crack site). While I appreciate the work people here have done, I'm kind of disapointed that no progress has been made, especially with something like the VB Header. I mean...come on... "Flag1" is simply a WORD representing the buld number. What you see as "26 36" say, is merely 0x3626, which in decimal is 9782. Surprise surprise, the VB Runtime DLL is 6.00.97.82
Anyways, I've always been taught "if you're going to bash something, fix it".
So without further ado, here are is the completely documented VB Header, with all the flags and their signification. I'm planning on doing the same thing for every sturcture out there over the next months (although this took only a day of non-stop debugging).

Enjoy => http://www.relsoft.net/Articles/VB/vb.pdf

PS. You guys can modify the structures on the site with that info...credit would be appreciated. I'm not going to do it myself because I despire the structure abbreviations you've taken. a for pointer?! I think you should all make your lives easier and use Hungarian Notation, like 99.9% of documentation writers/programmers out there.

Best regards,
Alex Ionescu
President, Relsoft Technologies
Core Kernel Developer, ReactOS Project

_aLfa_ · Posted: Sat Aug 21, 2004 10:27 am Post subject:

I must say, you done an awesome job Ionescu
Keep up the good work.

And by the way, one of the reasons I stop 'digging' the structures was that there was no need so far, but at the moment I'm interested in digging some more, beacuse I'm going to native code
_________________
One thing only I know, and that is that I know nothing. (Socrates)

vbgamer45 · Posted: Sat Aug 21, 2004 1:24 pm Post subject:

Thank you for your hard work and information. It will be a great help to all of the community. I hope you stay around.

As for Hungarian Notation, we here tend to be visual basic programmers and I think it was decided that it was best to use prefixes such as "a" for address and "o" for offset.
Probably beacause most vb programmers have no idea what Hungarian Notation is.

Nice set
http://www.relsoft.net
Going to have to take a look at that NTFS information.

Good Luck and thank you,

vbgamer45 · Posted: Sun Aug 22, 2004 10:50 pm Post subject:

Wow, just looking at that new pdf.
All this great information on COM.
Thank you so much.
Man just when I get back to college all this new information comes on out on COM.

Thank you so much Ionescu you are doing the communtiy a big favor.
This answers to many of my questions about COM.

Beyond2000! · New User Joined: 09 Nov 2003 Posts: 2

Hi ionescu

Are you sure that the Flag1 is the dll runtime version ?

It seems to be the version the the compiler itself. (vb6.exe), and not the MSVBVM60.DLL.

On my system, the version of MSVBVM60.DLL is: 6.0.96.90

While the vb6.exe is: 6.0.89.88

Analysing teh Flag1 it shows
W$ 0231C ( 8988 in decimal)

That means it is refering to the compiler version and not the runtime library.

Best Regards,

Guga

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Generally, having found just enough significant info in a structure to allow me to move on to the next structure, I'm done with it. But, filling in any blanks is always appreciated, and may even have the unexpected result of resolving an issue that resides numerous child structures down the tree.

I think most of us here have our own agendas, certainly a variety of different ones, and not all of us need 99+% of a structure filled before we can move on.

But I have always promoted the concept of "learn and teach" (as you may see in a few of my insignifican posts around this MB), and anything you can add may, and probably will, help someone, with some info, to do something, that may have been unresolvable without your input.

I guess, in general, I can only say "More, MORE!"

Thanks
Sarge

Dr Memory · Expert Joined: 16 Aug 2004 Posts: 147 Location: Surrey, UK

What he means is, yes, thanks, that makes sense ... we'll pass that info along to any kiddies who ask ...
_________________
[size=75:2sg2dqh1]At first, I was irridescent. Then, I became transparent. Finally, I was absent ...