VB Decompiler

MrUnleaded · Posted: Tue Oct 01, 2002 5:48 pm Post subject: OptionalObjectInfo

Parents:
Object Header

[vb:1ec62ddh]

Type OptionalObjectInfo 'If ((ObjectHeader.lObjectType AND &H2) = &H2)
  lguidObjectGUICount    As Long    '0x00 (00d) Number of ObjectGUI GUIDs (2 for Designer)
  aObjectCLSID           As Long    '0x04 (04d) Pointer to object CLSID
  lNull1                 As Long    '0x08 (08d)
  aguidObjectGUITable    As Long    '0x0C (12d) Pointer to pointers of guidObjectGUI
  lObjectDefaultIIDCount As Long    '0x10 (16d) Number of DefaultIID's
  aObjectEventsIIDTable  As Long    '0x14 (20d) Pointer to pointers of EventsIID
  lObjectEventsIIDCount  As Long    '0x18 (24d) Number of EventsIID's
  aObjectDefaultIIDTable As Long    '0x1C (28d) Pointer to pointers of DefaultIID
  lControlCount          As Long    '0x20 (32d) Number of controls
  aControlArray          As Long    '0x24 (36d) Pointer to an array of Controls
  iMethodLinkCount       As Integer '0x28 (40d) Number of Method Links
  iPCodeCount            As Integer '0x2A (42d) Number of OpCodes used
  oInitializeEvent       As Integer '0x2C (44d) Offset to Initialize Event from aMethodLinkTable
  oTerminateEvent        As Integer '0x2E (46d) Offset to Terminate Event from aMethodLinkTable
  aMethodLinkTable       As Long    '0x30 (48d) Pointer to pointers of MethodLink
  aBasicClassObject      As Long    '0x34 (52d) Pointer to an in-memory structure
  lNull2                 As Long    '0x38 (56d)
  lFlag1                 As Long    '0x3C (60d)
                                    '0x40 (64d) <-- Structure size
End Type

[/vb:1ec62ddh]

Notes:
* lNull1 and lNull2 are never written/readed by the compiler/runtime.
* lFlag1 is a temporary value only used in the IDE.
* guidObjectGUI is the same for all class modules. Since they don't have a real GUI, Visual Basic puts some general GUID for them.
* aMethodLinkTable includes: Event, Sub, Function, Property Get and Property Let; it doesn't include Declare Sub and Declare Function (API Imports).

* Why is there an array of DefaultIID and EventsIID?
-> Visual Basic saves previous IID's to keep binary compatibility between builds, so the most recent one is the one at index 0, and the other ones are there just in case there is some older project that uses a previous version of this object.

Pointers:
Control Array -> Control
aMethodLinkTable -> Method Link

_aLfa_ · Posted: Tue Oct 01, 2002 9:30 pm Post subject:

changed the name of Const1 (i verified that in all projects ive tested, but if any1 disagrees, plz tell me)

changed the name of ControlsAdress to aControlsTable
_________________
One thing only I know, and that is that I know nothing. (Socrates)

MrUnleaded · Posted: Wed Oct 02, 2002 2:51 pm Post subject: ok

[="_aLfa_":1sct6csu]changed the name of Const1 (i verified that in all projects ive tested, but if any1 disagrees, plz tell me)[/:1sct6csu]

ok...what do you mean by Form Designer??

[="_aLfa_":1sct6csu]changed the name of ControlsAdress to aControlsTable[/:1sct6csu]

the only reason i put ControlsAddress is because it implys several controls....while ControlTable impies another structure that has to do with Controls......
_________________
-MrU

_aLfa_ · Posted: Wed Oct 02, 2002 7:05 pm Post subject:

that Form_Designer is self explained
if that value =2 then its a designer, else it is a form or usercontrol or propertypage

hope u understand...
_________________
One thing only I know, and that is that I know nothing. (Socrates)

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

I cant see why a form designer would have a special flag for itself though...

MrUnleaded · Posted: Thu Oct 03, 2002 2:50 pm Post subject:

[="moogman":40bl50f7]I cant see why a form designer would have a special flag for itself though...[/:40bl50f7]

aLfa was saying that he thinks Form_Designer is part of the ObjectInfo...

i thought it was a constant.....but i never thought about Designers....i havent had time to check this out...

he was saying that this is a more direct indicator to the Presence of the OptionalObjectInfo....1=form;2=designer;im not sure on the other values;i believe he said forms are 0....im not sure.....

_aLfa_ · Posted: Thu Oct 03, 2002 5:58 pm Post subject:

possible values i found:
0=module, class (things without optional objectinfo)
1=form, usercontrol, propertypage
2=activex designer like "datadynamics activereports" or "vb6 active components"
(both 1 and 2 ve optional objectinfo)

i would any1 to test this more deeply, though...
ive only made a few tests on vb5/6
_________________
One thing only I know, and that is that I know nothing. (Socrates)

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Under "OptionalObjectInfo":

Address5 As Long ' 0x30

if non-zero, points to event procedures block for the control events for their particular parent form. This event procedures block includes pointers to GUI blocks (which in turn contain pointers to the GUI data), as well as pointers to the control events.

Don't know what you want to call it, tho.

sarge

MrUnleaded · Posted: Mon Oct 14, 2002 5:00 pm Post subject:

[="sarge":3ifa7eob]Under "OptionalObjectInfo":

Address5 As Long ' 0x30

...

Don't know what you want to call it, tho.

sarge[/:3ifa7eob]

i havent explored this area yet....it looks somewhat familiar though...im not sure why...

perhaps you could elaborate on the "control events" that this points to.....as i have found another way to find the control events and the events dont match up....
_________________
-MrU

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Note: This post was edited after posting! (So if you've already read it, read it again?)

Quickie caveat first:
I assuming that offset 0x30 of the OptionalObjectInfo, when it exists and is appended to the ObjectInfo, is equivalent to offset 0x68; at least, it works that way.

The EventBlock that this points to is the first of a series of EventBlocks that may exist (1 for the form; 1 each for each control), therefore, their quantity is not fixed.

In each EventBlock is a pointer to the GUILinkBlock; the GUILinkBlock is contains various addresses, offsets, and references to the appropriate data in the GUI code. By this, I mean that each EventBlock points to its own GUILinkBLock and that each GUILinkBlock points to a control/form in the GUI code. Obviously, each Eventblock representing a set of events for a given control, points to a GUILinkBlock that is also representing that same given control, which points to the GUI code of that control. In concept, these three items are a "married trio".

Each EventBlock also contains the address of its parent, the addresses of each possible event for that control (some will be NULL if the event has no code in it), and various other reference data including a pointer to the event code, and even a flag for the code type (PCODE or NATIVE). Since different controls have a different number of events, the size of the EventBlock will vary.

Thus, there is a variable quantity of EventBlocks, which in turn are of varying size, and which will require a varying number of GUILinkBlocks and a varying number of code pointers.

As a side thought, since the data in the GUILinkBlock needs to reference the data in the GUI code, should the structures of the GUI code be defined first? Otherwise, the data in the GUILinkBlock may not make sense. (It would seem to me that, since both the event code and the GUI code are the "parents" of the GUILinks, that both parents should be defined first.) Yes? No? Other thoughts?

sarge

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Moderators:

Should the last couple of posts maybe be moved to the "Interface/GUI-vs_Events" thread?

Sarge

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

[="sarge":2j3oqpb7]Note: This post was edited after posting! (So if you've already read it, read it again?)

Quickie caveat first:
I assuming that offset 0x30 of the OptionalObjectInfo, when it exists and is appended to the ObjectInfo, is equivalent to offset 0x68; at least, it works that way.
[/:2j3oqpb7]

Quick answer:
Yes

Sorry, i'vent read any more of your text as of yet, since it looks complicated

MrUnleaded · Posted: Wed Dec 04, 2002 4:02 pm Post subject: minor change

i havent finished looking over this struct but i changed the size due to an overlap that i found after implementing stuff that i forgot to implement hehe

anyways i just trimmed the size by 4 bytes making the length 0x44 bytes
_________________
-MrU

MrUnleaded · Posted: Fri Dec 13, 2002 7:41 am Post subject: Re: OptionalObjectInfo

Ok i updated this struct....i removed the two aGUID as Longs at the end since i found overlap here....ie the size is no more then 0x40....

i also changed Address5 to aEventLinkArray

it is an array to the Active Events
_________________
-MrU

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

HA! So does that mean tha "address6" now needs to be renamed to "address5"...so you won't have a gap? Wow! Blatant error :)

Sarge

MrUnleaded · Posted: Sat Dec 14, 2002 6:21 pm Post subject:

[="sarge":2tm3lcwo]HA! So does that mean tha "address6" now needs to be renamed to "address5"...so you won't have a gap? Wow! Blatant error

Sarge[/:2tm3lcwo]

thats alright...either way its an unknown addresss
_________________
-MrU

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

True...

Now, if only that was ALL that was unknown, we'd be in real good shape!

And...thanks for adding the easier opcode access.

Sarge

_aLfa_ · Posted: Mon Aug 02, 2004 6:04 pm Post subject:

I've changed the name of Const1 to Flag1 because this definitively isn't a constant
_________________
One thing only I know, and that is that I know nothing. (Socrates)

_aLfa_ · Posted: Sun Aug 29, 2004 2:24 pm Post subject:

Another minor update.
_________________
One thing only I know, and that is that I know nothing. (Socrates)

_aLfa_ · Posted: Tue Aug 31, 2004 5:25 pm Post subject:

I think I found the meaning to all OptionalObjectInfo unknown Address's, with some help from Alexandru for the in-memory one
Now your are able to get Event Names for in-project controls
_________________
One thing only I know, and that is that I know nothing. (Socrates)

MrUnleaded · Posted: Tue Aug 31, 2004 5:50 pm Post subject:

Very nice work
_________________
-MrU

vbgamer45 · Posted: Tue Aug 31, 2004 7:03 pm Post subject:

Bah, you used .Net datatypes again _aLfa_!

_aLfa_ · Posted: Tue Aug 31, 2004 7:43 pm Post subject:

woops
It's fixed now
_________________
One thing only I know, and that is that I know nothing. (Socrates)

MrUnleaded · Posted: Tue Aug 31, 2004 7:50 pm Post subject:

if you want to make it really confusing(from a vb5/6 programmer)..... in .net

Short is 16 bit
Integer is 32 bit
and Long is 64 bit
_________________
-MrU

_aLfa_ · Posted: Tue Aug 31, 2004 11:00 pm Post subject:

Another small fix related to guidObjectGUI

Will this stop....
_________________
One thing only I know, and that is that I know nothing. (Socrates)