VB Decompiler

MrUnleaded · Posted: Sat Oct 12, 2002 9:43 pm Post subject: GUI-vs-Events

[="Sarge":ais3u77l]Note: simplified(!) explanation follows:
----------------------------------------
To get an idea of the relationship format of the VB app, take a look at the text
".frm" file of any VB source code that you may have available (or, make up one
yourself). Just make sure it has both controls and their events in it. Notice
that the graphics (GUI) portion of the file is listed first, and the events are
listed after. In other words, the events for a control are NOT in the same section
of code as the graphic description of that control, but rather, all events are listed
AFTER all of the grahpics. Ok? Well, the relationship format in the app is very similar;
you will find all the graphic descriptions for a form (and its controls) first, while the
events for those controls come later. In fact, the relative positioning and relationships
of a form/control GUI code, and its event code, to another form/control with its particular
GUI code and event code, strongly suggets that the GUI code is generated separately from
the event code, and is actually appended to the app as a separate block of data. That
being the case, the question becomes,how are the blocks related?

In the GUI portion of a form/control, there is a sequence number (NOT the index number). This
sequence number holds a relationship to things like creation order (which control did you
place on the form first), Zorder, etc. When all is said and done, each form and each control on
that form, has a unique sequence number. This sequence number becomes an ID number which identifies
that particular control. Well, so what? So, this ID number is referenced in the event block of
each form. Thus, each particular block of event addresses can relate to its own particular control.

Ok so far?

So, how is this done?...Well, after you find the EventBlock for each form, you "walk through" the
sequence of addresses in that EventBlock; the structure of the EventBlocks events is such that each
controls events includes references to the controls name (located in the GUI code), the controls
ID number (located in the GUI code), and the control type (located in the GUI code). Notice that
all the significant data is located in the GUI code, and that the event code just references it.
So, as you continue to parse the various EventBlocks and their contained addresses, you get a set of addresses that point you to
other addresses that point to the data in the GUI block.

So, to tie this all together, you first analyze the GUI data (in whatever manner you see fit), but with
special attention to the ID number. Then, you analyze the EventBlock for that GUI data, and use the
ID number to "link" the event to the control it represents.

--------------
As I noted in the beginning of this post, this is a simplified explanation of how VBDE works; you will need to know and
understand a lot of details to make this work smoothly. Also, there are execptions to this explanation.
Good luck.

sarge[/:ais3u77l]

Quoted From Decompiler.com - Topic 347