VB Decompiler

MrUnleaded · Posted: Mon Sep 30, 2002 6:11 pm Post subject: Notes: Object->ObjectType

[code=text:m3cont87]

Form:         0000 0000 0001 1000 0000 1000 0011 -->   18083       
              0000 0000 0001 1000 0000 1010 0011 -->   180A3
              0000 0000 0001 1000 0000 1100 0011 -->   180C3 
Module:       0000 0000 0001 1000 0000 0000 0001 -->   18001
              0000 0000 0001 1000 0000 0010 0001 -->   18021
Class:        0000 0001 0001 1000 0000 0000 0011 -->  118003
              0000 0001 0011 1000 0000 0000 0011 -->  138003
              0000 0000 0001 1000 0000 0010 0011 -->   18023
              0000 0000 0001 1000 1000 0000 0011 -->   18803
              0000 0001 0001 1000 1000 0000 0011 -->  118803
UserControl:  0000 0001 1101 1010 0000 0000 0011 -->  1DA003
              0000 0001 1101 1010 0000 0010 0011 -->  1DA023
              0000 0001 1101 1010 1000 0000 0011 -->  1DA803
PropertyPage: 0000 0001 0101 1000 0000 0000 0011 -->  158003
Designer:     0011 0000 0001 1000 0000 1000 0011 --> 3018083
                 |   || ||     |  |    | |    |
[Loki]           |   || ||     |  |    | |    |
IsDesigner ------+   || ||     |  |    | |    |
VB_GlobalNameSpace --+| ||     |  |    | |    |
                      | ||     |  |    | |    |
[moog]                | ||     |  |    | |    |
HasPublicInterface ---+ ||     |  |    | |    |
HasPublicEvents --------+|     |  |    | |    |
IsCreatable/Visible? ----+     |  |    | |    |
Same as "HasPublicEvents" -----+  |    | |    |
                               |  |    | |    |
[_aLfa_]                       |  |    | |    |
UserControl (1) ---------------+  |    | |    |
OCX/DLL - VB_Exposed (1) ---------+    | |    |
Form (1) ------------------------------+ |    |
VB5 (1) ---------------------------------+    |
HasOptInfo (1) -------------------------------+
                                              |
Module (0) -----------------------------------+

Of course....as always.....all items are open for discussion (;

Last edited by MrUnleaded on Mon Aug 02, 2004 5:42 pm; edited 5 times in total

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

Nope it cant be, because Property Pages and User Controls also have the OptionalObjectInfo since they at least have a gui node to the objects etc...
Nevertheless, why the extra bits set in your AND and OR bitmasks? If you AND a bit with 1, it effectively ignores it and if you OR a bit with 0, it effectively ignores it. So basically, you're default AND mask would be all 1's, but with a 0 where you want to drop it to zero and your default OR mask would be all 0's, but with a 1 where you want to force it to 1

MrUnleaded · Posted: Tue Oct 01, 2002 2:55 pm Post subject: hmm

[="moogman":273tj1el]Nope it cant be, because Property Pages and User Controls also have the OptionalObjectInfo since they at least have a gui node to the objects etc...[/:273tj1el]

i think that is right....i will chek later today....

[="moogman":273tj1el]Nevertheless, why the extra bits set in your AND and OR bitmasks? If you AND a bit with 1, it effectively ignores it and if you OR a bit with 0, it effectively ignores it. So basically, you're default AND mask would be all 1's, but with a 0 where you want to drop it to zero and your default OR mask would be all 0's, but with a 1 where you want to force it to 1[/:273tj1el]

lol...i just did an AND of all the object types...and an OR of all the object types....i havent thought of a purpose for it yet.....

feel free to add anything you want

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

Well, thats how you figure out the bits basically. You AND them with, say, 0000 1000 to force all other bits to 0 and then you can compare the final answer with 0x08 (means bit it 1) and 0x00 (means bit is 0).

MrUnleaded · Posted: Thu Oct 03, 2002 2:52 pm Post subject: ok thanx

[="moogman":1jesi8ha]Well, thats how you figure out the bits basically. You AND them with, say, 0000 1000 to force all other bits to 0 and then you can compare the final answer with 0x08 (means bit it 1) and 0x00 (means bit is 0).[/:1jesi8ha]

alright i understand...i just got confused on it for some reason...even though i can do binary->hex conversions in my head.....

_aLfa_ · Posted: Thu Oct 03, 2002 6:00 pm Post subject: Re: ok thanx

[="MrUnleaded":1saf5r48]even though i can do binary->hex conversions in my head.....[/:1saf5r48]
like any1 that decompiles something does
_________________
One thing only I know, and that is that I know nothing. (Socrates)

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

I still have to use my toes. Thank god I was born with only two toes eh? (Joke)

_aLfa_ · Posted: Sat Oct 05, 2002 9:54 pm Post subject:

_aLfa_ · Posted: Fri Oct 25, 2002 8:00 pm Post subject:

ive updated the above table
if any1 has changes or dont agree with something, plz post
_________________
One thing only I know, and that is that I know nothing. (Socrates)

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

module (0) is the flag that states whether there is a OptionalObjectInfo structure. Hence it being 0 for modules (since they have no need for the extra structure - eg there are no objects/controls in a module). Maybe rename to HasOptionalObjectInfo.

Im pretty sure that the flag "user control" doesnt mean just that. Maybe it means public? Or public with external events.

I doubt that there are flags denoting whether an object is a form or a module or whatever. Although I cannot think of anything else that can represent "form"...

MrUnleaded · Posted: Sat Oct 26, 2002 8:23 pm Post subject: eh?

[="moogman":4axvn07z]I doubt that there are flags denoting whether an object is a form or a module or whatever. Although I cannot think of anything else that can represent "form"...[/:4axvn07z]

they how do you determine the object type?
_________________
-MrU

_aLfa_ · Posted: Sun Oct 27, 2002 8:05 am Post subject:

ive added the module thing again, cuz only the module dont ve optionalobjectinfo

btw: the value between () is the value of bit
_________________
One thing only I know, and that is that I know nothing. (Socrates)

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

[="MrUnleaded":2xq8cthg][="moogman":2xq8cthg]I doubt that there are flags denoting whether an object is a form or a module or whatever. Although I cannot think of anything else that can represent "form"...[/:2xq8cthg]

they how do you determine the object type?[/:2xq8cthg]

Using the GUID/UUID of course. Windows doesnt really know the difference between a form and a control. A control is of subtype "window" and a form, by definition, *is* a window. The only way you can tell is by the GUID of the window/control. In this respect, we dont care about whether it is a form/mdi form/control/your dog/kitchen sink etc. If we can get the GUID, we can get all the necessary information and therefore process them.

Some constructive critisism: Why does it matter about the object type? What possible difference would it make if we could tell that a form is a form and not a control or a module or what. We have this HasOptionalObjectInfo flag that tells us whether we need to process the additional object info stuff, so we should all be happy

Im also going to add a few things that may or may not be true; Please argue...

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Guys;
Given the most recent output of the code window by Moogman, and comparing it to the recent output by _aLfa_, can the various bit definitions be combined into one code window? It seems that Moogman's post has a lot of definitions of the bits on the left (MSB) side, while _aLfa_'s has a lot on the right (LSB) side. Can they be combined/displayed in the same window? (Assuming you can agree on the definitions; some bits have two different definitions_

Or are these two completely separate subjects?

Thanks for adding the non-binary values, I was going to request that.

Sarge

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

Yes they are the same thing and yes, I did purposely put them in a seperate window - these were only hunch++'s so for all I know, they could be total crap. It'd be easier to delete the post than edit the first version. If we can all agree on them then i'll merge them. (Or someone else can do the honours hehe).

MrUnleaded · Posted: Wed Oct 30, 2002 4:17 pm Post subject: Re: eh?

[="moogman":2gk3zudg]Using the GUID/UUID of course. [/:2gk3zudg]

Oh yea! hello.....im dumb....hehe

[="moogman":2gk3zudg]
Some constructive critisism: Why does it matter about the object type? What possible difference would it make if we could tell that a form is a form and not a control or a module or what. We have this HasOptionalObjectInfo flag that tells us whether we need to process the additional object info stuff, so we should all be happy
[/:2gk3zudg]

well how else do you know if you want to output a .bas or a .frm or .cls....etc

MrUnleaded · Posted: Wed Oct 30, 2002 4:23 pm Post subject: Re: Hmm...

[="sarge":3i92ah6o]some bits have two different definitions[/:3i92ah6o]

the only conflicting items are moog's second HasPublicEvents....and aLfa's usercontrol....

I will merge both posts into my original post....and i am begining to think that this item deserves a name change....

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

For gods sakes people! We're arguing over a bitmask flag hehe. The HasPublicEvents thing is just a hunch. I strongly doubt that there is one flag denoting a form, another denoting a usercontrol, another a module etc etc. Fair point on distinguishing bas/frm/cls etc. We can use alfa's flags to figure that out, its just i'd like to have the names changed to something non-object orientated. After all, VB exes were not intended to be decompiled right?!

MrUnleaded · Posted: Thu Oct 31, 2002 3:35 pm Post subject:

[="moogman":22n81r6a]For gods sakes people! We're arguing over a bitmask flag hehe. The HasPublicEvents thing is just a hunch. I strongly doubt that there is one flag denoting a form, another denoting a usercontrol, another a module etc etc.[/:22n81r6a]

I agree that this is a bitmask and that it probably isnt the item that will tell you what object type it is......on the other hand.....it could be used to figure out object types....but there is more to it....

[="moogman":22n81r6a]Fair point on distinguishing bas/frm/cls etc. We can use alfa's flags to figure that out, its just i'd like to have the names changed to something non-object orientated. After all, VB exes were not intended to be decompiled right?![/:22n81r6a]

I agree.

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Can a leading zero be added to those hex values that have only 5 characters; (like 18083 to be 018083) it would keep things in the same format. Thanks

Sarge

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Need to add new form type:

0000 0001 1000 0000 1100 0011 --> 180C3

Don't know what that bit does, tho.

Sarge

MrUnleaded · Posted: Mon Dec 16, 2002 2:30 am Post subject:

[="sarge":t40dsil6]Need to add new form type:

0000 0001 1000 0000 1100 0011 --> 180C3

Don't know what that bit does, tho.

Sarge[/:t40dsil6]

ok it was added
_________________
-MrU

Loki · New User Joined: 15 Sep 2004 Posts: 5

MrUnleaded · Posted: Wed Sep 15, 2004 3:16 pm Post subject:

Your "VB_Exposed" conflicts with _aLfa_ 's

Which one is correct?
_________________
-MrU

Loki · New User Joined: 15 Sep 2004 Posts: 5

_alfa_'s is: ocx/dll (1)

This bit is only set for exposed objects (not programs, like ocx or dll). Exposed means that the interface is accessible from other components. If you have private classes in a DLL, this bit will be set 0 for these classes.

Not accessible (and therefore not exposed) are:
Forms
private Classes
private Controls
PropertyPages
Designer
Modules

Accessible (and therefore exposed) are:
public Classes (PublicNotCreatable, MultiUse, SingleUse, GlobalMU, GlobalSU)
public Controls
UserDocuments

A Class which is "PublicNotCreatable" can't be created from outside, but you can create it inside your DLL and expose it's interface. (PublicNotCreatable: MultiUse = True, GlobalNameSpace = False, Creatable = False, Exposed = True)
The interface of a Control which Property "Public" is set to FALSE isn't accessible (not exposed) from outside the OCX. But as it can be used on other (public) Controls inside this OCX, it must be creatable. ("PrivateCreatable": MultiUse = True, GlobalNameSpace = False, Creatable = True, Exposed = False)
Please confer my posting in this Thread: ./viewtopic.php?t=1795

If you check the "Attribute VB_Exposed" setting in your project files and compare it to this bit, you'll see, that everywhere where "Attribute VB_Exposed" ist set to TRUE, this bit will be set in the compiled program.

So I think that something with "Exposed" would be a better name for this bit. The same with "GlobalNameSpace": As it is set only when "Attribute VB_GlobalNameSpace" is set to TRUE in the project file, the name should depend on the naming of the project file attribute.

But I recommend that someone checks all that first...

Bye
Loki

Loki · New User Joined: 15 Sep 2004 Posts: 5

Another one...