VB Decompiler

Lukasz3k · New User Joined: 28 Jun 2007 Posts: 2

Hi
I have some trouble in one VB app. I trying to exchnage one component GUIobject(some doc type file using dll extension to view it) I extracted orginal file add some changes and trying to put it back but new file size its quite bigger(about 1Kb) so impossible to put it in the orginal places in exe file beacuse overwrite header of next component. So I added new section for this I copy orginal header of this Guiobject and put the header in new file section then the modified doc file. I found guiobject table modified pointer to new location and I write new size. but it doesnt work. Some one maybe know what I doing wrong? Or maybe its impossible?

BTW. For test I moved GUIobject unmodified to the new section and only modified pointer in guiobject table and everythings ok. So I assume is something wrong with sizes?

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Welcome!

"So I assume is something wrong with sizes"

Well, maybe. But not necessarily. At least, not strickly with size itself.

Here's how it works:

Each section of a VB app is specific in it's size, location, and pointers.
So, it is entirely possible to move, or even add, a section, provided you fully inform the app of all the changed requirements to support that new section.

Moving the original code and just changing the pointer to it, works only because that piece of original code has, within it, pointers that are already correct(obvious, because it's working), as well as size info that is already correct (again, obvious because it's working).

Adding a "new" section (which may actually be only a modification of an old section), requires not only pointing to the new section as well as making sure the app size info is changed (note that there may be MULTIPLE size infos to change) , but changing/correcting the pointers within the new section, as well.

For example, one of the most common pointers within sections, particularly if that section is a "child", is a backpointer to the "parent". Thus, moving a piece of working code will not change that pointer value, since it is pointing into some other, untouched area of the app. But a new piece of code also needs the proper back pointer, and simply pointing the app to the new code is not sufficient; you must properly point the new code back to the app.

To recap, there can be many necessary pointers in a section. Some of these will of course point to the proper location in it's own block of code, but other pointers may need to reference various locations within other app code blocks.

A similar problem occurs with the size info. The app may need multiple size infos about the various sections within the new code, not just the info about the total size of the new section.

Good luck.

Sarge

Lukasz3k · New User Joined: 28 Jun 2007 Posts: 2

new section was mean new file section.(like rsrc for resources I added new one with pe editor) and in this new section I putted the modified guiobject with orginal start header, modified doc file, and orginal end header. But finally I found where is additional info about size, and it was in orginal start header before modified doc file. Anyway now works fine