VB Decompiler

_aLfa_ · Posted: Sun Sep 29, 2002 2:40 pm Post subject: ObjectInfo

Parents:

_aLfa_ · Posted: Sun Sep 29, 2002 2:43 pm Post subject:

this is my view of object info, at least the way i use it in my decompiler
if u dont agree, feel free to post here, so i can edit

we ve reached one of the best important structures of a VB compiled EXE, so ill stop in here for a while to discuss this structure and the parents
_________________
One thing only I know, and that is that I know nothing. (Socrates)

MrUnleaded · Posted: Mon Sep 30, 2002 1:56 am Post subject:

can u add in addresses? 0x00....0x04...0x08...etc

2byte=int
4byte=long

and references should be sub objects not related

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

Yeah, this is what I ws on about when I was discussing aout hte ObjectType and OptionalObjectType. Feel free to add the stuff from mine into your post alfa

MrUnleaded · Posted: Mon Sep 30, 2002 6:22 pm Post subject: Updated

OK i slightly modified your post alfa.....i added in hex addresses and renamed some of the unknowns properties to const\address\flag....

and i split one of your variables(a long) into two integers
_________________
-MrU

MrUnleaded · Posted: Fri Oct 04, 2002 6:00 pm Post subject: hey moog

moog: i was wondering what your current size on the ObjectInfo was....does it match mine(0x38)?

how bout you alfa?

_aLfa_ · Posted: Fri Oct 04, 2002 6:21 pm Post subject:

mine is 3C, ive the form/designer thing
_________________
One thing only I know, and that is that I know nothing. (Socrates)

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

0x38. No more, no less. Im pretty confident about this because they are all progressively after another... So with >0x38, we get overlaps and <0x38 we get gaps. Same with OptionalObjectInfo which I believe is 0x48 long

_aLfa_ · Posted: Sat Oct 05, 2002 7:01 pm Post subject:

moog i forget bout overlaps, but mru reminded me, and now i c that im wrong....

its 0x38 size (ive made a small routine to c the overlap thing, and it overlaps in a project ive somewhere here )
_________________
One thing only I know, and that is that I know nothing. (Socrates)

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

Yeah no worries. I had the sizes of a lot of the structures wrong too before I made one of those doo-hickeys Im glad we all agree...

MrUnleaded · Posted: Wed Dec 04, 2002 3:55 pm Post subject: changes

i made a change to +0x34 i changed it from aVariablePool to aConstantPool.....since all the items at the addresses are constant
_________________
-MrU

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

You guys are gonna love this!!!

The address at offset 0x34 should be renamed to something like aExecutionReferenceTable. It is a pointer to an array of addresses, whose values are the "flow control" for those procedures who are called as "external" to a given procedure. Like this example:

goto Opcode(0x0A)

Sarge

_aLfa_ · Posted: Mon Aug 02, 2004 5:35 pm Post subject:

Again, I changed from Proc to Method for the very same reason as the parent structure
_________________
One thing only I know, and that is that I know nothing. (Socrates)

_aLfa_ · Posted: Wed Aug 04, 2004 8:31 am Post subject:

Can someone verify if Flag3 (+0x28) is the number of Constants in constant pool?
_________________
One thing only I know, and that is that I know nothing. (Socrates)

_aLfa_ · Posted: Thu Aug 26, 2004 3:18 pm Post subject:

I changed the name of Flag3 to iConstantsCount, I verified myself and there is no overlaps in any project
_________________
One thing only I know, and that is that I know nothing. (Socrates)

MrUnleaded · Posted: Thu Aug 26, 2004 3:36 pm Post subject:

[="_aLfa_":2o7sqq65]I changed the name of Flag3 to iConstantsCount, I verified myself and there is no overlaps in any project [/:2o7sqq65]Ahh yes very good
_________________
-MrU

_aLfa_ · Posted: Sun Aug 29, 2004 12:14 pm Post subject:

Another change to this
_________________
One thing only I know, and that is that I know nothing. (Socrates)

_aLfa_ · Posted: Tue Aug 31, 2004 7:29 am Post subject:

Fixed some typos.
_________________
One thing only I know, and that is that I know nothing. (Socrates)