VB Decompiler Forum Index VB Decompiler
Hosted by TheAutomaters.com
 
  MemberlistMemberlist
 

Method Link

 
   VB Decompiler Forum Index -> Structures
Author Message
_aLfa_
Site Admin


Joined: 21 Sep 2002
Posts: 233
Location: Aveiro, Portugal

Posted: Tue Aug 31, 2004 10:13 pm     Post subject: Method Link

Parents:
OptionalObjectInfo.aMethodLinkTable

Code:
Type MethodLinkNative
jmpOpCode As Byte '0x0 (0d)
jmpOffset As Long '0x1 (1d) jmp <address> ; <address> = <currentoffset> + <jmpOffset> + 5
'0x5 (5d) <-- Structure Size
End Type


Code:
Type MethodLinkPCode
xorOpCode As Integer '0x0 (00d) xor eax, eax
movOpCode As Byte '0x2 (02d)
movAddress As Long '0x3 (03d) mov edx, <movAddress>
pushOpCode As Byte '0x7 (07d)
pushAddress As Long '0x8 (08d) push <pushAddress>
retOpCode As Byte '0xC (12d) ret
'0xD (13d) <-- Structure Size
End Type


Notes:
* Teoricaly MethodLink can't be really treated as a structure, but since the OpCodes are always following same scheme, I choose to post these 'structures', just as guideline.
* These 2 structures are only valid for Native and PCode respectivaly.
* These 2 structures are only valid to: Sub, Function, Property Get and Property Let
* There isn't a structure for an API declaration.
* There is another 'structure' that can appear, and its related to Event declarations OR WithEvents declarations. (I do appreciate some help to debug this 'structure' more in depth).

Pointers:
Depending on the 'structure' the pointers could be the address of a native code method, could be the address of methodinfo for the PCode or could be an indirect pointer to VB Runtime.
Back to top
   VB Decompiler Forum Index -> Structures All times are GMT
Page 1 of 1

 
You can post new topics in this forum
You can reply to topics in this forum
You can edit your posts in this forum
You can delete your posts in this forum
You can vote in polls in this forum


Powered by phpBB © 2001, 2005 phpBB Group