VB Decompiler

_aLfa_ · Last edited by _aLfa_ on Sat Aug 07, 2004 1:43 pm; edited 4 times in total

I've made a handy class to help me with decompiling stuff.
I think it's worth to share, thanks to MrU for the idea

[vbnet:1c8s7yjx]

Option Explicit On
Option Strict On
 
Public Class cFile
  Private fsFile As IO.FileStream
  Private brFile As IO.BinaryReader
 
  Public ReadOnly Property Length() As Long
    Get
      Return brFile.BaseStream.Length
    End Get
  End Property
  Public Property Offset() As Long
    Get
      Return brFile.BaseStream.Position
    End Get
    Set(ByVal newValue As Long)
      brFile.BaseStream.Position = newValue
    End Set
  End Property
 
  Public Function ReadByte(Optional ByVal Offset As Long = -1) As Byte
    If Offset > -1 Then
      brFile.BaseStream.Position = Offset
    End If
    Return brFile.ReadByte
  End Function
  Public Function ReadBytes(ByVal Count As Integer, Optional ByVal Offset As Long = -1) As Byte()
    If Offset > -1 Then
      brFile.BaseStream.Position = Offset
    End If
    Return brFile.ReadBytes(Count)
  End Function
  Public Function ReadInt16(Optional ByVal Offset As Long = -1) As Short
    If Offset > -1 Then
      brFile.BaseStream.Position = Offset
    End If
    Return brFile.ReadInt16
  End Function
  Public Function ReadInt32(Optional ByVal Offset As Long = -1) As Integer
    If Offset > -1 Then
      brFile.BaseStream.Position = Offset
    End If
    Return brFile.ReadInt32
  End Function
  Public Function ReadString(Optional ByVal Offset As Long = -1) As String
    ' change offset
    If Offset > -1 Then
      brFile.BaseStream.Position = Offset
    End If
 
    ' read the string
    ' note: the string is prefixed with the length, encoded as an integer 7 bits at a time
    Return brFile.ReadString()
  End Function
  Public Function ReadNullTerminatedString(Optional ByVal Offset As Long = -1) As String
    Dim bByte As Char, sString As String = ""
 
    ' change offset
    If Offset > -1 Then
      brFile.BaseStream.Position = Offset
    End If
 
    ' read first byte
    bByte = brFile.ReadChar()
    ' loop until it founds null char
    While Asc(bByte) > 0
      sString &= bByte
      bByte = brFile.ReadChar
    End While
 
    ' return the string readed
    Return sString
  End Function
  Public Function ReadNullTerminatedUnicodeString(Optional ByVal Offset As Long = -1) As String
    Dim sString As String = ""
 
    'change offset
    If Offset > -1 Then
      brFile.BaseStream.Position = Offset
    End If
 
    ' read first byte
    Dim bByte As Char = brFile.ReadChar()
    ' loop until it founds null char
    While Asc(bByte) > 0
      sString &= bByte
      brFile.BaseStream.Seek(1, IO.SeekOrigin.Current)
      bByte = brFile.ReadChar
    End While
 
    ' return the string readed
    Return sString
  End Function
  Public Function ReadStructure(ByRef Struct As Object, Optional ByVal Offset As Long = -1) As Integer
    ' get structure size
    Dim iStructLen As Integer = Runtime.InteropServices.Marshal.SizeOf(Struct) - 4
 
    ' change file offset
    If Offset > -1 Then
      brFile.BaseStream.Position = Offset
    End If
    ' read our byte array from file
    Dim StructData() As Byte = brFile.ReadBytes(iStructLen)
 
    ' allocate buffer
    Dim DataBuffer As IntPtr = Runtime.InteropServices.Marshal.AllocHGlobal(iStructLen)
    ' copy our byte array to buffer
    Runtime.InteropServices.Marshal.Copy(StructData, 0, DataBuffer, iStructLen)
    ' change our structure pointer to buffer
    Struct = Runtime.InteropServices.Marshal.PtrToStructure(DataBuffer, Struct.GetType)
    ' free memory
    Runtime.InteropServices.Marshal.FreeHGlobal(DataBuffer)
 
    ' return bytes read
    Return iStructLen
  End Function
  Public Function ReadStructure(ByRef StructType As Type, Optional ByVal Offset As Long = -1) As Object
    ' get structure size
    Dim iStructLen As Integer = Runtime.InteropServices.Marshal.SizeOf(StructType) - 4
 
    ' change file offset
    If Offset > -1 Then
      brFile.BaseStream.Position = Offset
    End If
    ' read our byte array from file
    Dim StructData() As Byte = brFile.ReadBytes(iStructLen)
 
    ' allocate buffer
    Dim DataBuffer As IntPtr = Runtime.InteropServices.Marshal.AllocHGlobal(iStructLen)
    ' copy our byte array to buffer
    Runtime.InteropServices.Marshal.Copy(StructData, 0, DataBuffer, iStructLen)
    ' get a pointer to our buffer and redirect our function pointer to there (casting it)
    ReadStructure = Runtime.InteropServices.Marshal.PtrToStructure(DataBuffer, StructType)
    ' free memory
    Runtime.InteropServices.Marshal.FreeHGlobal(DataBuffer)
  End Function
 
  Public Sub New(ByVal FilePath As String)
    fsFile = New IO.FileStream(FilePath, IO.FileMode.Open, IO.FileAccess.Read, IO.FileShare.Read)
    brFile = New IO.BinaryReader(fsFile)
  End Sub
  Protected Overrides Sub Finalize()
    brFile.Close()
    MyBase.Finalize()
  End Sub
End Class

[/vbnet:1c8s7yjx]

BTW: This is VB.NET
_________________
One thing only I know, and that is that I know nothing. (Socrates)

MrUnleaded · Posted: Sat Aug 07, 2004 3:36 am Post subject:

Very Nice

I love OOP
_________________
-MrU

_aLfa_ · Posted: Sat Aug 07, 2004 9:26 am Post subject:

Class updated:
Added ReadBytes function to read an array of bytes from the file.
Added ReadNullTerminatedUnicodeString (same as ReaddNullTerminatedString, but it skips 1 byte at a time)
Added some comments on ReadString (the name may be confusing)

And don't forget, if you find any additions/bugs whatever, poke me
_________________
One thing only I know, and that is that I know nothing. (Socrates)

_aLfa_ · Posted: Sat Aug 07, 2004 9:32 am Post subject:

Class updated again:
I forgot to add the FileLength property
_________________
One thing only I know, and that is that I know nothing. (Socrates)

_aLfa_ · Posted: Sat Aug 07, 2004 10:18 am Post subject:

Bug Fix:
SizeOf operator on ReadStructure was returning wrong size for structure (for some weird reason it was returning the real value plus 4 bytes)
_________________
One thing only I know, and that is that I know nothing. (Socrates)

_aLfa_ · Posted: Sat Aug 07, 2004 1:45 pm Post subject:

Added another ReadStructure (now you can use this one even with Option Strict On)

Examples:
Public DOSHeader As IMAGE_DOS_HEADER

(Option Strict Off)
StructLength = File.ReadStructure(DOSHeader)
-or-
DOSHeader = File.ReadStructure(DOSHeader.GetType)

(Option Strict On)
DOSHeader = CType(File.ReadStructure(DOSHeader.GetType), IMAGE_DOS_HEADER)

P.S.: If you don't understand something, feel free to ask
_________________
One thing only I know, and that is that I know nothing. (Socrates)

vbgamer45 · Posted: Sat Aug 07, 2004 1:47 pm Post subject:

Good Job keep up the good work

_aLfa_ · Posted: Sat Aug 07, 2004 1:50 pm Post subject:

Just edited the post
_________________
One thing only I know, and that is that I know nothing. (Socrates)

MrUnleaded · Posted: Sat Aug 07, 2004 4:29 pm Post subject:

[="_aLfa_":3w5aoyk5]Class updated:
Added ReadNullTerminatedUnicodeString (same as ReaddNullTerminatedString, but it skips 1 byte at a time)
[/:3w5aoyk5]

Technically....a unicode string is not every other byte....Unicode is comprised of 16 bit characters(you probably know)

there are some Unicode to Ascii conversion stuff in a .net library.

I think it is the System.Text.Encoding Namespace.

And here is a link on proper byte to unicode conversion

http://msdn.microsoft.com/library/defau ... topic1.asp
_________________
-MrU

MrUnleaded · Posted: Thu Aug 12, 2004 5:38 pm Post subject:

Hey i Updated your class to support writing to files as well as Unsigned Int/long

[vbnet:9hwh66el]

Public Class cFile
    Private fsFile As IO.FileStream
    Private brFile As IO.BinaryReader
    Private bwFile As IO.BinaryWriter
 
    Public ReadOnly Property Length() As Long
        Get
            Return brFile.BaseStream.Length
        End Get
    End Property
    Public Property Offset() As Long
        Get
            Return brFile.BaseStream.Position
        End Get
        Set(ByVal newValue As Long)
            brFile.BaseStream.Position = newValue
            bwFile.BaseStream.Position = newValue
        End Set
    End Property
 
    
    Public Function WriteByte(ByVal Value As Byte, Optional ByVal Offset As Long = -1) As Boolean
        Try
            If Offset > -1 Then
                bwFile.BaseStream.Position = Offset
            End If
            bwFile.Write(Value)
            Return True
        Catch
            Return False
        End Try
    End Function
    Public Function WriteBytes(ByVal Value As Byte(), Optional ByVal Offset As Long = -1) As Boolean
        Try
            If Offset > -1 Then
                bwFile.BaseStream.Position = Offset
 
            End If
            bwFile.Write(Value)
            ' Me.Offset += Value.Length
            Return True
        Catch
            Return False
        End Try
    End Function
    Public Function WriteInt16(ByVal Value As Int16, Optional ByVal Offset As Long = -1) As Boolean
        Try
            If Offset > -1 Then
                bwFile.BaseStream.Position = Offset
 
            End If
            bwFile.Write(Value)
            'Me.Offset += 2
            Return True
        Catch
            Return False
        End Try
    End Function
    Public Function WriteInt32(ByVal Value As Int32, Optional ByVal Offset As Long = -1) As Boolean
        Try
            If Offset > -1 Then
                bwFile.BaseStream.Position = Offset
            End If
            bwFile.Write(Value)
            'Me.Offset += 4
            Return True
        Catch
            Return False
        End Try
    End Function
    Public Function WriteUInt16(ByVal Value As UInt16, Optional ByVal Offset As Long = -1) As Boolean
        Try
            If Offset > -1 Then
                bwFile.BaseStream.Position = Offset
 
            End If
            bwFile.Write(Value)
            'Me.Offset += 2
            Return True
        Catch
            Return False
        End Try
    End Function
    Public Function WriteUInt32(ByVal Value As UInt32, Optional ByVal Offset As Long = -1) As Boolean
        Try
            If Offset > -1 Then
                bwFile.BaseStream.Position = Offset
            End If
            bwFile.Write(Value)
            'Me.Offset += 4
            Return True
        Catch
            Return False
        End Try
    End Function
    Public Function WriteString(ByVal Value As String, Optional ByVal Offset As Long = -1) As Boolean
        Try
            If Offset > -1 Then
                bwFile.BaseStream.Position = Offset
                bwFile.Write(Value)
            End If
            Return True
        Catch
            Return False
        End Try
    End Function
 
    Public Function ReadByte(Optional ByVal Offset As Long = -1) As Byte
        If Offset > -1 Then
            brFile.BaseStream.Position = Offset
        End If
        Return brFile.ReadByte
    End Function
    Public Function ReadBytes(ByVal Count As Integer, Optional ByVal Offset As Long = -1) As Byte()
        If Offset > -1 Then
            brFile.BaseStream.Position = Offset
        End If
        Return brFile.ReadBytes(Count)
    End Function
    Public Function ReadInt16(Optional ByVal Offset As Long = -1) As Short
        If Offset > -1 Then
            brFile.BaseStream.Position = Offset
        End If
        Return brFile.ReadInt16
    End Function
    Public Function ReadInt32(Optional ByVal Offset As Long = -1) As Integer
        If Offset > -1 Then
            brFile.BaseStream.Position = Offset
        End If
        Return brFile.ReadInt32
    End Function
    Public Function ReadUInt16(Optional ByVal Offset As Long = -1) As UShort
        If Offset > -1 Then
            brFile.BaseStream.Position = Offset
        End If
        Return brFile.ReadUInt16
    End Function
    Public Function ReadUInt32(Optional ByVal Offset As Long = -1) As UInteger
        If Offset > -1 Then
            brFile.BaseStream.Position = Offset
        End If
        Return brFile.ReadUInt32
    End Function
    Public Function ReadString(Optional ByVal Offset As Long = -1) As String
        ' change offset
        If Offset > -1 Then
            brFile.BaseStream.Position = Offset
        End If
 
        ' read the string
        ' note: the string is prefixed with the length, encoded as an integer 7 bits at a time
        Return brFile.ReadString()
    End Function
    Public Function ReadNullTerminatedString(Optional ByVal Offset As Long = -1) As String
        Dim bByte As Char, sString As String = ""
 
        ' change offset
        If Offset > -1 Then
            brFile.BaseStream.Position = Offset
        End If
 
        ' read first byte
        bByte = brFile.ReadChar()
        ' loop until it founds null char
        While Asc(bByte) > 0
            sString &= bByte
            bByte = brFile.ReadChar
        End While
 
        ' return the string readed
        Return sString
    End Function
    Public Function ReadNullTerminatedUnicodeString(Optional ByVal Offset As Long = -1) As String
        Dim sString As String = ""
 
        'change offset
        If Offset > -1 Then
            brFile.BaseStream.Position = Offset
        End If
 
        ' read first byte
        Dim bByte As Char = brFile.ReadChar()
        ' loop until it founds null char
        While Asc(bByte) > 0
            sString &= bByte
            brFile.BaseStream.Seek(1, IO.SeekOrigin.Current)
            bByte = brFile.ReadChar
        End While
 
        ' return the string readed
        Return sString
    End Function
    Public Function ReadStructure(ByRef Struct As Object, Optional ByVal Offset As Long = -1) As Integer
        ' get structure size
        Dim iStructLen As Integer = Runtime.InteropServices.Marshal.SizeOf(Struct) - 4
 
        ' change file offset
        If Offset > -1 Then
            brFile.BaseStream.Position = Offset
        End If
        ' read our byte array from file
        Dim StructData() As Byte = brFile.ReadBytes(iStructLen)
 
        ' allocate buffer
        Dim DataBuffer As IntPtr = Runtime.InteropServices.Marshal.AllocHGlobal(iStructLen)
        ' copy our byte array to buffer
        Runtime.InteropServices.Marshal.Copy(StructData, 0, DataBuffer, iStructLen)
        ' change our structure pointer to buffer
        Struct = Runtime.InteropServices.Marshal.PtrToStructure(DataBuffer, Struct.GetType)
        ' free memory
        Runtime.InteropServices.Marshal.FreeHGlobal(DataBuffer)
 
        ' return bytes read
        Return iStructLen
    End Function
    Public Function ReadStructure(ByRef StructType As Type, Optional ByVal Offset As Long = -1) As Object
        ' get structure size
        Dim iStructLen As Integer = Runtime.InteropServices.Marshal.SizeOf(StructType) - 4
 
        ' change file offset
        If Offset > -1 Then
            brFile.BaseStream.Position = Offset
        End If
        ' read our byte array from file
        Dim StructData() As Byte = brFile.ReadBytes(iStructLen)
 
        ' allocate buffer
        Dim DataBuffer As IntPtr = Runtime.InteropServices.Marshal.AllocHGlobal(iStructLen)
        ' copy our byte array to buffer
        Runtime.InteropServices.Marshal.Copy(StructData, 0, DataBuffer, iStructLen)
        ' get a pointer to our buffer and redirect our function pointer to there (casting it)
        ReadStructure = Runtime.InteropServices.Marshal.PtrToStructure(DataBuffer, StructType)
        ' free memory
        Runtime.InteropServices.Marshal.FreeHGlobal(DataBuffer)
    End Function
 
    Public Sub New(ByVal FilePath As String)
        fsFile = New IO.FileStream(FilePath, IO.FileMode.Open, IO.FileAccess.ReadWrite, IO.FileShare.ReadWrite)
        brFile = New IO.BinaryReader(fsFile)
        bwFile = New IO.BinaryWriter(fsFile)
    End Sub
 
    Protected Overrides Sub Finalize()
        brFile.Close()
        MyBase.Finalize()
    End Sub
 
End Class

[/vbnet:9hwh66el]
_________________
-MrU

_aLfa_ · Posted: Thu Aug 12, 2004 8:04 pm Post subject:

Why do you pretend writing to the file?
(in this decompiling context)
_________________
One thing only I know, and that is that I know nothing. (Socrates)

MrUnleaded · Posted: Thu Aug 12, 2004 8:24 pm Post subject:

well....some values i the exe could potentially be hexed to the value you want...

say a forms width is too small... just update that value in the file.

in theory at least?

But also...i was testing some stuff...and i needed to be able to write binary data....so yea. file dumps....etc.
_________________
-MrU

MrUnleaded · Posted: Tue Aug 24, 2004 3:49 am Post subject: to 4 or not to 4

[="_aLfa_":328qwttp]Bug Fix:
SizeOf operator on ReadStructure was returning wrong size for structure (for some weird reason it was returning the real value plus 4 bytes)[/:328qwttp]

Thats weird because it is returning the correct value for me. ie 64 bytes for IMAGE_DOS_HEADER.....it was messing me up for a while....because it was getting me weird values for e_lfanew since it was reading from some random area in memory....

anyways i changed my copy:

napalm · Site Admin Joined: 11 Dec 2003 Posts: 18 Location: UK

Hello again all.. Just a note that i had problems with.. some compilers can align structures to word or dwords this could account for the 4 bytes.

I dont program .NET so I have no idea if there are any packing attributes to structures. But its worth a look, to sort that problem.

This would also explain why its different for MrU and for _aLfa_ as on some compilers this attribute can be set in the IDEs options.

Nice to see the forums still alive.. and im getting back into the scene.

Nice to see you all again (MrU, Moogman, _aLfa_, and the rest)

Speak soon..
_________________
~Napalm~

"With insomnia, you're never really asleep;
you're never really awake."
Fight Club - 1999 - [url:hdzph3dx]http://www.imdb.com/title/tt0137523/[/url:hdzph3dx]

MrUnleaded · Posted: Mon Sep 20, 2004 3:10 pm Post subject:

you signed up for the message board on my birthday
_________________
-MrU