VB Decompiler

_aLfa_ · Posted: Mon Aug 23, 2004 1:06 pm Post subject: COM Registration Data

Parents:
VB Header

[vb:k8kt6z2a]

Type COMRegData
  oRegInfoArray           As Long    ' 0x00 (00d) Offset to COM Interfaces Info
  oNTSProjectName         As Long    ' 0x04 (04d) Offset to Project/Typelib Name
  oNTSHelpDirectory       As Long    ' 0x08 (08d) Offset to Help Directory
  oNTSProjectDescription  As Long    ' 0x0C (12d) Offset to Project Description
  uuidProjectClsId(15)    As Byte    ' 0x10 (16d) CLSID of Project/Typelib
  lTlbLcid                As Long    ' 0x20 (32d) LCID of Type Library
  iPadding1               As Integer ' 0x24 (36d) 
  iTlbVerMajor            As Integer ' 0x26 (38d) Typelib Major Version
  iTlbVerMinor            As Integer ' 0x28 (40d) Typelib Minor Version
                                     ' 0x2A (42d) <- Structure Size
End Type

[/vb:k8kt6z2a]

Childs:
COM Registration Info
Designer Info

Greetings to Alexandru Ionescu for decoding this structure.

_aLfa_ · Posted: Tue Aug 24, 2004 8:36 pm Post subject:

I changed iPadding1 to iFlag1 and removed iPadding2 and lPadding3 trimming down this structure to 0x2A size.

As usual if there are any objections, just argue
_________________
One thing only I know, and that is that I know nothing. (Socrates)

ionescu007 · Sometimes here Joined: 21 Aug 2004 Posts: 33

Hi,

iFlag1 is not a flag.... it's never actually read. The closest you could call it is "Reserved" but it doesn't serve a single purpose... At least you made me notice a typo in my structure though, I wrote 0x30 instead of 0x2A. And you're right there's no padding at the end, the size is 0x2A

Best regards,
Alex Ionescu
Kernel Developer, ReactOS
President, Relsoft Technologies

_aLfa_ · Posted: Wed Aug 25, 2004 7:58 am Post subject:

I changed to iFlag1 because in some executables there was some values there.

Anyway I changed the name back to iPadding1, if you are so sure about it.
_________________
One thing only I know, and that is that I know nothing. (Socrates)

ionescu007 · Sometimes here Joined: 21 Aug 2004 Posts: 33

Kidnly send me the executable in question...I'll take a look at it...read what I wrote about heap corruption thought in the topic about this structure that I posted... Keep in mind I use SP6 so I might have been both right and wrong (ie, the value might be used in SP5).

Best regards,
Alex Ionescu
Kernel Developer, ReactOS
President, Relsoft Technologies

_aLfa_ · Posted: Thu Aug 26, 2004 8:08 am Post subject:

[="ionescu007":a7wbz35x]...read what I wrote about heap corruption thought in the topic about this structure that I posted...[/:a7wbz35x]

Don't know which structure that you posted that talks about heap corruption, anyway drop me a private message with your mail so I can send you the executable I'm talking about
_________________
One thing only I know, and that is that I know nothing. (Socrates)

_aLfa_ · Posted: Thu Aug 26, 2004 8:23 am Post subject:

BTW: The value I've been finding in iPadding1 is 0x00000002 and I can only find in some OCX's I have...
_________________
One thing only I know, and that is that I know nothing. (Socrates)