VB Decompiler

Dr Memory · Expert Joined: 16 Aug 2004 Posts: 147 Location: Surrey, UK

G'day, long time no see... hope somebody still keeps an eye on things here!

Here's a question - I want to find a thunk location, by which I mean the ultimate location where the VB dynamic call mechanism puts the resolved target function address.

In a native-code PE, all the thunk locations can be found in the ".data" section, so armed with any particular API function address, and assuming the app has called it (thus getting itself apropriately thunked ), then you can easily locate this section and search it for the target address.

That will be unique, so the first one you find is the right one.

What I would like to be able to do is to find the same thunk when the appn is running in the IDE.

I know the IDE uses the same mechanism, more or less. You can confirm this by a simple experiment. Call some API function, then use FreeLibrary to unload the reference DLL, then see what happens when you try and make another call - ouch!

So there is a thunk in the IDE as well - but where to look?????

Cheers
Dr Memory
ANU, Canberra
_________________
[size=75:2sg2dqh1]At first, I was irridescent. Then, I became transparent. Finally, I was absent ...