VB Decompiler

MrUnleaded · Posted: Mon Jan 05, 2004 4:27 am Post subject: Memory Space

Do you guys think it would be beneficial to create a virtual memory space similar to the way the OS does when processing a file and its dependednts?

or do you think it would just make everything a hassle to deal with?
_________________
-MrU

golem · Often here Joined: 18 Nov 2002 Posts: 73

What got you thinking along those lines?

Carry on!
golem

MrUnleaded · Posted: Wed Jan 07, 2004 4:17 am Post subject:

the way i have always read the file was directly from the file. I know some people....like wkt debugger let the OS load the file and then access it through memory....since i really dont know how to do that very well....i would just assume load the file into a Virtual Memory of my creation....this way i can go to address 0x401215 and read from that location instead of converting it to its fileoffset then reading

It may or may not help.....but i think that is the way i am going to do it.
_________________
-MrU

golem · Often here Joined: 18 Nov 2002 Posts: 73

Yeah that makes sense. It would have some real advantages...

You might want to contact those guys and get some info... They're friends of JosephCo.

Carry on!
golem

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

If I understand correctly, what you're trying to do is actually quite simple... I'm sorry I'm not at my own computer right now, so I can't copy paste my code, but if I remember correctly on planet source code ( http://www.planet-source-code.com ) there are several projects from the same author that use this technique under VB. Simply do a search on the site for either "debugger" or "disassembler". The newest of his creations would be "Debuggy 0.95" which is actually a pretty complete debugger under VB. Anyway, the technique is something like first

DIM MemSpace() As Byte
'then open the file, get the size of it and then something like:
REDIM MemSpace(LOF(1))
'then you can use something like
Get #1,,MemSpace
'to put the file into mem and use the windows api functions to access the memory

You'll see how it works in the example from planet source code.

Hope this helps,

Axyz

MrUnleaded · Posted: Mon Jan 12, 2004 7:47 pm Post subject:

[="Axyz":3aimx4wi]If I understand correctly, what you're trying to do is actually quite simple... I'm sorry I'm not at my own computer right now, so I can't copy paste my code, but if I remember correctly on planet source code ( http://www.planet-source-code.com ) there are several projects from the same author that use this technique under VB. Simply do a search on the site for either "debugger" or "disassembler". The newest of his creations would be "Debuggy 0.95" which is actually a pretty complete debugger under VB. Anyway, the technique is something like first

DIM MemSpace() As Byte
'then open the file, get the size of it and then something like:
REDIM MemSpace(LOF(1))
'then you can use something like
Get #1,,MemSpace
'to put the file into mem and use the windows api functions to access the memory

You'll see how it works in the example from planet source code.

Hope this helps,

Axyz[/:3aimx4wi]the thing is...i wont be actually loading it into memory...

but i am making a class that i can use to reference as if it were memory. but the class actually pulls the information from a file. perhaps this would be helpful though in learning how to load sections from a PE/COFF file...
_________________
-MrU

golem · Often here Joined: 18 Nov 2002 Posts: 73

That it is still worth while checking out Axyz's referral.

There is some seriously interesting code in the Debuggy 0.95 project...

(Being stuck in the Dark Ages (VB5 ), I was unfortunately not able to play with the project... Right out of the gate some of the functions return Long(). Would either need to recode the offending subroutines or upgrade to VB6.

Nonetheless... Thanks for the lead Axyz!

Carry on!
golem

MrUnleaded · Posted: Tue Jan 13, 2004 11:48 am Post subject:

Yea, i wasnt trying to imply that it wasnt good because you are right, it is a good link. from what i looked at in notepad[no vb here] it looks similar to my first decompiler... but i am sure there is something to be learned from it. but too bad he didnt use the tab in his coding
_________________
-MrU

golem · Often here Joined: 18 Nov 2002 Posts: 73

Yeah, the formatting on the code basically sucks...

I've already reformatted some of the modules. You would think I would have written a utility expressly to do that very thing.

It is a very strange coding, formatting, logic, etc. style... Besides being peculiar in those regards, it shows a significant tendency towards conceptual compartmentualization...

I AM curious...

Carry on!
golem