VB Decompiler :: View topic - VB Header (Start Here)

+---------+------------+---------------+
| Ctrl ID | Value | Object Name |
+---------+------------+---------------+
| First Flag |
+---------+------------+---------------+
| 0x00 | 0x00000001 | PictureBox |
| 0x01 | 0x00000002 | Label |
| 0x02 | 0x00000004 | TextBox |
| 0x03 | 0x00000008 | Frame |
| 0x04 | 0x00000010 | CommandButton |
| 0x05 | 0x00000020 | CheckBox |
| 0x06 | 0x00000040 | OptionButton |
| 0x07 | 0x00000080 | ComboBox |
| 0x08 | 0x00000100 | ListBox |
| 0x09 | 0x00000200 | HScrollBar |
| 0x0A | 0x00000400 | VScrollBar |
| 0x0B | 0x00000800 | Timer |
| 0x0C | 0x00001000 | Print |
| 0x0D | 0x00002000 | Form |
| 0x0E | 0x00004000 | Screen |
| 0x0F | 0x00008000 | Clipboard |
| 0x10 | 0x00010000 | Drive |
| 0x11 | 0x00020000 | Dir |
| 0x12 | 0x00040000 | FileListBox |
| 0x13 | 0x00080000 | Menu |
| 0x14 | 0x00100000 | MDIForm |
| 0x15 | 0x00200000 | App |
| 0x16 | 0x00400000 | Shape |
| 0x17 | 0x00800000 | Line |
| 0x18 | 0x01000000 | Image |
| 0x19 | 0x02000000 | Unsupported |
| 0x1A | 0x04000000 | Unsupported |
| 0x1B | 0x08000000 | Unsupported |
| 0x1C | 0x10000000 | Unsupported |
| 0x1D | 0x20000000 | Unsupported |
| 0x1E | 0x40000000 | Unsupported |
| 0x1F | 0x80000000 | Unsupported |
+---------+------------+---------------+
| Second Flag |
+---------+------------+---------------+
| 0x20 | 0x00000001 | Unsupported |
| 0x21 | 0x00000002 | Unsupported |
| 0x22 | 0x00000004 | Unsupported |
| 0x23 | 0x00000008 | Unsupported |
| 0x24 | 0x00000010 | Unsupported |
| 0x25 | 0x00000020 | DataQuery |
| 0x26 | 0x00000040 | OLE |
| 0x27 | 0x00000080 | Unsupported |
| 0x28 | 0x00000100 | UserControl |
| 0x29 | 0x00000200 | PropertyPage |
| 0x2A | 0x00000400 | Document |
| 0x2B | 0x00000800 | Unsupported |
+---------+------------+---------------+

Posted: Sat Sep 21, 2002 8:35 pm Post subject: Re: i would tweak it a little

[="_aLfa_":3ezf6ifz]keep up the good work [/:3ezf6ifz] hey can u try to edit out similar data and only submit modifications? it would be easier that way Last edited by MrUnleaded on Mon Jan 05, 2004 2:27 am; edited 1 time in total

Posted: Sat Sep 21, 2002 11:28 pm Post subject: Re: i would tweak it a little

[="MrUnleaded":14relgfc]hey can u try to edit out similar data and only submit modifications? it would be easier that way [/:14relgfc] sorry for the incovenience ill do that in later posts _________________ One thing only I know, and that is that I know nothing. (Socrates)

Posted: Sat Sep 28, 2002 9:45 pm Post subject: will do

[="moogman":18mvy6rs]by the end of this, I want every byte covered [/:18mvy6rs] I agree If anyone strongly disagrees let me know and why Last edited by MrUnleaded on Mon Jan 05, 2004 2:27 am; edited 1 time in total

Posted: Wed Nov 13, 2002 1:54 pm Post subject: typo?

If 0x4a is an integer, it includes 0x4a and 0x4b. Where is 0x4c and 0x4d? The next shown address is 0x4e. Or is 0x4a really a long? Sarge

Posted: Wed Nov 13, 2002 3:39 pm Post subject: Re: typo?

[="sarge":3az2x46v]If 0x4a is an integer, it includes 0x4a and 0x4b. Where is 0x4c and 0x4d? The next shown address is 0x4e. Or is 0x4a really a long? Sarge[/:3az2x46v] aww yes i seee what you are saying....give me some time and ill check it out.....hopefully it is a long so that i dont have to redo the hex addresses Last edited by MrUnleaded on Mon Jan 05, 2004 2:28 am; edited 1 time in total

Posted: Fri Nov 15, 2002 12:28 pm Post subject:

Also, Unknown7 As Integer ' 0x40 (64d) Unknown8 As Integer ' 0x40 (64d) With both the same addresses? :/

Posted: Fri Nov 15, 2002 1:52 pm Post subject: Yep

Yeh, I saw that too,....just wasn't too sure how much "noise" I can/should really make about these little typos. Oh, well, I guess it all comes out in the wash. sarge

Posted: Fri Nov 15, 2002 3:26 pm Post subject: Re: Yep

[="sarge":1sspd37h]Yeh, I saw that too,....just wasn't too sure how much "noise" I can/should really make about these little typos. Oh, well, I guess it all comes out in the wash. sarge[/:1sspd37h] thats what i get for trusting moog hehe moog you may want to make the same changes here: http://extra.decompiler.com/structures/vbheader.html _________________ -MrU Last edited by MrUnleaded on Mon Jan 05, 2004 2:29 am; edited 1 time in total

Posted: Fri Nov 15, 2002 6:50 pm Post subject:

Ok, I cant count in hex. My bad. The definitions should be ok though

Posted: Mon Nov 18, 2002 3:42 pm Post subject: ok i think this is right?

[="moogman":2jiu5k04]Ok, I cant count in hex. My bad. The definitions should be ok though[/:2jiu5k04] well i cant convert from hex->dec......well at least not quickly..... but yea... i updated the offsets....i hope they are correct this time _________________ -MrU Last edited by MrUnleaded on Mon Jan 05, 2004 2:29 am; edited 1 time in total

Posted: Wed Nov 20, 2002 2:21 pm Post subject: More questions

1. Offset 0x14 is 0x7E in CommonApp; does that mean anything special, as opposed to the default of 0x7F? 2. I can't reconcile offset 0x54 with aProjectDescription. The offset of the ProjectDescription text in CommonApp is 0x10B5; yet the pointer at 0x54 is 0x106C, which points to a NULL, not the ProjectDescription text. This NULL is the start of a series of four offsets that eventually point to various text datas, including the ProjectDescription. Shouldn't the name of offset 0x54 be changed to reflect this mini-structure, and this mini-structure be documented, thus including the real aProjectDescription and other texts? (Well, you did say you wanted "every byte"--so here's a few more) By the way, this is true for VB6, but I think not for VB5...do we need to start to make this distinction in our structs? Sarge

Posted: Wed Nov 20, 2002 6:14 pm Post subject: Re: More questions

[="sarge":3bep50vv]1. Offset 0x14 is 0x7E in CommonApp; does that mean anything special, as opposed to the default of 0x7F? [/:3bep50vv] i need a little notebook to keep track of all these itemschanges.... maybe the default is 0x7F.....im not sure ill check on it.... [="sarge":3bep50vv] 2. I can't reconcile offset 0x54 with aProjectDescription. The offset of the ProjectDescription text in CommonApp is 0x10B5; yet the pointer at 0x54 is 0x106C, which points to a NULL, not the ProjectDescription text. This NULL is the start of a series of four offsets that eventually point to various text datas, including the ProjectDescription. Shouldn't the name of offset 0x54 be changed to reflect this mini-structure, and this mini-structure be documented, thus including the real aProjectDescription and other texts? (Well, you did say you wanted "every byte"--so here's a few more) [/:3bep50vv] hmm i also had a problem with that....i figured out how to do it though...i will post it if i remember.... [="sarge":3bep50vv] By the way, this is true for VB6, but I think not for VB5...do we need to start to make this distinction in our structs? Sarge[/:3bep50vv] perhaps....i guess it depends on how different the structs are from each other.....i dont have VB5 so it makes it a little difficult for me to compare.... _________________ -MrU Last edited by MrUnleaded on Mon Jan 05, 2004 2:30 am; edited 1 time in total

Posted: Thu Nov 21, 2002 1:46 pm Post subject: Offset table

I also do not have VB5; perhaps some of the newer members here know that from a previous MB... I have done some more checking. It appears, in general, that two of the offsets are text locations, another is sometimes an offset to what appears to be ANOTHER table of offsets, and the other one is as-yet-unknown. I'll continue testing and see what I find. Of course, if there's anyone out there who has this info, please let us know. sarge

Posted: Tue Dec 03, 2002 11:25 pm Post subject: updates

i have updated this struct...most notable is the change from "aProjectDescription" to "Address1" Also all "Unknown"s were renamed as "Flag"s btw An unknown comes in four flavors....AddressX,ConstX,NullX,FlagX[when none other apply] _________________ -MrU

Posted: Fri Jul 04, 2003 1:28 pm Post subject:

Hmm, how about this... the difference is one bye...is that the 0x00 termination byte? VB counts string lengths different than VC? just a thought! sarge

Posted: Fri Jul 04, 2003 1:32 pm Post subject: Login

Attn Moderator: It is normal that I have to re-login for every message I post? That gets old real fast. Sarge

Posted: Sun Jul 20, 2003 6:17 pm Post subject:

[="sarge":ecdhgabf]Hmm, how about this... the difference is one bye...is that the 0x00 termination byte? VB counts string lengths different than VC? just a thought! sarge[/:ecdhgabf] Yes, they are equivalent... BYTE LangDLLName[14]; == LangDLLName(13) As Byte

Posted: Sat Aug 21, 2004 10:36 am Post subject:

I do agree with Ionescu view of this structure, except the notation because we are VB programers, not C programers (just kidding). Anyway what do you think of updating this structure with his new/fixed data, and yes I've tested it myself without errors so far _________________ One thing only I know, and that is that I know nothing. (Socrates)

Posted: Sat Aug 21, 2004 7:13 pm Post subject:

I say go for it. If we have no definition for something....worse thing thast can happen is it is wrong...and when we rely on that...we will figure that out....so go for it. btw, good work Ionescu _________________ -MrU

Posted: Sun Aug 22, 2004 10:26 am Post subject:

OK, I changed the structure to the new info we got and added the flags tables. I won't stick with hungarian notation for the moment, because to be honest I prefer 'our' notation, anyway Ionescu stick with ur notation because it's quite professional _________________ One thing only I know, and that is that I know nothing. (Socrates)

Posted: Sun Aug 22, 2004 5:27 pm Post subject:

An extract from my forthcoming bestseller: Software Engineering for Axolotls APPENDIX B: LEXICON Section 7: Programming Standards and Conventions POLISH NOTATION: Nested expression parsing method, aka "Reverse Polish" 1. Indexed entry: Section 11.3 SILK PURSES HUNGARIAN NOTATION: VisualBasic variable-naming convention 1. Indexed entry: Section 11.4 SOW'S EARS 2. Citations index returned (11) entries: First = Dog's Breakfast ... accessing citations database ..... ... ... error ... reality checksum failure! ... service reset Sorry, but this request failed at the server end - you may need to reboot your brain

Posted: Sun Aug 22, 2004 10:42 pm Post subject:

Polish Notation (and reverse) = Method of entering arithmetic computations on a scientific calculator, using a stack-based method. Hungarian Notation = Standard (although quite the source of flame wars between programmers) notation used in programming where a prefix specifies the type of the appended variable name. Not a Visual Basic convention per-se, but simply used in VB because most other language it too. In regards to "it's profesional" and "VB programmers don't use it", that's quite false. Everytime you name your form "frmMain" and a label "lblTime" you're using Hungarian Notation. Your variable is Main, the type is frm -> Form. So it's quite false to say VB doesn't use it. Furthermore, all MSDN documentation (and last time I used VB, I called APIs quite a lot) uses Hungarian Notation, and there's even a MSKB article on the proper variable naming in VB. I just think most people out there know by now that "lp" is long-pointer and "sz" is Zero-Terminated String. Then again, I'm not going to start a flame war on notation lol. You have a very nice guideline document specifying it so that won't cause confusion. I've updated the PDF and posted a new post, btw.

Posted: Mon Aug 23, 2004 9:36 am Post subject:

This is not a war :p But it's not common that VB programmers use that notation, because that notation is widely used in C comunity, and as you said we use things more readable like 'frm' for form or 'nts' for null terminated string Anyway everyone has his style of doing things, and please keep your style because it's always good to have various point-of-views and heads thinking. _________________ One thing only I know, and that is that I know nothing. (Socrates)

Posted: Mon Aug 23, 2004 11:57 am Post subject:

[:3ozhzxqb] because that notation is widely used in the C community [/:3ozhzxqb] Well, that explains it, then! The MSDN "C" coding conventions produce the most ghastly and indecipherable bloatsource I've ever had the misfortune of having to decipher - and having been at this game for 30+ years now, I have dealt with a fairly comprehensive catalog of programming languages. The issue of naming will always be subjective, and hence the cause of much "robust" discussion ...... One difference between systems programming and applications programming is that you spend much more time going over other people's code. The prime objective in any such task is "How does this code work?" - the only comparison that matters is how long it takes on average to understand a page of code written in any given language and style. This will clearly vary from person to person. My loathing of MSDN SDK C code is not a prejudice against C per se, it's simply a reflection of how long it takes me to read it and how much I get out of it compared to other languages ... I find ASM easier to decipher than that stuff .... Hungarian per se is not a major problem, it's the fact that it usually comes with bloated names! When I take over the world, Presidential Edict #3 will be: The use of variable names longer than 16 characters is henceforth a criminal offence!

Posted: Mon Aug 23, 2004 4:28 pm Post subject:

/me slaps MrUnleaded Sarcastic bitch _________________ One thing only I know, and that is that I know nothing. (Socrates)

Posted: Mon Aug 23, 2004 5:02 pm Post subject:

lol Yea but seriously.....i wish i had enough time to do that _________________ -MrU

Posted: Mon Aug 23, 2004 5:06 pm Post subject:

Stop wanking, etc... You eventually may get time _________________ One thing only I know, and that is that I know nothing. (Socrates)

Posted: Mon Aug 23, 2004 7:08 pm Post subject:

That must have been a Hungarian joke, I didn't get it! Have it your way, I'll just observe in passing that once you've aligned a structure the first time, keeping it that way is a fairly trivial exercise... If I post any sample code, I'll mark them clearly "Warning: May contain traces of peanuts and aligned structures. This product may not function correctly in Hungary. "

Posted: Thu Sep 02, 2004 6:24 am Post subject: Re: aGUIObjectInfoArray

Regarding aGUIObjectInfoArray ....I am a little confused... should it be aGUIObjectInfoArray or aGUIObjectArray ? _________________ -MrU

Posted: Thu Sep 02, 2004 8:03 am Post subject:

Fixed _________________ One thing only I know, and that is that I know nothing. (Socrates)

Posted: Wed Feb 20, 2008 3:46 pm Post subject: Re: VB Header (Start Here)

Oh dear... The last edit of this structure? Maybe yes, maybe not... Anyway, I've changed "iFormCount" to "iGUIObjectCount" because "aGUIObjectArray" also points to UserControls, PropertyPages and other kind of stuff besides Forms. I've also removed the "iPadding" because you will get overlaps if you compile with VB5. "oProjectDescription" usually offsets at 0x68 which is the new structure size at the moment. I've added some descriptions, eventually I'll add more in the future. And at last but not the least, I've changed the layout a bit, hopefuly for the better (; _________________ One thing only I know, and that is that I know nothing. (Socrates)

	VB Decompiler Forum Index -> Structures	All times are GMT Goto page 1, 2 Next
Page 1 of 2