VB Decompiler

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

Hi

I need to know the position of Sub Main in an EXE file compiled in P-Code with VB6.

I used the folowing fields of the structures but they seem to have incorrect values:

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

I'm not sure if you want to get to the events of SubMain, or to the SubMain module. They are usually located in widely different places

The first thing to do is find out if SubMain is, in fact, the startup module. You have already done this by realizing that the value at {submain(VBHeader)} is non-zero. So, remember that number, but correct it for the offset of the loading address. In your case, the offset appears to be the usual 0x400000. So you have 0x40113C - 0x400000 = 0x113C. Call this address SubMainOffset. Now go to that offset in the file. Skip one byte, then get the next 4-byte address. Remember to correct this address, too. Call this address the SubMainPointer.

Since I'm not sure which way you want to go....
See where this new info takes you, depending upon what you want to do. In one case, it will help you with the SubMain module. In the other case, it will help you with the SubMain events.

Also, RACE will give you these offset automatically if you enable the proper option.

Sarge

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

Thanks, I can't believe! I was so blind! All the time i have the proc structure!

I've got it. I have the sub main MODULE code... Compiled with PCODE but... What about NCode???? I need it too... I know it's hard... Do u have any idea?

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Both the PCode and the NCode exist in the same way. In fact, each individual procedure in each module actually has a flag that indicates whether it is coded in N or P, regardless of what the compiler option says. So it is possible to have a mix of both P and N codes in the same exe. However, this is quite rare since most VB programmers just let the compiler do its' thing. So, all you have to do is get the compile-type flag and you will know if the exe is P or N.

Now, do actually decode P-vs-N, N code is assembler and can be disassembled with, ...well... a disassembler. And there are lots out there that can do that. As for the P code, that's what this and other forums are for.

Sarge