VB Decompiler

MrUnleaded · Posted: Mon Oct 07, 2002 2:58 pm Post subject: MethodTable

Parent: <a href=./viewtopic.php?t=14>ObjectInfo</a>

_aLfa_ · Posted: Mon Oct 07, 2002 4:47 pm Post subject:

mru, u cant think of this as a type, cuz this is an array of longs for sure, why did u put type

ive put the explanation in the notes
_________________
One thing only I know, and that is that I know nothing. (Socrates)

MrUnleaded · Posted: Mon Oct 07, 2002 5:58 pm Post subject:

[="_aLfa_":t3355d9t]mru, u cant think of this as a type, cuz this is an array of longs for sure, why did u put type

ive put the explanation in the notes[/:t3355d9t]

to help clarify

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

If you had a map function without this "type" (whether it is deemed as one or not), then you'd have a bloody big gap and maybe a false representation of what we have documented and what we have not

MrUnleaded · Posted: Wed Oct 09, 2002 2:57 pm Post subject: i agree

[="moogman":3m2fd042]If you had a map function without this "type" (whether it is deemed as one or not), then you'd have a bloody big gap and maybe a false representation of what we have documented and what we have not[/:3m2fd042]

yea...you could also just have...

Dim aProcedure() as Long

ReDim aProcedure(ObjectInfo.NumberOfProcs - 1)

Get #cFile.FileNumber,,aProcedure()

to get all the addresses.....[i think this works :]

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

[="MrUnleaded":f3f72329]yea...you could also just have...

Dim aProcedure() as Long

ReDim aProcedure(ObjectInfo.NumberOfProcs - 1)

Get #cFile.FileNumber,,aProcedure()

to get all the addresses.....[i think this works :][/:f3f72329]

Aye, but I mean having a type that defines this array is better than not having one. Obviously you'd just chuck the addresses straight into an array with the proper size set, but thats a different story...

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

So, why would there be a procedure table with NULL entries in it? I have an exe that shows 51 procedures (which is correct), and the first 5 in the procedure array are 0x00000000. There doesn't appear to be anything obvious in the related structs that would indicate that this particular group of procedures (or the BAS module that contains it) is any different than the others. Any ideas? (Requests for support info or more data will be honored!)

Sarge

MrUnleaded · Posted: Thu Aug 12, 2004 6:23 am Post subject:

I am working on the structs db right now...i was thinking that is Struct is kinda dumb....basically because it is variable length struct....

We know that "Table" basically means array(....maybe we should use array?) and the object that points here, ObjectInfo.aMethodTable . So from MethodTable we would assume that it is an array of methods...but thats not exactly right...it is an array of pointers to Methods.

So here are the changes i am proposing:

rename ObjectInfo.aMethodTable to aMethodPointerArray

and create the MethodPointer Struct:

_aLfa_ · Posted: Thu Aug 12, 2004 8:15 am Post subject:

Fair enough...

BTW Sarge, In this array, the first methods are declares (Declare Function FunctionXXX Lib "xxx.DLL" (<params>) As <returntype>)

And you ask, how do you know that?
Well, you don't. The way i know its an API import its by analyzing this VA:
* If its 0 then its an API
* If its -1 then its an API
* If its some value outside EXE's size then it's an API
* If you can read it, but the first Long in this pointer its not equal to ObjectInfo VA then its an API
* Else its a normal method (AKA event, procedure, function, property, whatever)

If you have any better way to see if these pointer's are APIs, then let me know.

P.S.: Just one side note, the API's come in the (general) section of objects, so they are the first in this array too.
_________________
One thing only I know, and that is that I know nothing. (Socrates)

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

[:1novt9l4]
So here are the changes i am proposing:

rename ObjectInfo.aMethodTable to aMethodPointerArray
and create the MethodPointer Struct:
.....
[/:1novt9l4]

This could help very nicely with the PCode ContextSwitch sequence of 0x05/0x24/0x0D. I have been calling it Method_Table, Table_of_Methods, Object_Methods, etc, 'cause I havent't yet found a clean way to reference the related variables. Using a second set of tables in this manner may work better for both the structure definitions/inter-relationships AND the variables they use. Guess I'll have to experiment....

Sarge

MrUnleaded · Posted: Thu Aug 12, 2004 3:34 pm Post subject: just a thought

[="_aLfa_":zq9zd7sz]Fair enough...

BTW Sarge, In this array, the first methods are declares (Declare Function FunctionXXX Lib "xxx.DLL" (<params>) As <returntype>)

And you ask, how do you know that?
Well, you don't. The way i know its an API import its by analyzing this VA:
* If its 0 then its an API
* If its -1 then its an API
* If its some value outside EXE's size then it's an API
* If you can read it, but the first Long in this pointer its not equal to ObjectInfo VA then its an API
* Else its a normal method (AKA event, procedure, function, property, whatever)

If you have any better way to see if these pointer's are APIs, then let me know.

P.S.: Just one side note, the API's come in the (general) section of objects, so they are the first in this array too.[/:zq9zd7sz]

ok looks like you guys agree or at least have no objections....

Just a thought....perhaps -1/0/[outside the exe] represent the scope of the declarations usage...ie public,private,friend?

No vb6 to prove it though

Also i noticed before that some dll/ocx whatever....when they are loaded sometimes the address is very high....like 0x700000 and those you can subtract the imagebase of the ocx to find the entrypoint for a given function.....im not sure if this applies here...but its worth a look.
_________________
-MrU

_aLfa_ · Posted: Thu Aug 12, 2004 3:51 pm Post subject:

It doesn't represent the scope of the declarations usage.
I have tested on an OCX with 0x11000000 ImageBase, and it's the same thing
_________________
One thing only I know, and that is that I know nothing. (Socrates)