|
VB Decompiler Hosted by TheAutomaters.com
|
Author |
Message |
MrUnleaded Site Admin
Joined: 21 Sep 2002 Posts: 385 Location: California
|
Posted: Mon Sep 30, 2002 6:11 pm
Post subject: Notes: Object->ObjectType
|
|
[code=text:m3cont87]- Form: 0000 0000 0001 1000 0000 1000 0011 --> 18083
- 0000 0000 0001 1000 0000 1010 0011 --> 180A3
- 0000 0000 0001 1000 0000 1100 0011 --> 180C3
- Module: 0000 0000 0001 1000 0000 0000 0001 --> 18001
- 0000 0000 0001 1000 0000 0010 0001 --> 18021
- Class: 0000 0001 0001 1000 0000 0000 0011 --> 118003
- 0000 0001 0011 1000 0000 0000 0011 --> 138003
- 0000 0000 0001 1000 0000 0010 0011 --> 18023
- 0000 0000 0001 1000 1000 0000 0011 --> 18803
- 0000 0001 0001 1000 1000 0000 0011 --> 118803
- UserControl: 0000 0001 1101 1010 0000 0000 0011 --> 1DA003
- 0000 0001 1101 1010 0000 0010 0011 --> 1DA023
- 0000 0001 1101 1010 1000 0000 0011 --> 1DA803
- PropertyPage: 0000 0001 0101 1000 0000 0000 0011 --> 158003
- Designer: 0011 0000 0001 1000 0000 1000 0011 --> 3018083
- | || || | | | | |
- [Loki] | || || | | | | |
- IsDesigner ------+ || || | | | | |
- VB_GlobalNameSpace --+| || | | | | |
- | || | | | | |
- [moog] | || | | | | |
- HasPublicInterface ---+ || | | | | |
- HasPublicEvents --------+| | | | | |
- IsCreatable/Visible? ----+ | | | | |
- Same as "HasPublicEvents" -----+ | | | |
- | | | | |
- [_aLfa_] | | | | |
- UserControl (1) ---------------+ | | | |
- OCX/DLL - VB_Exposed (1) ---------+ | | |
- Form (1) ------------------------------+ | |
- VB5 (1) ---------------------------------+ |
- HasOptInfo (1) -------------------------------+
- |
- Module (0) -----------------------------------+
|
Of course....as always.....all items are open for discussion (;
Last edited by MrUnleaded on Mon Aug 02, 2004 5:42 pm; edited 5 times in total
|
|
Back to top |
|
|
|
Anonymous New User
Joined: 10 Feb 2008 Posts: 0
|
Posted: Tue Oct 01, 2002 10:55 am
Post subject:
|
|
Nope it cant be, because Property Pages and User Controls also have the OptionalObjectInfo since they at least have a gui node to the objects etc...
Nevertheless, why the extra bits set in your AND and OR bitmasks? If you AND a bit with 1, it effectively ignores it and if you OR a bit with 0, it effectively ignores it. So basically, you're default AND mask would be all 1's, but with a 0 where you want to drop it to zero and your default OR mask would be all 0's, but with a 1 where you want to force it to 1
|
|
Back to top |
|
|
|
MrUnleaded Site Admin
Joined: 21 Sep 2002 Posts: 385 Location: California
|
Posted: Tue Oct 01, 2002 2:55 pm
Post subject: hmm
|
|
[="moogman":273tj1el]Nope it cant be, because Property Pages and User Controls also have the OptionalObjectInfo since they at least have a gui node to the objects etc...[/:273tj1el]
i think that is right....i will chek later today....
[="moogman":273tj1el]Nevertheless, why the extra bits set in your AND and OR bitmasks? If you AND a bit with 1, it effectively ignores it and if you OR a bit with 0, it effectively ignores it. So basically, you're default AND mask would be all 1's, but with a 0 where you want to drop it to zero and your default OR mask would be all 0's, but with a 1 where you want to force it to 1[/:273tj1el]
lol...i just did an AND of all the object types...and an OR of all the object types....i havent thought of a purpose for it yet.....
feel free to add anything you want
|
|
Back to top |
|
|
|
Anonymous New User
Joined: 10 Feb 2008 Posts: 0
|
Posted: Thu Oct 03, 2002 10:22 am
Post subject:
|
|
Well, thats how you figure out the bits basically. You AND them with, say, 0000 1000 to force all other bits to 0 and then you can compare the final answer with 0x08 (means bit it 1) and 0x00 (means bit is 0).
|
|
Back to top |
|
|
|
MrUnleaded Site Admin
Joined: 21 Sep 2002 Posts: 385 Location: California
|
Posted: Thu Oct 03, 2002 2:52 pm
Post subject: ok thanx
|
|
[="moogman":1jesi8ha]Well, thats how you figure out the bits basically. You AND them with, say, 0000 1000 to force all other bits to 0 and then you can compare the final answer with 0x08 (means bit it 1) and 0x00 (means bit is 0).[/:1jesi8ha]
alright i understand...i just got confused on it for some reason...even though i can do binary->hex conversions in my head.....
|
|
Back to top |
|
|
|
_aLfa_ Site Admin
Joined: 21 Sep 2002 Posts: 233 Location: Aveiro, Portugal
|
Posted: Thu Oct 03, 2002 6:00 pm
Post subject: Re: ok thanx
|
|
[="MrUnleaded":1saf5r48]even though i can do binary->hex conversions in my head.....[/:1saf5r48]
like any1 that decompiles something does _________________ One thing only I know, and that is that I know nothing. (Socrates)
Last edited by _aLfa_ on Mon Aug 02, 2004 5:02 pm; edited 1 time in total
|
|
Back to top |
|
|
|
Anonymous New User
Joined: 10 Feb 2008 Posts: 0
|
Posted: Sat Oct 05, 2002 2:37 pm
Post subject:
|
|
I still have to use my toes. Thank god I was born with only two toes eh? (Joke)
|
|
Back to top |
|
|
|
_aLfa_ Site Admin
Joined: 21 Sep 2002 Posts: 233 Location: Aveiro, Portugal
|
Posted: Sat Oct 05, 2002 9:54 pm
Post subject:
|
|
Code: | form: 0000 0001 1000 0000 1000 0011 --> 18083
0000 0001 1000 0000 1010 0011 --> 180A3
module: 0000 0001 1000 0000 0000 0001 --> 18001
0000 0001 1000 0000 0010 0001 --> 18021
class: 0001 0001 1000 0000 0000 0011 --> 118003
0001 0011 1000 0000 0000 0011 --> 138003
0000 0001 1000 0000 0010 0011 --> 18023
0000 0001 1000 1000 0000 0011 --> 18803
0001 0001 1000 1000 0000 0011 --> 118803
usercontrol: 0001 1101 1010 0000 0000 0011 --> 1DA003
0001 1101 1010 0000 0010 0011 --> 1DA023
0001 1101 1010 1000 0000 0011 --> 1DA803
propertypage: 0001 0101 1000 0000 0000 0011 --> 158003
| | | | |
usercontrol (1) ----------+ | | | |
ocx/dll (1) -----------------+ | | |
form (1) -------------------------+ | |
vb5 (1) ----------------------------+ |
module/HasOptInfo (0) -------------------+ |
some reference i use, if any1 wants to add or modify something, plz feel free, but post the change _________________ One thing only I know, and that is that I know nothing. (Socrates)
Last edited by _aLfa_ on Mon Aug 02, 2004 5:05 pm; edited 2 times in total
|
|
Back to top |
|
|
|
_aLfa_ Site Admin
Joined: 21 Sep 2002 Posts: 233 Location: Aveiro, Portugal
|
Posted: Fri Oct 25, 2002 8:00 pm
Post subject:
|
|
ive updated the above table
if any1 has changes or dont agree with something, plz post _________________ One thing only I know, and that is that I know nothing. (Socrates)
|
|
Back to top |
|
|
|
Anonymous New User
Joined: 10 Feb 2008 Posts: 0
|
Posted: Sat Oct 26, 2002 8:09 pm
Post subject:
|
|
module (0) is the flag that states whether there is a OptionalObjectInfo structure. Hence it being 0 for modules (since they have no need for the extra structure - eg there are no objects/controls in a module). Maybe rename to HasOptionalObjectInfo.
Im pretty sure that the flag "user control" doesnt mean just that. Maybe it means public? Or public with external events.
I doubt that there are flags denoting whether an object is a form or a module or whatever. Although I cannot think of anything else that can represent "form"...
|
|
Back to top |
|
|
|
MrUnleaded Site Admin
Joined: 21 Sep 2002 Posts: 385 Location: California
|
Posted: Sat Oct 26, 2002 8:23 pm
Post subject: eh?
|
|
[="moogman":4axvn07z]I doubt that there are flags denoting whether an object is a form or a module or whatever. Although I cannot think of anything else that can represent "form"...[/:4axvn07z]
they how do you determine the object type? _________________ -MrU
|
|
Back to top |
|
|
|
_aLfa_ Site Admin
Joined: 21 Sep 2002 Posts: 233 Location: Aveiro, Portugal
|
Posted: Sun Oct 27, 2002 8:05 am
Post subject:
|
|
ive added the module thing again, cuz only the module dont ve optionalobjectinfo
btw: the value between () is the value of bit _________________ One thing only I know, and that is that I know nothing. (Socrates)
|
|
Back to top |
|
|
|
Anonymous New User
Joined: 10 Feb 2008 Posts: 0
|
Posted: Wed Oct 30, 2002 11:30 am
Post subject: Re: eh?
|
|
[="MrUnleaded":2xq8cthg][="moogman":2xq8cthg]I doubt that there are flags denoting whether an object is a form or a module or whatever. Although I cannot think of anything else that can represent "form"...[/:2xq8cthg]
they how do you determine the object type?[/:2xq8cthg]
Using the GUID/UUID of course. Windows doesnt really know the difference between a form and a control. A control is of subtype "window" and a form, by definition, *is* a window. The only way you can tell is by the GUID of the window/control. In this respect, we dont care about whether it is a form/mdi form/control/your dog/kitchen sink etc. If we can get the GUID, we can get all the necessary information and therefore process them.
Some constructive critisism: Why does it matter about the object type? What possible difference would it make if we could tell that a form is a form and not a control or a module or what. We have this HasOptionalObjectInfo flag that tells us whether we need to process the additional object info stuff, so we should all be happy
Im also going to add a few things that may or may not be true; Please argue...
Code: |
form: 0000 0001 1000 0000 1000 0011 --> 18083
0000 0001 1000 0000 1010 0011 --> 180A3
module: 0000 0001 1000 0000 0000 0001 --> 18001
0000 0001 1000 0000 0010 0001 --> 18021
class: 0001 0001 1000 0000 0000 0011 --> 118003
0001 0011 1000 0000 0000 0011 --> 138003
0000 0001 1000 0000 0010 0011 --> 18023
0000 0001 1000 1000 0000 0011 --> 18803
0001 0001 1000 1000 0000 0011 --> 118803
usercontrol: 0001 1101 1010 0000 0000 0011 --> 1DA003
0001 1101 1010 0000 0010 0011 --> 1DA023
0001 1101 1010 1000 0000 0011 --> 1DA803
propertypage: 0001 0101 1000 0000 0000 0011 --> 158003
| || |
HasPublicInterface ---+ || |
HasPublicEvents --------+| |
IsCreatable/Visible? ----+ |
Same as "HasPublicEvents" -----+
|
|
|
Back to top |
|
|
|
sarge Moderator
Joined: 24 Sep 2002 Posts: 194
|
Posted: Wed Oct 30, 2002 1:54 pm
Post subject: Hmm...
|
|
Guys;
Given the most recent output of the code window by Moogman, and comparing it to the recent output by _aLfa_, can the various bit definitions be combined into one code window? It seems that Moogman's post has a lot of definitions of the bits on the left (MSB) side, while _aLfa_'s has a lot on the right (LSB) side. Can they be combined/displayed in the same window? (Assuming you can agree on the definitions; some bits have two different definitions_
Or are these two completely separate subjects?
Thanks for adding the non-binary values, I was going to request that.
Sarge
Last edited by sarge on Wed Oct 30, 2002 4:02 pm; edited 1 time in total
|
|
Back to top |
|
|
|
Anonymous New User
Joined: 10 Feb 2008 Posts: 0
|
Posted: Wed Oct 30, 2002 2:31 pm
Post subject:
|
|
Yes they are the same thing and yes, I did purposely put them in a seperate window - these were only hunch++'s so for all I know, they could be total crap. It'd be easier to delete the post than edit the first version. If we can all agree on them then i'll merge them. (Or someone else can do the honours hehe).
|
|
Back to top |
|
|
|
MrUnleaded Site Admin
Joined: 21 Sep 2002 Posts: 385 Location: California
|
Posted: Wed Oct 30, 2002 4:17 pm
Post subject: Re: eh?
|
|
[="moogman":2gk3zudg]Using the GUID/UUID of course. [/:2gk3zudg]
Oh yea! hello.....im dumb....hehe
[="moogman":2gk3zudg]
Some constructive critisism: Why does it matter about the object type? What possible difference would it make if we could tell that a form is a form and not a control or a module or what. We have this HasOptionalObjectInfo flag that tells us whether we need to process the additional object info stuff, so we should all be happy
[/:2gk3zudg]
well how else do you know if you want to output a .bas or a .frm or .cls....etc
|
|
Back to top |
|
|
|
MrUnleaded Site Admin
Joined: 21 Sep 2002 Posts: 385 Location: California
|
Posted: Wed Oct 30, 2002 4:23 pm
Post subject: Re: Hmm...
|
|
[="sarge":3i92ah6o]some bits have two different definitions[/:3i92ah6o]
the only conflicting items are moog's second HasPublicEvents....and aLfa's usercontrol....
I will merge both posts into my original post....and i am begining to think that this item deserves a name change....
|
|
Back to top |
|
|
|
Anonymous New User
Joined: 10 Feb 2008 Posts: 0
|
Posted: Thu Oct 31, 2002 2:06 pm
Post subject:
|
|
For gods sakes people! We're arguing over a bitmask flag hehe. The HasPublicEvents thing is just a hunch. I strongly doubt that there is one flag denoting a form, another denoting a usercontrol, another a module etc etc. Fair point on distinguishing bas/frm/cls etc. We can use alfa's flags to figure that out, its just i'd like to have the names changed to something non-object orientated. After all, VB exes were not intended to be decompiled right?!
|
|
Back to top |
|
|
|
MrUnleaded Site Admin
Joined: 21 Sep 2002 Posts: 385 Location: California
|
Posted: Thu Oct 31, 2002 3:35 pm
Post subject:
|
|
[="moogman":22n81r6a]For gods sakes people! We're arguing over a bitmask flag hehe. The HasPublicEvents thing is just a hunch. I strongly doubt that there is one flag denoting a form, another denoting a usercontrol, another a module etc etc.[/:22n81r6a]
I agree that this is a bitmask and that it probably isnt the item that will tell you what object type it is......on the other hand.....it could be used to figure out object types....but there is more to it....
[="moogman":22n81r6a]Fair point on distinguishing bas/frm/cls etc. We can use alfa's flags to figure that out, its just i'd like to have the names changed to something non-object orientated. After all, VB exes were not intended to be decompiled right?![/:22n81r6a]
I agree.
|
|
Back to top |
|
|
|
sarge Moderator
Joined: 24 Sep 2002 Posts: 194
|
Posted: Tue Nov 19, 2002 6:46 pm
Post subject: suggestion
|
|
Can a leading zero be added to those hex values that have only 5 characters; (like 18083 to be 018083) it would keep things in the same format. Thanks
Sarge
|
|
Back to top |
|
|
|
sarge Moderator
Joined: 24 Sep 2002 Posts: 194
|
Posted: Sun Dec 15, 2002 3:08 pm
Post subject:
|
|
Need to add new form type:
0000 0001 1000 0000 1100 0011 --> 180C3
Don't know what that bit does, tho.
Sarge
|
|
Back to top |
|
|
|
MrUnleaded Site Admin
Joined: 21 Sep 2002 Posts: 385 Location: California
|
Posted: Mon Dec 16, 2002 2:30 am
Post subject:
|
|
[="sarge":t40dsil6]Need to add new form type:
0000 0001 1000 0000 1100 0011 --> 180C3
Don't know what that bit does, tho.
Sarge[/:t40dsil6]
ok it was added _________________ -MrU
|
|
Back to top |
|
|
|
Loki New User
Joined: 15 Sep 2004 Posts: 5
|
Posted: Wed Sep 15, 2004 9:26 am
Post subject:
|
|
Code: |
0000 0001 1000 0000 1000 0011
| |
| +------ Corresponds to "Attribute VB_Exposed"
|
+------Corresponds to "Attribute VB_GlobalNameSpace"
|
The Exposed-Bit is not only set in creatable (public) ctls (in private it's 0), it's also set in creatable (non-private) Classes.
Bye,
Loki
|
|
Back to top |
|
|
|
MrUnleaded Site Admin
Joined: 21 Sep 2002 Posts: 385 Location: California
|
Posted: Wed Sep 15, 2004 3:16 pm
Post subject:
|
|
Your "VB_Exposed" conflicts with _aLfa_ 's
Which one is correct? _________________ -MrU
|
|
Back to top |
|
|
|
Loki New User
Joined: 15 Sep 2004 Posts: 5
|
Posted: Wed Sep 15, 2004 4:03 pm
Post subject:
|
|
_alfa_'s is: ocx/dll (1)
This bit is only set for exposed objects (not programs, like ocx or dll). Exposed means that the interface is accessible from other components. If you have private classes in a DLL, this bit will be set 0 for these classes.
Not accessible (and therefore not exposed) are:
Forms
private Classes
private Controls
PropertyPages
Designer
Modules
Accessible (and therefore exposed) are:
public Classes (PublicNotCreatable, MultiUse, SingleUse, GlobalMU, GlobalSU)
public Controls
UserDocuments
A Class which is "PublicNotCreatable" can't be created from outside, but you can create it inside your DLL and expose it's interface. (PublicNotCreatable: MultiUse = True, GlobalNameSpace = False, Creatable = False, Exposed = True)
The interface of a Control which Property "Public" is set to FALSE isn't accessible (not exposed) from outside the OCX. But as it can be used on other (public) Controls inside this OCX, it must be creatable. ("PrivateCreatable": MultiUse = True, GlobalNameSpace = False, Creatable = True, Exposed = False)
Please confer my posting in this Thread: ./viewtopic.php?t=1795
If you check the "Attribute VB_Exposed" setting in your project files and compare it to this bit, you'll see, that everywhere where "Attribute VB_Exposed" ist set to TRUE, this bit will be set in the compiled program.
So I think that something with "Exposed" would be a better name for this bit. The same with "GlobalNameSpace": As it is set only when "Attribute VB_GlobalNameSpace" is set to TRUE in the project file, the name should depend on the naming of the project file attribute.
But I recommend that someone checks all that first...
Bye
Loki
|
|
Back to top |
|
|
|
Loki New User
Joined: 15 Sep 2004 Posts: 5
|
Posted: Wed Sep 15, 2004 6:35 pm
Post subject:
|
|
Another one...
Code: |
0011 0000 0001 1000 0000 1000 0011
|
+----------IsDesigner (1)
|
BTW, if you're wondering where I got that strange VB-Attributes from, try to open a .cls-file with notepad.
[="MrUnleaded":kqhcugxi][="moogman":kqhcugxi]
Some constructive critisism: Why does it matter about the object type? What possible difference would it make if we could tell that a form is a form and not a control or a module or what. We have this HasOptionalObjectInfo flag that tells us whether we need to process the additional object info stuff, so we should all be happy
[/:kqhcugxi]
well how else do you know if you want to output a .bas or a .frm or .cls....etc
[/:kqhcugxi]
If you're cycling through COM Registration Info-structures (these objects are public) and then adding the Informations from ObjectType (like GlobalNameSpace etc.) you're able to identify the type and instancing of all the public objects.
The rest of the objects in ObjectArray (ObjectTable) that don't have a COM Registration Info-structure must be private. You can retrieve their types by only comparing the bits in fObjectType.
Bye,
Loki
|
|
Back to top |
|
|
|
|
|