VB6 Class Instances

Author: David Zimmer
Date: 01.15.23 - 9:38pm

Does the runtime track all live instances of classes?
Where can I find this data?

consider the following:

'Module 1
Dim a As Class1
Dim b As Object
Dim c As Object

Sub Main()
    Set a = New Class1
    Set b = New Class1
    Set c = New Class1
    a.name = "dog"
    b.name = "cat"
    c.name = "bird"
    InputBox "", , Hex(ObjPtr(a)) & " " & Hex(ObjPtr(b)) & " " & Hex(ObjPtr(c))
End Sub

'Class 1 code
Public name As String

Private Sub Class_Terminate()
    MsgBox "terminating " & name
End Sub
Since the vars are owned at global module level, they are only torn down at program end, so what triggers the tear down and how does the runtime find them?

for the answer see

.text:66027FE5 void __stdcall RcmResetModulesPrepass(struct epiProject *objTable, struct ProjectThread *)

runtime data:
   objptr 1 = 565280 
   objptr 2 = 565C88 
   objptr 3 = 565CE8

Header field:
   Class1.ObjInfo.lpProjectData     402018

Memory walking:
00402018  005650C8  *RUN_INSTMGR 

005650C8  00565CE8  <-- objptr 3
005650CC  00000000
005650D0  004011E8  Project1.004011E8  Class1.objinfo
005650D4  00000003  <-- live instances count

	00565CE8  00402348  Project1.00402348  class vtable
	00565CEC  00565C88  <-- objptr 2
	00565CF0  00565D04  -> 660682E0  MSVBVM60.BASIC_CLASS::PRIVATE_UNKNOWN::`vftable'
	00565CF4  02BAC904  -> 6600FF08  MSVBVM60.CClassModule::CUnkPrivate::`vftable'
	00565CF8  02BAC8EC  -> 6600FB08  MSVBVM60.CClassModule::`vftable'

		00565C88  00402348  Project1.00402348 class vtable
		00565C8C  00565280  <-- objptr 1
		00565C90  00565CA4  -> 660682E0  MSVBVM60.BASIC_CLASS::PRIVATE_UNKNOWN::`vftable'
		00565C94  02BAC8B4  -> 6600FF08  MSVBVM60.CClassModule::CUnkPrivate::`vftable'
		00565C98  02BAC89C  -> 6600FB08  MSVBVM60.CClassModule::`vftable'
		00565C9C  00000000

			00565280  00402348  Project1.00402348 class vtable
			00565284  00000000  <-- no next instance
			00565288  0056529C
			0056528C  02BAC864
			00565290  02BAC84C

call stack when pausing the debugger at MsgBox in Class_Terminate and inspecting from there.
Address    Stack      Procedure / arguments                         Called from  
0019FA64   66028116   MSVBVM60.RUN_INSTMGR::ExecuteInitTerm         MSVBVM60.66028111 
0019FA9C   66027F83   MSVBVM60.RcmResetModulesPrepass               MSVBVM60.66027F7E 
0019FAB0   66027F04   MSVBVM60.RcmShutDownProject                   MSVBVM60.66027EFF 
0019FAC8   66027B3C   MSVBVM60.RcmResetProject                      MSVBVM60.66027B37 
0019FD44   66051B59   MSVBVM60.66027AC0                             MSVBVM60.66051B54 
0019FD58   66027A39   MSVBVM60.EbResetProjectNormal                 MSVBVM60.66027A34 
0019FD70   66027D28   MSVBVM60.CThreadPool::ResetProject            MSVBVM60.66027D23 
0019FD8C   66051AEC   MSVBVM60.DbgReset                             MSVBVM60.66051AE7 
0019FDAC   6600B1B5   MSVBVM60.DbgResetIfDoneRunning                MSVBVM60.6600B1B0 
0019FDE0   6600B0BB   MSVBVM60.MainAfterDispatch                    MSVBVM60.6600B0B6 
0019FDEC   6600B095   Includes MSVBVM60.6600B0BB                    MSVBVM60.6600B092 
0019FE20   6600B041   MSVBVM60.SCM::FContinueMessageLoop            MSVBVM60.6600B03C 
0019FE28   6600A7EE   Includes MSVBVM60.6600B041                    MSVBVM60.6600A7EB 
0019FE6C   6600A74D   MSVBVM60.ThunderMsgLoop                       MSVBVM60.6600A748 
0019FE80   6600A6EF   Includes MSVBVM60.6600A74D                    MSVBVM60.6600A6EC 
0019FEB0   6600A62B   MSVBVM60.SCM::FPushMessageLoop                MSVBVM60.6600A626 
0019FECC   6600A5F6   Includes MSVBVM60.6600A62B                    MSVBVM60.6600A5F3
0019FEF0   660241C0   MSVBVM60.CMsoComponent::PushMsgLoop           MSVBVM60.660241BB
0019FF6C   00401076   ?                         Project1.00401071

A UI for this for will be released in vbdec next week to view all live class instances in a running executable and can also dump the values of any public properties on the class. I have also taken to tracking the reference count which is at objptr() + &h20

Comments: (0)

Leave Comment:
Email: (not shown)
Message: (Required)
Math Question: 92 + 80 = ? followed by the letter: C 

About Me
More Blogs
Main Site
Posts: (year)
2023 (4)
     UDTs in Native Const Pool
     PublicBytes struct
     VB6 Class Instances
2022 (6)
     VB6 Implements
     vbdec remote scripting
     VB6 Stubs BS
     VB6 TypeInfo
     VB6 VTable Layout
     Yara isPCode rule
2021 (4)
     VB6 Hijacking
     VB6 Gosub
     VB App object
2020 (6)
     AutoIT versions
     IDA JScript 2
     Using VB6 Obj files from C
     Vb6 PCode Internals
     Yara Corrupt Imports
     Yara Undefined values
2019 (6)
     Yara WorkBench
     vb6 API and call backs
     UConnect Disable Cell Modem
2017 (5)
     IDA python over IPC
     dns wildcard blocking
     64bit IDA Plugins
     anterior lines
     misc news/updates
2016 (4)
     KANAL Mod
     Decoders again
     CDO.Message Breakpoints
     SysAnalyzer Updates
2015 (6)
     SysAnalyzer and Site Updates
     crazy decoder
     ida js w/dbg
     flash patching #2
     JS Graphing
     packet reassembly
2014 (5)
     Delphi IDA Plugin
     scdbg IDA integration
     API Hash Database
     Winmerge plugin
     IDACompare Updates
2013 (9)
     Guest Post @ hexblog
     TCP Stream Reassembly
     SysAnalyzer Updates
     Apilogger Video
     Shellcode2Exe trainer
     scdbg updates
     IDA Javascript w/IDE
     Rop Analysis II
     scdbg vrs ROP
2012 (13)
     flash patching
     x64 Hooks
     micro hook
     jmp api+5 *2
     SysAnalyzer Updates
     InjDll runtime config
     C# Asm/Dsm Library
     Shellcode Hook Detection
     Updates II
     Java Hacking
     Windows 8
     Win7 x64
2011 (19)
     Graphing ideas
     .Net Hacking
     Old iDefense Releases
     hll shellcode
     ActionScript Tips
     -patch fu
     scdbg ordinal lookup
     scdbg -api mode
     Peb Module Lists
     scdbg vrs Process Injection
     GetProcAddress Scanner
     scdbg fopen mode
     scdbg findsc mode
     scdbg MemMonitor
     demo shellcodes
     scdbg download
     api hashs redux
     Api hash gen
2010 (11)
     Retro XSS Chat Codes
     Exe as DLL
     Olly Plugins
     Debugging Explorer
     Attach to hidden process
     JS Refactoring
     Asm and Shellcode in CSharp
     Fancy Return Address
     PDF Stream Dumper
     Malcode Call API by Hash
     WinDbg Cheat Sheet
2009 (1)
     GPG Automation