VB Decompiler

_aLfa_ · Posted: Mon Aug 23, 2004 5:07 pm Post subject: Designer Info

MrUnleaded · Posted: Mon Aug 23, 2004 5:23 pm Post subject:

By augmentation.....do you mean it goes afterwards? similar to OptionalObjectInfo?

Also....is there another way we can do this struct....because it looks awfully confusing... as there is overlapping section(i assume based on the type of the struct.) and if it is based on the type of struct...perhaps several structs or even an appending struct should be made?

Thoughts?
_________________
-MrU

ionescu007 · Sometimes here Joined: 21 Aug 2004 Posts: 33

Unforunately, because of the dumb-headness of VB, variable UDTs don't really work out nicely. The whole idea is to treat the structure stable only until the first bstr, whose first long is the size of the upcoming string. Everything past that is variable and the best would be to use a dynamic array. Worse, you can't know in advance which strings are present or not, since you must actually read their size, and skip if 0.

This is sadly a limitation of VB

Best regards,
Alex Ionescu

Dr Memory · Expert Joined: 16 Aug 2004 Posts: 147 Location: Surrey, UK

VB6's reluctance to let you use a UDT that way has been a source of grief for many people over the past decade, that's for sure!

It is, however, just that - reluctance, not a limitation. It's perfectly capable of doing it for you, but making it available would require acknowledgement that it opens the door to open-slather pointer operations, making it all too easy for the average VB Joe in the street to screw his application

Like "can't build normal dll's", and several other famous problems, mythical beasts, the ability to apply an arbitrary UDT mapping to an address of your choosing is not so hard....

Have you never "rolled your own"???

Dynamic array, I mean, not a spliff! :chuckle:

You CAN have your cake (access Fred.Member.SubMember), and eat it too (set Fred.Address yourself). I do it all the time!

ionescu007 · Sometimes here Joined: 21 Aug 2004 Posts: 33

If you're thinking of doing:

UDT Foo
Bar as Long
BarString() As String
Bar2 as Long
Bat2String() as String
Bar3 as Long
etc...

and then manually reading the first long, then copying into the strptr/varptr of the string array, you'll notice that the structure isn't alctually contigous (because of dynamic OLESAFEARRAYS) and if you'll want to read the whole thing at once (in the case of passing it to an API, I know it won't happen here), you'll run into a dead end.

In other news, I've found out the unknown/flag parts of ProjectInfo 2 and will be updating the PDF when I get back from school tonight.

Best regards,
Alex Ionescu

MrUnleaded · Posted: Tue Aug 24, 2004 3:56 pm Post subject:

Several of the structures here will simply not work when copied and pasted into VB5/6/.Net but they are all in a format that isnt too confusing to understand.

Anyways it looks like it has changed since my last view.

I guess it is just the +iSizeAddinRegKey +iSizeAddinName +... stuff that represents the offset that is confusing me....

Usually for something like this i load up the entire struct into a custom buffer....size equal to lStructSize....and then "pop" off variables....

_aLfa_ · Posted: Tue Aug 24, 2004 4:32 pm Post subject:

I use something like that too.
And in VB .NET is even easier to do that
_________________
One thing only I know, and that is that I know nothing. (Socrates)

Dr Memory · Expert Joined: 16 Aug 2004 Posts: 147 Location: Surrey, UK

Was that explanation a little too brief?

Oops! Sorry about that!

I'll fix that, but before I do, can you tell me, what methods are you and/or people here generally using to examine EXE files?

I mean, are you accessing it as a file or as an image?

Cheers

Dr Memory · Expert Joined: 16 Aug 2004 Posts: 147 Location: Surrey, UK

"something like that in VB.NET"

Omygawwd!

Don't worry, they'll probably develop a cure soon!