VB6 Class Instances


Author: David Zimmer
Date: 01.15.23 - 9:38pm



Does the runtime track all live instances of classes?
Where can I find this data?

consider the following:

'Module 1
Dim a As Class1
Dim b As Object
Dim c As Object

Sub Main()
    Set a = New Class1
    Set b = New Class1
    Set c = New Class1
    a.name = "dog"
    b.name = "cat"
    c.name = "bird"
    InputBox "", , Hex(ObjPtr(a)) & " " & Hex(ObjPtr(b)) & " " & Hex(ObjPtr(c))
End Sub

'Class 1 code
Public name As String

Private Sub Class_Terminate()
    MsgBox "terminating " & name
End Sub
Since the vars are owned at global module level, they are only torn down at program end, so what triggers the tear down and how does the runtime find them?

for the answer see

.text:66027FE5 void __stdcall RcmResetModulesPrepass(struct epiProject *objTable, struct ProjectThread *)

runtime data:
   objptr 1 = 565280 
   objptr 2 = 565C88 
   objptr 3 = 565CE8

Header field:
   Class1.ObjInfo.lpProjectData     402018

Memory walking:
00402018  005650C8  *RUN_INSTMGR 

005650C8  00565CE8  <-- objptr 3
005650CC  00000000
005650D0  004011E8  Project1.004011E8  Class1.objinfo
005650D4  00000003  <-- live instances count

	00565CE8  00402348  Project1.00402348  class vtable
	00565CEC  00565C88  <-- objptr 2
	00565CF0  00565D04  -> 660682E0  MSVBVM60.BASIC_CLASS::PRIVATE_UNKNOWN::`vftable'
	00565CF4  02BAC904  -> 6600FF08  MSVBVM60.CClassModule::CUnkPrivate::`vftable'
	00565CF8  02BAC8EC  -> 6600FB08  MSVBVM60.CClassModule::`vftable'

		00565C88  00402348  Project1.00402348 class vtable
		00565C8C  00565280  <-- objptr 1
		00565C90  00565CA4  -> 660682E0  MSVBVM60.BASIC_CLASS::PRIVATE_UNKNOWN::`vftable'
		00565C94  02BAC8B4  -> 6600FF08  MSVBVM60.CClassModule::CUnkPrivate::`vftable'
		00565C98  02BAC89C  -> 6600FB08  MSVBVM60.CClassModule::`vftable'
		00565C9C  00000000

			00565280  00402348  Project1.00402348 class vtable
			00565284  00000000  <-- no next instance
			00565288  0056529C
			0056528C  02BAC864
			00565290  02BAC84C

call stack when pausing the debugger at MsgBox in Class_Terminate and inspecting from there.
Address    Stack      Procedure / arguments                         Called from  
0019FA64   66028116   MSVBVM60.RUN_INSTMGR::ExecuteInitTerm         MSVBVM60.66028111 
0019FA9C   66027F83   MSVBVM60.RcmResetModulesPrepass               MSVBVM60.66027F7E 
0019FAB0   66027F04   MSVBVM60.RcmShutDownProject                   MSVBVM60.66027EFF 
0019FAC8   66027B3C   MSVBVM60.RcmResetProject                      MSVBVM60.66027B37 
0019FD44   66051B59   MSVBVM60.66027AC0                             MSVBVM60.66051B54 
0019FD58   66027A39   MSVBVM60.EbResetProjectNormal                 MSVBVM60.66027A34 
0019FD70   66027D28   MSVBVM60.CThreadPool::ResetProject            MSVBVM60.66027D23 
0019FD8C   66051AEC   MSVBVM60.DbgReset                             MSVBVM60.66051AE7 
0019FDAC   6600B1B5   MSVBVM60.DbgResetIfDoneRunning                MSVBVM60.6600B1B0 
0019FDE0   6600B0BB   MSVBVM60.MainAfterDispatch                    MSVBVM60.6600B0B6 
0019FDEC   6600B095   Includes MSVBVM60.6600B0BB                    MSVBVM60.6600B092 
0019FE20   6600B041   MSVBVM60.SCM::FContinueMessageLoop            MSVBVM60.6600B03C 
0019FE28   6600A7EE   Includes MSVBVM60.6600B041                    MSVBVM60.6600A7EB 
0019FE6C   6600A74D   MSVBVM60.ThunderMsgLoop                       MSVBVM60.6600A748 
0019FE80   6600A6EF   Includes MSVBVM60.6600A74D                    MSVBVM60.6600A6EC 
0019FEB0   6600A62B   MSVBVM60.SCM::FPushMessageLoop                MSVBVM60.6600A626 
0019FECC   6600A5F6   Includes MSVBVM60.6600A62B                    MSVBVM60.6600A5F3
0019FEF0   660241C0   MSVBVM60.CMsoComponent::PushMsgLoop           MSVBVM60.660241BB
0019FF6C   00401076   ?                         Project1.00401071


A UI for this for will be released in vbdec next week to view all live class instances in a running executable and can also dump the values of any public properties on the class. I have also taken to tracking the reference count which is at objptr() + &h20








Comments: (0)

 
Leave Comment:
Name:
Email: (not shown)
Message: (Required)
Math Question: 32 + 90 = ? followed by the letter: T 



About Me
More Blogs
Main Site
Posts: (All)
2026 ( 2 )
2025 ( 12 )
2024 ( 1 )
2023 (6)
     Yara Workbench Automation
     VS linker versions
     IDA decompiler comments
     PublicBytes struct
     DispCallFunc
     VB6 Class Instances
2022 (7)
     VB6 Implements
     VBDec Bug
     vbdec remote scripting
     VB6 Stubs BS
     VB6 TypeInfo
     VB6 VTable Layout
     Yara isPCode rule
2021 (4)
     VB6 Hijacking
     rtcTypeName
     VB6 Gosub
     VB App object
2020 ( 8 )
2019 ( 12 )
2017 ( 5 )
2016 ( 4 )
2015 ( 5 )
2014 ( 5 )
2013 ( 9 )
2012 ( 13 )
2011 ( 19 )
2010 ( 11 )
2009 ( 1 )