VB Decompiler

MrUnleaded · Posted: Sat Nov 23, 2002 3:35 am Post subject: help with form decompiling

Ok with a little help from aLfa i figured out how to decode most of the forms.....but heres my problem....

heres a hex dump of the frmMain section of common app:

MrUnleaded · Posted: Sat Nov 23, 2002 3:59 am Post subject: Re: help with form decompiling

and also....the last four bytes.... 46 03FF 01
i know that 0x46 is the MemberID for StartUpPosition but in the COM library it says that it takes an integer....whereas it should take a byte

the last two bytes i am pretty sure designate how the next control\property should be displayed......

anyone know what up with the conflicting Variable Types?
_________________
-MrU

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

1. This answers your question:

I think your statement re: 0x35 being not a valid member is predicated on the fact that there is no IDe property that operates that way? True, but you need to think how VB thinks: If you look in the IDE properties, you will realize that the properties are in alphabetical order; this is for user convienience, not VB's. So, you have to think differently...0x35 is the SizePosition opcode. In other words, Top,Left, Height and Width are all buried in there...under 0x35. (There is NO opcode for Top, NO opcode for Left, etc). The 0x4D is also a "fooler"

2. This reprimands you:

Use RACE, turn on the OFFSET option.

Sarge

PS: Re item 2, that really hurts.

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

"0x4D" should have been "0x46"...my bad.

Sarge

PS: Are you feeling any pain from my scathing remark? And, by the way, what the hell are you doing up a 4am?

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Here's the whole thing via RACE 2.3:

Filename: C:\RaceDevelopment\support\CommonApp.exe
--------------BEGIN PROJECT PROPERTIES-------------
Comments:
Company Name:
File Description:
CopyRight:
TradeMark:
Product Name: this_is_the_project_name
File Version: 1.00
Product Version: 1.00
Internal Name: CommonApp
Original File Name: CommonApp.exe
Application Title: this_is_the_project_title
HelpFile Name: help_file_name.hlp
Project Name: this_is_the_project_title
Disc File Name: CommonApp
StartUp Module: (Sub) Main [BAS]
Project Description: this is the project description
Compile Type: Pseudo Code
--------------END PROJECT PROPERTIES-------------
--------------BEGIN MODULE POOL LIST-------------
frmMain
modMain
--End of module list--
--Item count: 2--
--------------END MODULE POOL LIST-------------
----------Begin FORM----------
Name: frmMain (SDI)
Caption: Common Application
ScaleMode: 1 - Twip
FontTransparent: True
AutoRedraw: False
Icon: (DEFAULT ICON)
LinkTopic: Form1
Left: 60
Top: 345
Width: 3645
Height: 1965
StartUpPosition: 3 - Windows Default
----------Begin TEXTBOX----------
Name: txtItem
Left: 120
Top: 120
Height: 285
Width: 2415
TabIndex: 2
----------End TEXTBOX---------
----------Begin LIST BOX----------
Name: lstItems
Left: 120
Top: 600
Height: 1230
Width: 3375
TabIndex: 1
----------End LISTBOX---------
----------Begin COMMAND BUTTON----------
Name: cmdAdd
Caption: Add
Left: 2640
Top: 120
Height: 255
Width: 855
TabIndex: 0
----------End COMMANDBUTTON---------
----------End FORM---------

Let me know if you find any errors.

Sarge

MrUnleaded · Posted: Sat Nov 23, 2002 9:44 pm Post subject: COM?

[="sarge":2cqox4dw]Here's the whole thing via RACE 2.3:

....
....
....

Let me know if you find any errors.

Sarge[/:2cqox4dw]

Hey just out of Curiosity.....do you use COM inorder to split out your Variable namesTypes??

Who does use COM here?
_________________
-MrU

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

The answer to that is easy: emphatically not.

Why is it easy? Because I have no idea what/how/who COM is (other than the term Common Object Module), so I don't use it (and never have). As soon as I see the term "object", I panic..I do not understand the concept/usage of OOP. In fact, I am so paranoid of that that I am not even sure COM is related to OOP...and....I don't want to know!

Actually, you don't need to go that far until you need to access the events for code that relates any external libraries used in the app. At that point, you may want to go the TypeLib route. The other option is to just name the event as a procedure w/address....so you'd have like TreeList_Proc_413AD and not worry if that is a Click event, etc. At the very least, use that as a first step to prove/debug your analysis tool, then worry about getting the real event name out of the OCX (or whatever).

The current version of RACE (under development, not the one currently available on the other MB), does just that. For CommonApp, which uses intrinsic controls, it pumps out the code for each control event by name. For test programs that use, for example, the MSCOMM32 control, I just use the generic term "Event" with the address. I expect to begin using the real event names shortly; I have to clean up the format of the output text file first.

Sarge

MrUnleaded · Posted: Wed Nov 27, 2002 7:34 pm Post subject: Re: COM who?

[="sarge":3mr7iymt]The answer to that is easy: emphatically not.

Why is it easy?
Sarge[/:3mr7iymt]

well....it makes a whole lot of the database techniques obsolete....ie the RSL files

but i keep having minor problems....COM tells me the parameter should be a Integer....but its a byte....so im confused now....

im having trouble getting COM to work with the more indepth Properties like Font that has the "BeginProperty" thingy.....

i will post the TypeLibInfo project asap...that way everyone can download it and incorporate it if they feel so inclined.
_________________
-MrU

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Well, if you want help with the font stuff, you only have to ask (of course! I'm sure I don't have to tell you that). The BeginProperty thingy is easier if you change your thinking from "opcode, parameter" to "opcode, flag"; at least, it was the way I did it. Hmm, did CommonApp/2 have any font stuff in it? I think not, but I'm not sure...I'll go check them both, if there is any, I'll dump it.

I would absolutely love to see your typelib stuff; I started it and ran with it just enough to get a feel for what I needed to do to incorporate it into Race, but haven't done so yet. (I've just finished up the Pcode display for the GUI, and will be starting the non-GUI stuff next.)

(So, what's with all the BS on the other MB? Hope it doesn't come here, cause that stuff is the main reason I don't visit there much.)

Sarge

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

[="MrUnleaded":2ive6qsx]COM tells me the parameter should be a Integer....but its a byte....so im confused now....

im having trouble getting COM to work with the more indepth Properties like Font that has the "BeginProperty" thingy.....

i will post the TypeLibInfo project asap...that way everyone can download it and incorporate it if they feel so inclined.[/:2ive6qsx]

Yess, you could always use the one that I made ages ago heehee. I had the same problem as you MrU. It seems that, for the internal vb types, the actual types are not as they seem. A lot of the things say integer for example, but only hold one byte in the file etc etc. My thoughts were that you cant use COM effectively for the internal types, but you can for external types...

Anonymous · New User Joined: 10 Feb 2008 Posts: 0

My bad, I realised that you have posted the one that I gave out. Please note that I didnt make it from scratch - it wass pulled as an example from the msdn.com site. I changed it a little, but dont give me much (or any) of the credit for it.

MrUnleaded · Posted: Sat Nov 30, 2002 5:34 am Post subject: Re: COM who?

[="moogman":27ywqnlw]Yess, you could always use the one that I made ages ago heehee. I had the same problem as you MrU. It seems that, for the internal vb types, the actual types are not as they seem. A lot of the things say integer for example, but only hold one byte in the file etc etc. My thoughts were that you cant use COM effectively for the internal types, but you can for external types...[/:27ywqnlw]

ok then i will program the stuff for the internal types using COM but add in a set of Exceptions[or whatever] fo the internal types.....as thats what my original post was about....

"for StartUpPosition but in the COM library it says that it takes an integer....whereas it should take a byte"

i guess vbvm does the processing for internal types and goes to COM for external....

help on the Font stuff would be great.......
isnt a Font an external librarypropertyitem??
_________________
-MrU

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Well, I hate use this term, but I guess you could consider Fonts as a class (agghhh!) Anyway, treat the font block of code as a sub-property of the particular control/form it relates to. That way, when you make your "font parser", the same one will work for all fonts on all controls.

Some hints: Other than a few textual properties, most of the font data is in the form of flags, so expect to do a bit of bit manipulation (hey, I made a pun!)

Other than that, you'll have to ask a more specific question. As always, you can use my humble offering as a guide as to where the data is and how to decode it.

Sidebar: who is the "owner" of the data on this MB? Yes, I know it belongs to us all (and maybe even the public) but my question is intended to determine who actually decides that the published data is correct or finished; I ask this because I wonder if we shouldn't begin to prioritize our efforts...there are still "open" spots in the structs that we have questions on,; should they be answered first, or new stuff started and the unknown/half-finished data done later because it is less critical to us now? So, should there be a thread/table that is a list of prioritized "we'll get to it later" items? Or even just a list of "don't forget we haven't finsihed this" stuff?

Sarge

PS Hope those of you to whom it is applicable had a happy holiday!

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

(Well, I would have put this in the previous post, if I was allowed to edit!)

PPS: I could use some help with the "Declares" in a module; how to find them, etc.

Sarge

MrUnleaded · Posted: Tue Dec 03, 2002 3:56 pm Post subject: Re: Fonts

>Sidebar: who is the "owner" of the data on this MB? Yes, I know it belongs to us all (and maybe even the public) but my question is intended to determine who actually decides that the published data is correct or finished;

the way i see it....we should all find a common ground which we agree upon....

>I ask this because I wonder if we shouldn't begin to prioritize our efforts...there are still "open" spots in the structs that we have questions on,; should they be answered first, or new stuff started and the unknown/half-finished data done later because it is less critical to us now?

i think we should fix problemserrors as we find them....but still continue on

>So, should there be a thread/table that is a list of prioritized "we'll get to it later" items? Or even just a list of "don't forget we haven't finsihed this" stuff?

a "Correction to be done" topic would be a good one.....i can deleteedit as items are fixed...

>PS Hope those of you to whom it is applicable had a happy holiday!

its past...but happy holiday to you too
_________________
-MrU

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

"Correction to be done" is probably a good idea. But also realize that you then have to go back thru this MB and find all the places where we had posts that discussed/disagreed/etc, and at that point decided to get_to_it_later, and then put all of those topics in this list. In other words, you'll have to go backwards to get the not-yet-done corrections (like the infamous "address5"?), as well as whatever we find in the future.

Good luck with the fonts; an answer is always just a question away!

Sarge

MrUnleaded · Posted: Tue Dec 03, 2002 11:06 pm Post subject: you are right so...

i am going to go and try to update as much as i can....ill keep you updated and post where anychanges are made...
_________________
-MrU

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

I realize that, that is a lot of work, especially if you have to maintain the PCODE database...there ARE those of us out here how appreciate your efforts.

Thanks

Sarge

MrUnleaded · Posted: Wed Dec 04, 2002 3:38 pm Post subject: w00t

Thanks sarge i appreciate it.....i think i will have to have a real-time chat with you about the "address5" thing... hehe....you have AIM or soemthing?
_________________
-MrU

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Well, don't tell anyone (which means only you should read this post???), but I'm doing this from work, where no outside contact is allowed...so, no type of real-time chat or messaging or ANYTHING. So, we may have to do that from my home...which leads to the time difference thing. We'll have to work on this; if you recall, I have desired and still do desire to do this via phone...maybe internet phone? Well, we'll get there when we get there.

Sarge

MrUnleaded · Posted: Wed Dec 04, 2002 11:30 pm Post subject: [reset]

[="sarge":12dma7yq]Well, don't tell anyone (which means only you should read this post???), but I'm doing this from work, where no outside contact is allowed...so, no type of real-time chat or messaging or ANYTHING. So, we may have to do that from my home...which leads to the time difference thing. We'll have to work on this; if you recall, I have desired and still do desire to do this via phone...maybe internet phone? Well, we'll get there when we get there.

Sarge[/:12dma7yq]

well i say we start over.....and dont post more then a paragraph at a time...otherwise you lose me.....

what is the problem with Address5?
_________________
-MrU

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Aha! The "one-step-at-a-time" concept. Way to go!.....and as soon as I get my notes together, I'll repost something that is a bit more clear!!

Be back later.

Sarge

vbgamer45 · Posted: Thu Jul 22, 2004 12:49 am Post subject:

This was driving me nuts today. I should have read about the size opcode first.. This is what i am doing.
First I get the control/form header.
Public Type ControlHeader
Length As Integer 'Length of the control/form
unknown As Integer
un1 As Byte 'unknown
cName As String 'Control Name
un2 As Byte unknown
cType As Byte 'Control/Form type
End Type
For ctype i am using a hard coded list.

Next i am using COM to find all the properties and get their values.

Then I get the sizetype...I spent a while trying to figure that out when i noticed i didn't see the opcodes for height, width, top or left.
Public Type ControlSize
clientLeft As Integer
un2 As Integer 'unknown
clientTop As Integer
un3 As Integer 'unknown
clientWidth As Integer
un4 As Integer 'unknown
clientHeight As Integer
End Type

Finally the control seperator.

Ok a couple questions now.
Any ideas on the tag property. When i put a string into the tag it turns into a unicode string not a normal string.

A couple questions on COM.
Is vb6.olb part of the runtime and is it required for the exe to run?
If the file "vb6.olb" does not need to be installed on the computer how does the program get the properties of the standard vb controls.

It seems that guid's are important for something. I have yet to be able to grasp this. I been looking though the exe's looking at guid's conatined in them and can't seem to match them up to typeviewer or maybe i am reading them wrong.

vbgamer45 · Posted: Thu Jul 22, 2004 3:12 am Post subject:

Well I was playing around some more I had a mistake in my last post

Public Type ControlSize
clientLeft As Integer
un1 As Integer
clientTop As Integer
un2 As Integer
clientWidth As Integer
un3 As Integer
clientHeight As Integer
un4 As Integer
End Type

Thats the correct one.
Then after that you have search for more COM Properties
Then get the control seperator.

Now i finally see the problem you all are getting the startup position
on a form from COM returns an integer when it should be a byte.
Any other properties that do this?
It gets me thinking about wether i should be getting the properties from vb6.olb or if there is another source for them...

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Pardon me, but you might want to re-visit your definitions for top/left/height/width. Try really large values (larger than an integer); try negative values also. And, compare the "valid" values of, for example, a form, against the "valid" values of other controls.

Sarge

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

POST #2:

Well, since I can't seed to edit my own post...

Yes, you're correct about the TAG property being Unicode. So? You still have to parse it; it doesn't matter whether it's DOS or UNI. And, Unicode IS the "normal" string; at least, now-adays.

GUID are references to external things....you might want to make some test programs using the "Declare" pragma.

Sarge

vbgamer45 · Posted: Thu Jul 22, 2004 10:41 pm Post subject:

Figured out the unicode string thing. COM is now making me somewhat mad now that it doesn't always return the right type....Fixed the size of clienttop clientheight, properties. Hmm right now for COM i have the option to skip COM since it doesn't work all the time...but this gives me a new idea maybe i will have a list of properties that COM doesn't do right for each control and then checked if that property is on that list.. Added the option to dump a control/form's raw data.

MrUnleaded · Posted: Mon Jul 26, 2004 5:48 pm Post subject:

[="vbgamer45":ijzf29yf]Figured out the unicode string thing. COM is now making me somewhat mad now that it doesn't always return the right type....Fixed the size of clienttop clientheight, properties. Hmm right now for COM i have the option to skip COM since it doesn't work all the time...but this gives me a new idea maybe i will have a list of properties that COM doesn't do right for each control and then checked if that property is on that list.. Added the option to dump a control/form's raw data.[/:ijzf29yf]

If i were you i would think of some form of database for "fixes" of COM. my first attempt with COM ended up pretty ugly....since i hard coded many of the "fixes"....eventually i realized how many there were...

Just a suggestion
_________________
-MrU

vbgamer45 · Posted: Mon Jul 26, 2004 7:06 pm Post subject:

Yeah, right now I have textfile that has the following format
Objectname,PropertyName,NewDataType
So here is one of them
Form,StartUpPosition,Byte

Right now I have hardcoded control and form size opcodes.
So many properties to worry about... Font seems strange. Doesn't work with my format for com hacks maybe I need another one.
Started work on graphics and extracting them.

vbgamer45 · Posted: Fri Aug 06, 2004 2:30 am Post subject:

Everything is going great so far.
Got Image extraction done, have most of the properites decoded, have the font and size property for each control.

Now my current problem deals with each control ending.
Before at the end of each control I would get an integer and
check what type of ending it was FF 01, FF 02 etc
This was working great until. I started to get errors on common app 2.
I soon realized that there was line FF 02 02 03 for the end of Command1.
So I decieded I would write a quick function that would goto the end of the current control via the control header length and go backwards till FF.
And then i process each byte between 01 to 05
But...I found out the control length property does not goto to the end of the last seperator.

So this is my current problem getting all of the seperators before the start of the new control.

MrUnleaded · Posted: Fri Aug 06, 2004 4:50 am Post subject:

from what i remember those numbers determine wether the next control is a sub control ie a control in a frame.....or just a next control.....or the end of a parenting control....

look at the relation of child to parent controls and you should figure it out.
_________________
-MrU

_aLfa_ · Posted: Fri Aug 06, 2004 7:50 am Post subject:

Yes, indeed.
The last part (after gui opcodes) of each control determines wether the very next control is child, or if the current control is the last one of its parent, etc...
Compile some forms with frames with controls inside, and frames inside and you should be able to figure it out
_________________
One thing only I know, and that is that I know nothing. (Socrates)

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Well, that's not the best way. The FF xx series is an "escape" from each control "up" to it's parent. So, FF 02 02 03 means "end of this child control, end of it's parent (although still a child, itself), and finally, end of IT's parent". Something like this:

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

And, since I can't edit the above, I guess it's too late to "uncode" it...but I couldn't figure out how else to indent.

Not to mention that I forgot to sign it, so here that is:

Sarge

Sarge <-----This is, of course, the signature for THIS post

MrUnleaded · Posted: Fri Aug 06, 2004 3:16 pm Post subject:

[="sarge":2ngcy8d2]And, since I can't edit the above, I guess it's too late to "uncode" it...but I couldn't figure out how else to indent.

Not to mention that I forgot to sign it, so here that is:

Sarge

Sarge <-----This is, of course, the signature for THIS post[/:2ngcy8d2]lol....im sorry man....if any of you are familiar with phpBB2.....let me know how to change permissions.....i have only two options....moderator and not.

and seeing how those who are moderators cant edit.....im not sure what good that did.
_________________
-MrU

vbgamer45 · Posted: Fri Aug 06, 2004 3:22 pm Post subject:

Thank you Sarge, I finally got a good understanding it. CommonApp2 finished.

test: I edited my post woot!

MrUnleaded · Posted: Fri Aug 06, 2004 3:43 pm Post subject:

[="vbgamer45":3tnvu5hx]Thank you Sarge, I finally got a good understanding it. CommonApp2 finished.[/:3tnvu5hx]

Post your output, im sure I am not the only one whod like to see it.

There is a section for it too i think.
_________________
-MrU

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

All:
Since I had done my little "FF xx" explanation (above) from memory, I wanted to make sure I had not only the concept right, but the data right. So I checked my notes...looks like I hit only 50%. Here's my notes:

vbgamer45 · Posted: Sat Aug 07, 2004 1:25 pm Post subject:

Thank you Sarge for the information,
What do you call FF05 right now i call it begin of menu? Any better name for it?

MrUnleaded · Posted: Sat Aug 07, 2004 4:32 pm Post subject:

[="sarge":3foupxen]All:
Since I had done my little "FF xx" explanation (above) from memory, I wanted to make sure I had not only the concept right, but the data right. So I checked my notes...looks like I hit only 50%. Here's my notes:

sarge · Moderator Joined: 24 Sep 2002 Posts: 194

Depends...if you flag the first byte as FF, and concatinate it with each additional byte until you exit, then you just need to compare one at a time. So FF01 and FF02 and FF03, etc IS the sequence.

I call it BEGINFORMMENU. And here is a hint: beware of an upcoming trap; thing aren't always consistant!

Sarge

MrUnleaded · Posted: Sun Aug 08, 2004 1:17 am Post subject:

[="sarge":v1ukx9k4]Depends...if you flag the first byte as FF, and concatinate it with each additional byte until you exit, then you just need to compare one at a time. So FF01 and FF02 and FF03, etc IS the sequence.

I call it BEGINFORMMENU. And here is a hint: beware of an upcoming trap; thing aren't always consistant!

Sarge[/:v1ukx9k4]well....if you have to add FF to make the sequence FF0X...then is it really FF0X?

but yea.....the dreaded menu problem hehehe good luck
_________________
-MrU