programmers resources
  http://www.intel-assembler.it/  (c)2017 intel-assembler.it   info@intel-assembler.it
 
Search :  
Lingua Italiana    English Language   
Index
 
just an empty assembly space
just an arrow Intel Platform
just an arrow Article & Guides
just an arrow Download Software


23/01/2009 Featured Article: How to remove Buzus Virus (permalink)




:::3210981:::
Bottone Scambio Directory Pubblicitaonline.it
Home Page | Articles & Guides | Download | Intel Platform | Contacts

Google
 


Bookmark and Share
Download 
Tell a friend



VBDE v0.85 (Visual Basic v6 Decompiler)

A VB Decompiler

(by iorior)

VBDE v0.85 (Visual Basic v6 Decompiler) This tool can rescue part of lost sources and offset of the procedures, if you have an executable compiled with Visual Basic 6.
This article is online from 2816 days and has been seen 23173 times





VBDE v0.85 (Visual Basic v6 Decompiler)
by iorior

This tool can rescue part of lost sources
and offset of the procedures, if you have
an executable compiled with Visual Basic 6.

NOTES VB6

Here is some notes.
I think it can be useful to change something in your programs,
it can be too useful for those who want to code a real decompiler ;) 
Mail me to complete or correct.
iorior@altavista.com

object type:

00 PictureBox 
01 label
02 textbox 
03 frame  
04 CommandButton
05 checkbox  
06 optionbutton  
07 combobox  
08 listbox  
09 hscrollbar  
0A vscrollbar  
0B timer  
10 drivelistbox  
11 dirlistbox  
12 filelistbox  
13 menu  
16 shape
17 line
18 image  
25 data   
26 OLE


some object properties:

menu properties:
01 index
02 visible
03 caption
04 checked
05 enabled
07 submenu
0B WindowList
0D Negotiatesituation

example: 04FF : checked = true


label properties:
01 Caption
02 Index
03 BackColor
04 ForeColor
05 Left, Top, Width, Height
09 Enabled
0A Visible
0B MousePointer
12 TabIndex
13 BorderStyle
14 Alignment
18 AutoSize
1A DragMode
1E WordWrap
1F BackStyle
24 UseMnemonic
25 Font
27 Appearance
2A ToolTiptexte 


example for a menu: 
FF02170000000C0500746874683100130304007468746800
as: FF 02 17000000 0C 0500 thth1 00 13 03 0400 thth 00

FF : separator
02 : means that the previous is not the last submenu in the menu
17 : lenght
0C : number of the object
05 : lenght of the name
thth1 : name
13 : type (list above)
03 : property 'caption' (list above)
04 : lenght of the caption
thth :  caption

-------------------------------------------------------------------


To enable a commandbutton:
(command.enable = true)

00401F38                 call    dword ptr [edx+304h]  ; objet reference
00401F3E                 push    eax
00401F3F                 lea     eax, [ebp-18h]
00401F42                 push    eax
00401F43                 call    ds:__vbaObjSet
00401F49                 mov     esi, eax
00401F4B                 push    0FFFFFFFFh ; true
00401F4D                 push    esi
00401F4E                 mov     ecx, [esi]
00401F50                 call    dword ptr [ecx+8Ch] ; enable

command.visible = true:
00401F38                 call    dword ptr [edx+304h]   ; objet reference
00401F3E                 push    eax
00401F3F                 lea     eax, [ebp-18h]
00401F42                 push    eax
00401F43                 call    ds:__vbaObjSet
00401F49                 mov     esi, eax
00401F4B                 push    0FFFFFFFFh ; true
00401F4D                 push    esi
00401F4E                 mov     ecx, [esi]
00401F50                 call    dword ptr [ecx+94h] ;visible

(if command.visible = true)
004020D3                 call    dword ptr [edx+304h]  ; objet reference
004020D9                 push    eax
004020DA                 lea     eax, [ebp-18h]
004020DD                 push    eax
004020DE                 call    ds:__vbaObjSet
004020E4                 mov     esi, eax
004020E6                 lea     edx, [ebp-9Ch]
004020EC                 push    edx
004020ED                 push    esi
004020EE                 mov     ecx, [esi]
004020F0                 call    dword ptr [ecx+90h]  ;isvisible?


call    dword ptr [ecx+94h] 
94 : visible (commandbutton)

it's different for each property and for each type.

the list is easy to do:

label properties:
01 Caption => 54
02 Index => 5C
03 BackColor => 64
04 ForeColor => 6C

etc...




Top
Download 
Tell a friend
Bookmark and Share


 Tags: decompiler, vb


webmaster jes
writers rguru, tech-g, aiguru, drAx

site optimized for IE/Firefox/Chrome with 1024x768 resolution

Valid HTML 4.01 Transitional


ALL TRADEMARKS ® ARE PROPERTY OF LEGITTIMATE OWNERS.
© ALL RIGHTS RESERVED.

hosting&web - www.accademia3.it

grossocactus
find rguru on
http://www.twitter.com/sicurezza3/
... send an email ...
Your name

Destination email

Message

captcha! Code