wqweto

Reconstructing a VB6 p-code OCX from vbdec output: problems and lessons

Context

• Target: a commercial VB6 ActiveX control library (one OCX, compiled to p-code, packed with an executable compressor). After unpacking: 1,844 p-code procedures, about 137k instructions. The main UserControl alone has about 23k lines of reconstructed source. A second, smaller designer OCX was reconstructed the same way.
• Goal: VB6 source that compiles binary compatible with the original (same CLSIDs, IIDs, DISPIDs, enums, identical type library) and behaves the same.
• Pipeline:
  1. Unpack the OCX.
  2. vbdec disassembly, one file per procedure, plus an object dump and a method list.

3. Fix vbdec's call-target names in the disassembly.

wqweto

[Description("")]
[FormDesignerId("EEE61188-FE4E-4F4F-9274-D6373E8C5008")]
[PredeclaredId]
Class Form1

    Private Declare PtrSafe Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As LongPtr)
    Private Declare PtrSafe Function ArrPtr Lib "vbe7" Alias "VarPtr" (Ptr() As Any) As LongPtr

    Private Type SAFEARRAY1D
        cDims               As Integer

wqweto

'=== mdCallStack.bas =======================================================
' VB6 call-stack capture via dbghelp.dll (32-bit StackWalk + Unicode symbol APIs).
'
' Requires:  Native code compile + "Create Symbolic Debug Info" (Project ->
'            Properties -> Compile).  The resulting .pdb must sit next to the
'            .exe/.dll.  Ship a known-good dbghelp.dll alongside the app.
'
' Output mimics the IDE call-stack view, one frame per line:
'   Module.ext!Class::Method Line 123           (when source line is known)
'   Module.dll!Export + &H1A                    (no PDB -> symbol + displacement)

wqweto

Emulating VB6: References vs Components, and the Ctl suffix

A guide for language/IDE developers who want to reproduce how VB6 surfaces COM type libraries in its two pickers (References and Components) and decides the control namespace name (and when to append the Ctl suffix).

Everything below was verified against a real working OCX (UniCCtl.ocx, library FLAGS=2, no suffix) and a from-scratch one (FLAGS=0, suffix appears).

---

wqweto

# Find-DanglingOnErrorGoto0.ps1

param(
    [string]$Path
)

# Finds VB6 procedures that have `On Error GoTo 0` but do NOT have a real
# error handler (neither `On Error GoTo <label>` nor `On Error Resume Next`).

if (-not $Path) {

wqweto

Type=Exe
Reference=*\G{00020430-0000-0000-C000-000000000046}#2.0#0#..\..\..\Windows\SysWOW64\stdole2.tlb#OLE Automation
Module=mdUsbPrinters; mdUsbPrinters.bas
Module=mdStartup; mdStartup.bas
Startup="Sub Main"
ExeName32="UsbPrinters.exe"
Command32=""
Name="Project1"
HelpContextID="0"
CompatibleMode="0"

wqweto

[Description("")]
[FormDesignerId("70FFB010-72A5-4DC0-8DBC-4F33ED7EE0B0")]
[PredeclaredId]
Class Form1

    Private DeclareWide Function StrCmpLogicalW Lib "shlwapi" (ByVal psz1 As String, ByVal psz2 As String) As Boolean

    Sub New()
        Dim a(0 To 1000000) As String
        Dim lIdx        As Long

wqweto

Option Explicit
DefObj A-Z
Private Const MODULE_NAME As String = "mdHookImportedFunctionByName"

'--- will DebugPrint module imports
#Const SHOW_MODULE_IMPORTS = True

'=========================================================================
' API
'=========================================================================

wqweto

Option Explicit
DefObj A-Z
Private Const MODULE_NAME As String = "mdImageConvert"

'=========================================================================
' API
'=========================================================================

'--- for GdipCreateBitmapFromScan0
Private Const PixelFormat32bppPARGB         As Long = &HE200B

wqweto

IF OBJECT_ID('fn_sys_GetUuidV5') IS NOT NULL DROP FUNCTION fn_sys_GetUuidV5
GO
-- SELECT dbo.fn_sys_GetUuidV5(CONVERT(UNIQUEIDENTIFIER, 'E11EAC0E-4D75-4567-BA60-683D357A9227'), 'Test42'), '73CF5B24-114A-5A5B-837C-64CF22468258'
-- SELECT dbo.fn_sys_GetUuidV5(CONVERT(UNIQUEIDENTIFIER, '6ba7b810-9dad-11d1-80b4-00c04fd430c8'), 'www.terraform.io'), 'A5008FAE-B28C-5BA5-96CD-82B4C53552D6'
-- SELECT dbo.fn_sys_GetUuidV5(CONVERT(UNIQUEIDENTIFIER, '6ba7b810-9dad-11d1-80b4-00c04fd430c8'), 'Проба'), 'E40F6EF0-210D-5F5B-B2B1-CABD47B5CBD9'

CREATE FUNCTION fn_sys_GetUuidV5 (
			@Namespace		SQL_VARIANT
			, @Name			SQL_VARIANT
) RETURNS UNIQUEIDENTIFIER