Skip to content

Instantly share code, notes, and snippets.

@AlexeyTolstopyatov
Last active May 31, 2025 06:48
Show Gist options
  • Save AlexeyTolstopyatov/6b5dd8165afd69fbce1040deb1636b75 to your computer and use it in GitHub Desktop.
Save AlexeyTolstopyatov/6b5dd8165afd69fbce1040deb1636b75 to your computer and use it in GitHub Desktop.
The proposed VB5 table
//
// (C) CoffeeLake 2024-2025
// 15th section (as far as I know, ".text")
// stores Visual Basic 5.0 VM information. Nowdays 15th section stores Cor20 .NET data
//
public struct VbHeaderStart
{
public Byte Ia32PushCode;
public UInt32 PushAddress; // <- This address is a pointer to the VbHeader
public Byte Ia32CallCode; // structure.
public UInt32 CallAddress;
}
[StructLayout(LayoutKind.Sequential, Pack = 1)]
public struct VbHeader
{
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
public Char[] VbMagic;
public UInt16 RuntimeBuild;
public UInt64 LanguageDll;
public UInt64 SecondLanguageDll;
public UInt16 RuntimeRevision;
public UInt32 LanguageId;
public UInt32 SecondLanguageId;
public UInt32 SubMainPointer;
public UInt32 ProjectDataPointer;
public UInt32 IntegerCtlsFlagLow;
public UInt32 IntegerCtlsFlagHigh;
public UInt32 ThreadFlags;
public UInt32 ThreadCount;
public UInt16 FormCtlsCount;
public UInt16 ExternalCtlsCount;
public UInt32 ThunkCount;
public UInt32 GuiTablePointer;
public UInt32 ExternalTablePointer;
public UInt32 ComRegisterDataPointer;
public UInt32 ProjectDescriptionOffset;
public UInt32 ProjectExeNameOffset;
public UInt32 ProjectHelpOffset;
public UInt32 ProjectNameOffset;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment