Skip to content

Instantly share code, notes, and snippets.

View AlexeyTolstopyatov's full-sized avatar
:shipit:
Exploring binaries and mem-garbage

CoffeeLake AlexeyTolstopyatov

:shipit:
Exploring binaries and mem-garbage
View GitHub Profile
using System;
using System.Collections.Generic;
using UnityEngine; // база
using TMPro; // TextMeshPro
/// <summary>
/// Определение типа "Слова".
/// Если я помню правильно, аттрибут нужен, чтобы Юня
@AlexeyTolstopyatov
AlexeyTolstopyatov / vb56head.cs
Last active May 31, 2025 06:48
The proposed VB5 table
//
// (C) CoffeeLake 2024-2025
// 15th section (as far as I know, ".text")
// stores Visual Basic 5.0 VM information. Nowdays 15th section stores Cor20 .NET data
//
public struct VbHeaderStart
{
public Byte Ia32PushCode;
public UInt32 PushAddress; // <- This address is a pointer to the VbHeader
public Byte Ia32CallCode; // structure.
@AlexeyTolstopyatov
AlexeyTolstopyatov / KillRvVPN.cmd
Created June 8, 2025 12:16
TerminateRadminVPN
ECHO OFF
TASKKILL /F /IM RvRvpnGui.exe /FI "STATUS eq RUNNING"
TASKKILL /F /IM RvControlSvc.exe
EXIT

Found VB 3.0 Runtime structures

NE segmented image divides per-segment. First segment follows alter segmented header: .CODE16 segment

For Microsoft Visual Basic 3.0 runtime this segment has next structure:

Type Vb3CodeSegment
  sUnknown1 As String * 1
  Token As String * 1
  sizeOfUnknown__ As Integer

Microsoft Visual Basic 4.0 runtime

Find diffenences between Visual Basic 4 header and old header (VB 4.0 too).

All information took from SemiVB decompiler by VBGamer45.

Disassembled structure looks like this:

All datatypes translates to undependent C# primitives