I'm looking at a problem with app that has lost source code and the app crashes shortly after calling code that appears to be [Global Variable representing Form Object].ZOrder 0 (i.e. trying to make the form visible) There are multiple forms so I am trying to work out specifically which form is being accessed. To work this out I made some sample code like this:

Public gFormToActivate As Form

Private Sub cmddoDo_Click()
    gsCurrentLine = "START: Set gFormToActivate = FormDoDo"
    Set gFormToActivate = FormDoDo
    gsCurrentLine = "END: Set gFormToActivate = FormDoDo"
    gsCurrentLine = "START: Me.Hide"
    gsCurrentLine = "END: Me.Hide"
End Sub

The ZOrder is later set using code like this:

Private Sub Command1_Click()
    Form2.Show vbModal
    gsCurrentLine = "START: gFormToActivate.ZOrder 0"
    gFormToActivate.ZOrder 0
    gsCurrentLine = "END: gFormToActivate.ZOrder 0"
End Sub

Using IDA Pro I look at the disassembly:

    .text:00403674 C7 45 D4 18 2B 40 00                                            mov     dword ptr [ebp-2Ch], offset aStartSetGformt ; "START: Set gFormToActivate = FormDoDo"
    .text:0040367B C7 45 CC 08 00 00 00                                            mov     dword ptr [ebp-34h], 8
    .text:00403682 FF D7                                                           call    edi ; __vbaVarCopy
    .text:00403684 A1 24 40 40 00                                                  mov     eax, dword_404024
    .text:00403689 85 C0                                                           test    eax, eax
    .text:0040368B 75 10                                                           jnz     short loc_40369D
    .text:0040368D 68 24 40 40 00                                                  push    offset dword_404024
    .text:00403692 68 60 15 40 00                                                  push    offset dword_401560
    .text:00403697 FF 15 4C 71 40 00                                               call    ds:__vbaNew2
    .text:0040369D                                                 loc_40369D:                             ; CODE XREF: .text:0040368B↑j
    .text:0040369D 8B 0D 24 40 40 00                                               mov     ecx, dword_404024
    .text:004036A3 68 E4 26 40 00                                                  push    offset dword_4026E4
    .text:004036A8 51                                                              push    ecx
    .text:004036A9 FF 15 70 71 40 00                                               call    ds:__vbaCastObj
    .text:004036AF 50                                                              push    eax
    .text:004036B0 68 60 40 40 00                                                  push    offset dword_404060
    .text:004036B5 FF 15 08 71 40 00                                               call    ds:__vbaObjSet
    .text:004036BB 8D 55 CC                                                        lea     edx, [ebp-34h]
    .text:004036BE 8D 4D DC                                                        lea     ecx, [ebp-24h]
    .text:004036C1 C7 45 D4 68 2B 40 00                                            mov     dword ptr [ebp-2Ch], offset aEndSetGformtoa ; "END: Set gFormToActivate = FormDoDo"

Based on this I suspected form variable might be stored at "offset dword_404060". Any suggestions on good next steps to work out in more detail how to get the properties of this object? In WinDbg looking a this address shows the following. I have been reviewing http://sandsprite.com/vb-reversing/files/Alex_Ionescu_vb_structures.pdf to better understand VB structures but haven't worked out a solution yet

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.