|
Over the years I have invested heavily in product R&D building a wide
assortment of new skills, and fostering a diverse background and understanding.
These are some of the papers I have developed along my journey that I make freely available to help others along. |
Sandsprite Papers
Artificial Intelligence
VB6 P-Code / Reversing
VB6 Pcode Reference
VB6 File Format Reference
Scripting Arbitrary VB6 Apps
Recovery of VB6 prototypes
VB6 P-Code Disassembly
Writing a P-Code Debugger
VB6 P-Code Obfuscation
Binary Data Hiding in VB6
Binary Reuse of VB6 PCode
Parsing VB6 Form Controls
VB6 Variable Initilization
VB6 Record Descriptors (UDT)
Reverse Engineering / Binary Analysis
Visual Basic 6
-
VB6 File Format Specification: Undocumented Executable Structures and Memory Graph Recovery - Sandsprite 2026
This specification details the underlying architecture and fixed data structures embedded within Visual Basic 5 and 6 executables, including the VBHeader, GUI property blobs, and unified UDT/frame records. It provides a comprehensive map of how the MSVBVM runtime navigates the compiled object graph for both P-code and native binary builds.
The research synthesizes automated binary diffing, live memory probing via the running object table (ROT), and MSVBVM60 debug symbol analysis. AI-assisted technical synthesis was utilized to document complex serialized states—such as the control-code state machine and prototype type-bytes—bridging decades of community reversing research with modern, structured tooling.
The resulting reference maps the complete object hierarchy from the PE entry point down to individual procedure frame descriptors (RTMI) and overlapping native thunks. It provides the definitive technical foundation necessary for recovering compile-time function signatures, reconstructing live memory instances, and developing advanced static analysis tools.