joec4281.github.io/vb6_dll_patch.html at main · joec4281/joec4281.github.io · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
<!DOCTYPE html>
<html>
<head>
  <meta charset="UTF-8">
  <title>Stopping VB6's Cleanup by Patching vba6.dll</title>
</head>
<body>
  <h1>Stopping VB6's Cleanup by Patching vba6.dll</h1>

  <h2>1. What You're Patching</h2>
  <p>In <strong>vba6.dll</strong> (VB6 SP6 English), two code paths check whether to delete generated <code>.obj</code> files. Those checks compile down to short-branch instructions:</p>
  <table>
    <thead>
      <tr>
        <th>File Offset (dec)</th>
        <th>RVA (hex)</th>
        <th>Original Opcode</th>
        <th>Meaning</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td>866 517</td>
        <td>0x0D38D5</td>
        <td>0x76 (JBE)</td>
        <td>Jump if below or equal</td>
      </tr>
      <tr>
        <td>866 577</td>
        <td>0x0D3911</td>
        <td>0x75 (JNE)</td>
        <td>Jump if not equal (ZF)</td>
      </tr>
    </tbody>
  </table>
  <p>By changing both bytes to <code>0xEB</code> (JMP short) you force an unconditional jump over the deletion logic-VB6 will leave the <code>.obj</code> files in place.</p>

  <hr>

  <h2>2. Verifying the Offsets</h2>
  <ol>
    <li>Backup your <code>vba6.dll</code> from <code>%SystemRoot%\System32</code> (e.g., <code>vba6.dll.bak</code>).</li>
    <li>Open it in a PE-aware hex editor and navigate to decimal offsets <strong>866517</strong> and <strong>866577</strong>.</li>
    <li>Confirm you see bytes <code>76</code> at 866 517 and <code>75</code> at 866 577. If they differ, you may have a localized or patched variant.</li>
  </ol>

  <hr>

  <h2>3. Pure PowerShell Patch/Unpatch Scripts</h2>
  <p>Save these two scripts alongside your <code>vba6.dll</code>, then run them <strong>as Administrator</strong>.</p>

  <h3>VBA6Patch.ps1</h3>
  <pre><code class="language-powershell">
param(
  [string]$DllPath = "vba6.dll",
  [int]$Off1    = 866517,
  [int]$Off2    = 866577
)

if (-not (Test-Path $DllPath)) {
  Write-Error "File not found: $DllPath"
  exit 1
}

$bytes = [System.IO.File]::ReadAllBytes($DllPath)

if ($bytes[$Off1] -ne 0x76) {
  Write-Warning ("Offset1 byte is 0x{0:X2} (expected 0x76)" -f $bytes[$Off1])
}
if ($bytes[$Off2] -ne 0x75) {
  Write-Warning ("Offset2 byte is 0x{0:X2} (expected 0x75)" -f $bytes[$Off2])
}

$bytes[$Off1] = 0xEB
$bytes[$Off2] = 0xEB

[System.IO.File]::WriteAllBytes($DllPath, $bytes)
Write-Host "Patch applied to $DllPath"
  </code></pre>

  <h3>VBA6Unpatch.ps1</h3>
  <pre><code class="language-powershell">
param(
  [string]$DllPath = "vba6.dll",
  [int]$Off1    = 866517,
  [int]$Off2    = 866577
)

if (-not (Test-Path $DllPath)) {
  Write-Error "File not found: $DllPath"
  exit 1
}

$bytes = [System.IO.File]::ReadAllBytes($DllPath)

if ($bytes[$Off1] -ne 0xEB) {
  Write-Warning ("Offset1 byte is 0x{0:X2} (expected 0xEB)" -f $bytes[$Off1])
}
if ($bytes[$Off2] -ne 0xEB) {
  Write-Warning ("Offset2 byte is 0x{0:X2} (expected 0xEB)" -f $bytes[$Off2])
}

$bytes[$Off1] = 0x76
$bytes[$Off2] = 0x75

[System.IO.File]::WriteAllBytes($DllPath, $bytes)
Write-Host "Patch removed from $DllPath"
  </code></pre>

  <hr>

  <h2>4. How to Confirm It Worked</h2>
  <ol>
    <li>Open the VB6 IDE and build any simple <code>.vbp</code> project.</li>
    <li>After the build completes, inspect your project's obj folder (or <code>%TMP%</code>). The <code>.obj</code> files should still be present.</li>
    <li>If they've vanished, ensure you ran the correct script against the right <code>vba6.dll</code>-on 64-bit Windows there may be one in <code>SysWOW64</code>.</li>
  </ol>

  <hr>

  <h2>5. Alternative Approaches</h2>
  <ul>
    <li><strong>API Hooks:</strong> Use Detours/MinHook to intercept <code>DeleteFileA</code> calls from the VB6 process.</li>
    <li><strong>NTFS Folder Permissions:</strong> Point your obj output to a directory with "deny delete" rights.</li>
    <li><strong>Third-Party Compilers:</strong> Consider VBCC or similar tools that produce standard <code>.obj</code> files.</li>
  </ul>

  <hr>

  <h2>6. Summary</h2>
  <p>By applying this patch you prevent VB6 SP6 from cleaning up your <code>.obj</code> outputs-granting you full control over linker workflows and easing integration of VB6-compiled objects into larger C/C++ projects.</p>
</body>
</html>