Parse and inspect Visual Basic 6 compiled binaries.
This crate provides typed access to all internal structures within a VB6 compiled executable, from the PE entry point down to individual P-Code bytecode instructions.
use visualbasic::{VbProject,RecognitionFailure};let file_bytes = std::fs::read("sample.exe")?;let project = matchVbProject::from_bytes(&file_bytes){Ok(p) => p,Err(e) => match e.recognition_failure(){Some(RecognitionFailure::NotRecognized | RecognitionFailure::UnrecognizedFormat) => {// Quietly skip non-VB6 files.returnOk(());}Some(RecognitionFailure::TruncatedContainer) => {eprintln!("warn: looks VB6 but truncated: {e}");returnOk(());}
_ => returnErr(e.into()),},};println!("Project: {}", project.project_name()?);println!("Objects: {}", project.object_count()?);for obj in project.objects()? {let obj = obj?;println!(" {} ({})", obj.name()?, obj.object_kind()?);for method in obj.pcode_methods()? {let method = method?;for insn in method.instructions()? {println!(" {}", insn?);}}}
# Ok::<(),Box<dyn std::error::Error>>(())- PE entry point detection (EXE push-stub and DLL export patterns)
- VBHeader, ProjectData, ObjectTable and the full structure chain
- PublicObjectDescriptor, ObjectInfo, OptionalObjectInfo, PrivateObjectDescriptor
- P-Code bytecode: opcode tables, operand decoding, streaming instruction iterator
- Controls: ControlInfo, event sink vtables, event handler thunks
- COM metadata: GUIDs, TypeLib registration, external component tables
- Form binary data: control trees, property streams, font/picture resources
- MSVBVM60.DLL exports: 169 runtime function signatures with parameter types
For consumer code that wants a single tagged stream rather than walking each substructure by hand:
- [
VbProject::code_entrypoints()] — every code VA in the project (P-Code stubs, native procs, native thunks, event handlers,Sub Main) in oneVec<CodeEntrypoint>. - [
VbObject::events()] — joined(control, event_slot, handler_va)bindings for a form, with per-control-type event-name resolution. - [
VbProject::gui_entries_with_form_data()] — pairs each GUI table entry with its parsed form binary in one iterator. - [
VbProject::compilation_mode()] — distinguishesPcode/Native/Mixedbinaries (combines the project flag with a per-object scan). - [
VbProject::diagnostics()] — eager parse-health probe surfacing missing optional structures and known-anomaly patterns.
| Feature | Default | Effect |
|---|---|---|
tracing | off | Emits structured tracing::warn! events at silent fail-soft sites. No effect when disabled — the helpers compile to no-ops. |
The included dump example produces an ildasm-style text dump of a VB6 executable:
cargo run --example dump -- path/to/sample.exeThe VB6 compiled binary format was never officially or publicly documented by Microsoft. All structure layouts, field semantics, and P-Code opcode definitions in this crate have been reverse engineered from MSVBVM60.DLL (6.00.9848) and VB6.EXE (6.00.8176) by humans and AI. While the results have been cross-verified against runtime behavior, errors and inaccuracies are possible.
Copyright 2026 ATRAPS LLC. Licensed under the Apache License,
Version 2.0. See LICENSE and NOTICE.