Willi Ballenthin

reduce cursor memory usage

1

I also detected the single test method consumes 11GB memory, when running the tests with python2.7. Amazing! ``` @slow @kern32_test() def test_cursor_enum_all_asc(kernel32_idb, version, bitness, expected): minkey = kernel32_idb.id0.get_min().key cursor =...

currently observed in an internal IDB. need to reproduce and then figure out how an IDB handles rebasing. 

these are b-tree entries with arbitrary-sized blobs. no idea how they are stored yet. i presume everything will break if this type of entry is encountered.

Suggested by @randomaccess3/@phillmoore: https://twitter.com/phillmoore/statuses/422588200754765824

See the list here: https://github.com/randomaccess3/4n6_stuff/blob/master/GUIDs

`header.lpGuiTable` points to `.wFormCount` entries of `GuiTableEntry` ([ref](http://sandsprite.com/vb-reversing/vb-decompiler/viewtopic0d03.html)). Each of these points to a `GuiObjectInfo` ([ref](http://sandsprite.com/vb-reversing/vb-decompiler/viewtopic121f.html)). the reference [here](https://www.vb-decompiler.org/forms_editing.htm) describes how to interpret the opcodes that define an element. you...

extract olb references

1

found in test binary strings: ``` C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB ```

from the test sample, we see the following strings: ``` VBA6.DLL __vbaVarTstGt __vbaDateVar __vbaFpI4 __vbaVarSetObjAddref __vbaVarLateMemStAd __vbaVarLateMemCallSt __vbaLateMemCall __vbaVarLateMemSt __vbaVarSetVar __vbaVarVargNofree __vbaInStrVar __vbaVarCmpGt __vbaRedimPreserve __vbaVarForNext __vbaVarForInit ``` note: this is...

should be referenced from the object descriptor, somewhere. from test file, we see these strings that look like variables/properties: ``` LocalTime TimeDiff Index bytesTotal Lowerbound Upperbound track oldTracks FindValue arrSearch...