Modify VB Executable to force Taskbar Button

imageI had to troubleshoot an application that was published with Citrix XenApp. The problem with this application was that it didn’t have an button/icon in the taskbar and the window would sometimes disappear.

I noticed that this (cr)application was written in Visual Basic, so I decided to run it through a decompilation tool.

The decompiler was able to list the forms used in the Application:

image

I inspected the main form and it showed the following properties:

VERSION 5.00
Begin VB.Form frmServerLogin
  Caption = "Main Form"
  BackColor = &H80000005
  ForeColor = &H0
  ScaleMode = 1
  AutoRedraw = False
  FontTransparent = True
  FillColor = &HFFCECE
  BorderStyle = 5 'Sizable ToolWindow
  Icon = "frmServerLogin.frx":0
  LinkTopic = "Form1"
  MaxButton = 0   'False
  MinButton = 0   'False
  ClientLeft = 45
  ClientTop = 315
  ClientWidth = 7560
  ClientHeight = 5715
  BeginProperty Font
    Name = "Arial"
    Size = 9
    Charset = 0
    Weight = 400
    Underline = 0 'False
    Italic = 0 'False
    Strikethrough = 0 'False
  EndProperty
  Appearance = 0 'Flat
  ShowInTaskbar = 0   'False
  StartUpPosition = 2 'CenterScreen

Obviously I wanted to change ShowInTaskbar from False to True but the decompiler didn’t have an edit option.

I enabled the following option (Tools | Options):

SNAGHTML4ddea108

This made the Decompiler show the Hex Offset of the form in the exe file:

VERSION 5.00
Begin VB.Form frmServerLogin 'Offset: 00142B5E

I opened the exe file in an Hex Editor and jumped to the form Offset. A Visual Basic form is a binary, undocumented format but in the Hex Viewer we can see how it’s structured. Taking the Form Caption (Title) as example we can see that it has Id 1, has a length of 0C (12) Bytes and the String is “Main Form”:

image

Luckily the author of the VB Decompiler has already done the hard work and has created a table of all the Id’s here.

This is a small part of the table, listing the properties I needed:

  Form
01    Caption    String
44    ShowInTaskbar    Boolean
46    StartUpPosition    Byte

I was interested in the ShowInTaskbar property (Id 44) and to easily identify it I combined it with the StartupPosition (Id 46). So I had to search for Id 44 followed by False (0 in VB), followed by 46, followed by 02. So I searched for Hex Bytes 44 00 46 02 and found them at offset 0x143014:

image

I needed to change Id 44 to True which is -1 in Visual Basic, the Byte value for -1 is FF so I changed it to 44 FF 46 02:

image

I saved the file and ran it through the decompiler again to verify the results:

VERSION 5.00
Begin VB.Form frmServerLogin
  Caption = "Main Form"
  BackColor = &H80000005
  ForeColor = &H0
  ScaleMode = 1
  AutoRedraw = False
  FontTransparent = True
  FillColor = &HFFCECE
  BorderStyle = 5 'Sizable ToolWindow
  Icon = "frmServerLogin.frx":0
  LinkTopic = "Form1"
  MaxButton = 0   'False
  MinButton = 0   'False
  ClientLeft = 45
  ClientTop = 315
  ClientWidth = 7560
  ClientHeight = 5715
  BeginProperty Font
    Name = "Arial"
    Size = 9
    Charset = 0
    Weight = 400
    Underline = 0 'False
    Italic = 0 'False
    Strikethrough = 0 'False
  EndProperty
  Appearance = 0 'Flat
  ShowInTaskbar = -1   'True
  StartUpPosition = 2 'CenterScreen

Finally I tested the application and it worked fine now!

Was once an enthusiastic PepperByte employee but is now working elsewhere. His blogs are still valuable to us and we hope to you too.