============================================================== ATSPY (App.Title Spy) Written by Atif Aziz, June 1994 ============================================================== ABSTRACT -------- This Visual Basic application, App.Title Spy (ATSPY.EXE) peeks into a Visual Basic generated EXE and retrieves the its application title string. This is the same string contained by App.Title. IMPORTANT --------- There is no documented method or API for retrieving the App.Title given a Visual Basic generated executable, therefore the method demonstrated in ATSPY.EXE is purely based on research. In numerous cases tested, ATSPY.EXE has never failed, so it can be considered sure and safe. HOW DOES IT WORK? ----------------- When an EXE is generated by Visual Basic, it invariably saves the App.Title string (provided in Make EXE File dialog box) in a user-defined resource (RCDATA) that has an id of 1. The string is always null-terminated and can be found at offset 0x13 (&H13 or 19 in base 10) from the beginning of the resource data. The length of the string, which includes the null-terminator, is also recorded at offset 0x0f (&HF or 15 in base 10) into the resource data. Armed with these two key facts, ATSPY.EXE opens a given EXE file in binary mode and reads several information tables to locate the resource. Once located, ATSPY reads in the data and uses the length from offset 0x0f and extracts those many characters from offset 0x19. However, beware that this may change in future versions of Visual Basic. Moreover, ATSPY.EXE has only been tested with EXEs generated by Visual Basic 3.0 Professional Edition only. HOW TO CONTACT THE AUTHOR? -------------------------- Atif Aziz Internet: atif@infotec.ch CompuServe: 72644,3306