Modify VB Executable to force Taskbar Button

I had to troubleshoot an application that was published with Citrix XenApp. The problem with this application was that it didn’t have an button/icon in the taskbar and the window would sometimes disappear.

I noticed that this (cr)application was written in Visual Basic, so I decided to run it through a decompilation tool.

The decompiler was able to list the forms used in the Application:

I inspected the main form and it showed the following properties:

VERSION 5.00
Begin VB.Form frmServerLogin
  Caption = "Main Form"
  BackColor = &H80000005
  ForeColor = &H0
  ScaleMode = 1
  AutoRedraw = False
  FontTransparent = True
  FillColor = &HFFCECE
  BorderStyle = 5 'Sizable ToolWindow
  Icon = "frmServerLogin.frx":0
  LinkTopic = "Form1"
  MaxButton = 0   'False
  MinButton = 0   'False
  ClientLeft = 45
  ClientTop = 315
  ClientWidth = 7560
  ClientHeight = 5715
  BeginProperty Font
    Name = "Arial"
    Size = 9
    Charset = 0
    Weight = 400
    Underline = 0 'False
    Italic = 0 'False
    Strikethrough = 0 'False
  EndProperty
  Appearance = 0 'Flat
  ShowInTaskbar = 0   'False
  StartUpPosition = 2 'CenterScreen

Obviously I wanted to change ShowInTaskbar from False to True but the decompiler didn’t have an edit option.

I enabled the following option (Tools | Options):

This made the Decompiler show the Hex Offset of the form in the exe file:

VERSION 5.00
Begin VB.Form frmServerLogin 'Offset: 00142B5E

I opened the exe file in an Hex Editor and jumped to the form Offset. A Visual Basic form is a binary, undocumented format but in the Hex Viewer we can see how it’s structured. Taking the Form Caption (Title) as example we can see that it has Id 1, has a length of 0C (12) Bytes and the String is “Main Form”:

Luckily the author of the VB Decompiler has already done the hard work and has created a table of all the Id’s here.

This is a small part of the table, listing the properties I needed:

  Form
01    Caption    String
44    ShowInTaskbar    Boolean
46    StartUpPosition    Byte

I was interested in the ShowInTaskbar property (Id 44) and to easily identify it I combined it with the StartupPosition (Id 46). So I had to search for Id 44 followed by False (0 in VB), followed by 46, followed by 02. So I searched for Hex Bytes 44 00 46 02 and found them at offset 0x143014:

I needed to change Id 44 to True which is -1 in Visual Basic, the Byte value for -1 is FF so I changed it to 44 FF 46 02:

I saved the file and ran it through the decompiler again to verify the results:

VERSION 5.00
Begin VB.Form frmServerLogin
  Caption = "Main Form"
  BackColor = &H80000005
  ForeColor = &H0
  ScaleMode = 1
  AutoRedraw = False
  FontTransparent = True
  FillColor = &HFFCECE
  BorderStyle = 5 'Sizable ToolWindow
  Icon = "frmServerLogin.frx":0
  LinkTopic = "Form1"
  MaxButton = 0   'False
  MinButton = 0   'False
  ClientLeft = 45
  ClientTop = 315
  ClientWidth = 7560
  ClientHeight = 5715
  BeginProperty Font
    Name = "Arial"
    Size = 9
    Charset = 0
    Weight = 400
    Underline = 0 'False
    Italic = 0 'False
    Strikethrough = 0 'False
  EndProperty
  Appearance = 0 'Flat
  ShowInTaskbar = -1   'True
  StartUpPosition = 2 'CenterScreen

Finally I tested the application and it worked fine now!