[vb6] Project Scanner

Quote:

---

Originally Posted by Thierry69

And also A LOT of optional parameters unused. it could be a parameter to not check this

---

Don't know. If you have parameters but not using them, then why include them in the function/sub? One of the things I wanted to do with this project was to try to point out things where code can be made more efficient. If you can remove those parameters because they are not used, then VB doesn't have do extra work passing and/or returning them.

Quote:

---

Originally Posted by Thierry69

A great enhancement could be to jump directly into VB6 at the right place where the code is. For the moment, manual research, so takes time Maybe add in the menu over a procedure/function etc... Copy the name to the clipboard, so can be paste in the Debug area to go to the definition

---

The treeview can be clicked on (like Explorer) to send it into "edit" mode. You can copy whatever you need from there. Don't worry about accidentally changing the treeview node by mistake. The project won't allow you to do that.

Quote:

---

Originally Posted by Thierry69

A variable was declared like :
Dim sFile
And used as iterator for a collection, and throw it as an error.
I added "As Variant", but maybe, should not be thrown as a warning

---

I believe it should throw the warning. As mentioned in the "help", this warning is for you to look at your declaration and double check to make sure you intended it to be Variant. If you intended it to be, but didn't include the "As Variant" in the declaration, then the warning is considered a false positive. However, I have done it and others do also where you simply forget the "As ... whatever" by mistake. That warning is to help identify those.

Quote:

---

Originally Posted by Thierry69

Otherwise, it helped me to optimize/clean a bit.

---

I'm glad. That is the intent

Quote:

---

Originally Posted by LaVolpe

Don't know. If you have parameters but not using them, then why include them in the function/sub? One of the things I wanted to do with this project was to try to point out things where code can be made more efficient. If you can remove those parameters because they are not used, then VB doesn't have do extra work passing and/or returning them.

---

I know, but I use sometimes optional parameters (maybe not used), but to have same kind of definitions for procedures

Quote:

---

Originally Posted by LaVolpe

The treeview can be clicked on (like Explorer) to send it into "edit" mode. You can copy whatever you need from there. Don't worry about accidentally changing the treeview node by mistake. The project won't allow you to do that.

---

Maybe, I had VB6 openened and directly modifying it it, then after a few modification, compilation to be sure, all is ok

Quote:

---

Originally Posted by LaVolpe

I believe it should throw the warning. As mentioned in the "help", this warning is for you to look at your declaration and double check to make sure you intended it to be Variant. If you intended it to be, but didn't include the "As Variant" in the declaration, then the warning is considered a false positive. However, I have done it and others do also where you simply forget the "As ... whatever" by mistake. That warning is to help identify those.

---

This how I took it, and also fixed the 2 variables that were in the case

Quote:

---

Originally Posted by LaVolpe

I'm glad. That is the intent

---

Yep.

now, running a new turn with the 2 options unchecked by default
Hopefully, i have several computers :)

Quote:

---

Originally Posted by Elroy

a Function, Sub, or Property declared with no Private, Public, or Friend specification

---

I see LaVolpe wasn't too keen on this one, but there is a situation where it would be nice to have. When creating Multiuse /Global-Multiuse classes in ActiveX DLL projects, it's possible to accidentally create a Public procedure by omitting an explicit "Friend/Private" declaration. You can then get stuck with it for binary compatibility purposes if you happen to compile the project before noticing the omission. It might be nice to have this detection as an optional feature for this purpose (or maybe just active in public classes of ActiveX DLL/EXE projects?)

Quote:

---

Originally Posted by jpbro

I see LaVolpe wasn't too keen on this one... It might be nice to have this detection as an optional feature for this purpose (or maybe just active in public classes of ActiveX DLL/EXE projects?)

---

Ok, now looking seriously at it. When I was looking at it from the context of "personal style", I wasn't persuaded. But when looking at it from the context of a potential problem with binary compatibility, am now being persuaded.

Quote:

---

Originally Posted by jpbro

I see LaVolpe wasn't too keen on this one, but there is a situation where it would be nice to have. When creating Multiuse /Global-Multiuse classes in ActiveX DLL projects, it's possible to accidentally create a Public procedure by omitting an explicit "Friend/Private" declaration. You can then get stuck with it for binary compatibility purposes if you happen to compile the project before noticing the omission. It might be nice to have this detection as an optional feature for this purpose (or maybe just active in public classes of ActiveX DLL/EXE projects?)

---

Great idea.

Quote:

---

Originally Posted by LaVolpe

Ok, now looking seriously at it. When I was looking at it from the context of "personal style", I wasn't persuaded. But when looking at it from the context of a potential problem with binary compatibility, am now being persuaded.

---

Not that I've ever screwed up like that before....<ahem>...Nope not me. ;)

Quote:

---

Originally Posted by jpbro

Not that I've ever screwed up like that before....<ahem>...Nope not me. ;)

---

I my case I always delare the procedures explicitely as Public, Private or Friend, but I had that problem in the past with some functions that I copy/pasted from other authors.

I always try to explicitly declare Public/Private/Friend too, but I have made mistakes on occasion. Same as forgetting to declare the return type of a function, which can also have annoying binary compatibility problems if you later realize you're meant to return something other than Variant.

Running LaVolpe's scanner before compiling would help prevent this of course, which would be great.

Yep, I'll add that check but probably initialize it as unselected. Since I'm doing that, I'll probably add a sub-option to it which will report any constants, types, enums, and APIs that are not explicitly scoped -- also initially unselected. Not sure that would have any compatibility problems, but it could if Enums were public by mistake and changes were needed to them.

I also saw something in Krool's sample project that I didn't expect and will likely include a check for that in the zombie checks. He declared a variable WithEvents but did not have any events coded. Not sure if VB will create an event handler for that variable in that case, when compiled. But no harm in identifying those too.

Hello LaVolpe,

I tried to use the scanner to detect some unused procedures but I found that it didn't detect them. They are Public properties in Class modules, but the classes instancing are Private so they are not exposed to the outside of the project.

Since the project is an ActiveX, I tried changing it to standard exe and run the scanner again, but I got the same result.

Eduardo...

All public properties (actually all public methods), not in a bas-module, are excluded from zombie checks. I know this may sound like a cop-out, but I justified that decision on: public properties were defined by the coder because they may be called from inside/outside the project, whether they are actually called or not ... Think of someone planning for future enhancements or sharing a class from some other project where the property is called.

Even if I tried to include them, I couldn't catch many of them. The project does not track how a variable is used in code. Looking at the following statements, the scanner has no knowledge that oObject is a class reference.

Code:

---

Dim oObject As Object
...
  Set oObject = myClass
  oObject.Property = someValue

---

Now it could be possible to track something like the following via cross-referencing...

Code:

---

Dim oObject As myClass  ' or Dim oObject As New MyClass
...
    oObject.Property = someValue

---

When assignment happens at the declaration statement, I think that might be something I can incorporate. In that first example, just can't do it without getting creative. In simple cases like above where keyword "Set" is used and variable is followed with equal sign and immediately following that is the class name with/without "New" keyword, then that could be handled without much difficulty.

I have no intention to try to follow code to determine how variables are used. Here's an example of what I mean...

Code:

---

Dim oObject As Object
...
  Set oObject = someOtherClass.GetItem()  ' which returns a class the scanner has no knowledge of
  oObject.Property = someValue

' ... or something like this
    Set oObject = myCollection.Item(x) ' no way of knowing what this is

' ... or something like this
  SomeSub oObject, X, Y  ' where oObject is returned as some instantiated class

---

Public properties defined in bas modules are doable, and am doing that now, because we cannot assign a module to a variable.

Yes, I understand LaVolpe.
You would have to follow the object's variables through the code. And let's also consider that the objects can have default members.

Thank you.

Quote:

---

Originally Posted by Eduardo-

Yes, I understand LaVolpe.
You would have to follow the object's variables through the code. And let's also consider that the objects can have default members.

Thank you.

---

I won't be following code -- not interested in building a mini-compiler ;)
But ugh -- default members; that'll mean parsing Attribute statements to determine which is a default, if any

Quote:

---

Originally Posted by LaVolpe

I won't be following code -- not interested in building a mini-compiler ;)

---

Nooo. . . I had secret hopes here :-))

Was about to suggest to migrate parser to PEG grammar as to be able to generate the parser with VbPeg.

Edit: ziglang recently switched to PEG grammar to document their syntax. Here is their parser.peg grammar in VbPeg test-runner that passes compilation and tests successfully.

cheers,
</wqw>

Quote:

---

Originally Posted by wqweto

Here is their parser.peg grammar in VbPeg test-runner that passes compilation and tests successfully.</wqw>

---

Interesting.

My scanner is 99.9% complete now. I completely rewrote the logic over the past couple weeks. The logic does require the project to have correct syntax in order to return valid results. I really don't want to have it validate syntax -- should be no reason. VB does that with a simple Ctrl+F5. The logic I used really speeds up the validations because when files are parsed to find whole statements, it also tracks "words" within the statement and keeps a small list of where each word exists in the statement & its length, along with some attributes for the word, i.e., operator, punctuation, parenthesis parameters, etc. When statement is passed to various validation routines, statement doesn't need to be re-parsed, it just jumps right to the statement words & uses the attributes to determine what to do with it relative to the specific validation routine. This extra tracking stuff is not persisted, JIT and dumped.

The only thing I have left to do is come up with a better way of determining when to join words beginning with a dot when the dot is separated by a line break/continuation. VB allows breaks just about everywhere in a statement and there are so many variations, but haven't found a hard & fast ruleset to help me out. For example, an extreme case

Code:

---

    With myUDT
        ListView1 _
            . _
            ListItems( _      << belongs to ListView
            . _
            Index Xor _        << belongs to myUDT
            . _
            Offset) _          << belongs to myUDT
            . _ 
            Text _              << belongs to ListItems
            = myCollection _
            . _
            Item( _            << belongs to myCollection
            . _
            Key)                << belongs to myUDT
    End With

  ' and consistency isn't always there inside of VB, for example
  With Me
        Interaction.AppActivate .Tag    << no issues with VB
        Interaction.AppActivate . _
                                Tag        << no issues with VB
        Interaction.AppActivate _
                                .Tag      << ERROR won't compile (Ctrl+F5)
        Interaction.AppActivate _
                                . _
                                Tag        << ERROR won't compile (Ctrl+F5)
  End With

---

My logic requires objects to be "joined", whether a control, class, UDT, etc. So the above statement objects would be parsed as: myUDT.Index, myUDT.Offset, myUDT.Key, myCollection.Item, & ListView1.ListItems.Text.

Based on those compile errors in above example, it's fairly easy to guess how VB joins objects. Overly simplified... Because VB requires a space before the underscore continuation character, it needs to determine whether to preserve that space during compilation. So, in these cases where a dot follows the continuation, VB assumes it belongs to the previous word (if not an operator, number, literal, a reserved keyword or other special cases). Well, Interaction.AppActivate is a sub, not a class (or method that returns a class) and therefore an error.

In my head, this logic works, and I'll see if it pans out. Of course, those lines in sample code above that cause compile errors will fail to parse correctly using this logic. They would look like: Interaction.AppActivate.Tag. But I have stressed that code should be syntax error-free before scanning.

Code:

---

when not following continuation
Dot Scenario                Dot Belongs To:
1st word of statement      active "With" statement
previous char is ) ]        word before opening ( [
all other scenarios        active "With" statement

when following a continuation; previous word is the one before the continuation
the space-underscore of the continuation line are never looked at in these scenarios
Dot Scenario                Dot Belongs To:
1st word of statement      active "With" statement
    can only occur if previous word is open parenthesis
previous char is ) ]        word before opening ( [
previous word is:          active "With" statement
    comma, semicolon, number,
    Date , literal, keyword, operator, unary
all other scenarios        previous word

Note: the term "word" is flexible. Typically a word is surrounded by white space
or terminates on a VB-word break: comma, closed parenthesis, colon, etc
So words can include multiple words (Debug.Print) or single characters (+ , -).
Parentheses & square brackets are treated as words because they have special
meaning in my parser. Open parenthesis begins recursion, treating contained code
as a new "statement" up until its closing parenthesis.

---

Anyway, I thought that was the last part to rewrite until Eduardo brought up public class methods. Thanx Eduardo ;)

Edited: I'll probably post the updated version without Eduardo's enhancement idea and work on that for the next version

LaVolpe,

I'm not sure I understand. I've got my own project scanners (not ready for prime-time nor publishing), but one of the first things I do when processing a module is to combine all continued lines (" _") and split all mult-statement lines (": "). In addition to being syntactically correct, I assume it was saved by the VB6 IDE. That gives me additional assurance that I know certain things (like no space after the colon on a line label).

It would seem that, if you did that, the problem of what the preceding dots go with is solved.

Just my two-cents.

Best Regards,
Elroy

EDIT: I also tend to strip out all the comments too, before trying to process it.

Elroy, you can't just combine lines willy nilly. Sometimes the space before the continuation character needs to be preserved, sometimes it must not be in order to maintain syntax.

For example, look at some of these. If you were to simply "join" all the dots to the previous characters, it would be wrong in some cases.

Code:

---

  sText = myClass. _    << space not maintained
    Caption

  Debug.Print ListView1 _  << space not maintained
    .ListItems _    << space not maintained
    (1) _    << space not maintained
    .Text & _  << space maintained
    " blah"

  With myClass   
    Debug.Print 123 Xor _  << space maintained
      .Value
    CallMySub .Value, _    << space maintained
        .Index
  End With

---

And I can list a bunch of other examples such as the space between an API Alias and parameter's open parenthesis is maintained, but the space between a class Public Event statement's name and its parameter's open parenthesis is not maintained -- though not dot-related

Edited: Now it truly isn't necessary to get a lot of this stuff perfect, because VB can still remove/add spaces you may have mistakenly failed to do while manually joining lines. But the dots following continuations are an exception -- gotta be right otherwise you are joining properties/method to stuff that doesn't apply. And P.S. I don't actually join anything, except "objects" or if something needs to be displayed. Taking the time to join in other scenarios is wasted CPU cycles and time for my scanner -- that was 1st version and a mistake. My scanner does not update/edit VB files.

Tip: Trying to split text on ": " will fail in cases like the following

Code:

---

Private Enum CrazyEnum
  [__/ : \__]
  [>>[ : ]<<]
End Enum
 X = 1:: Y = 2
' and of course in literals
s = "List follows: 1, 2, 3, 4"

---

I assume you are joining on underscore carriage return combinations, but these are valid statements:

Code:

---

X = _
 _
 _
 1

X = 1 _

---

Interesting ... I definitely see your point. I guess I'm just not in the habit of using continuations in that way. Truth be told, I'd never dream of using line continuations in many of the ways you did in your above example. However, I "get" that it's valid syntax, and that you're therefore trying to cover those cases.

Therefore, for a totally robust project scanner, scratch my post #197, or make your concatenation algorithm VERY smart. :)

Quote:

---

Originally Posted by Elroy

Interesting ... I definitely see your point. I guess I'm just not in the habit of using continuations in that way. Truth be told, I'd never dream of using line continuations in many of the ways you did in your above example. However, I "get" that it's valid syntax, and that you're therefore trying to cover those cases.

---

Before I started this, I downloaded code from various sites just to get a feel for coding styles I've never really seen before. That helped. Then that evolved into questions like, "are we allowed to do [fill in the blank]?" which made me sit up and notice.

Hi LaVolpe,

The original version of Project Scanner cannot handle Chinese characters, and now the new version can. I'd like to know what steps you've taken to deal with Chinese characters? Thanks!

Quote:

---

Originally Posted by dreammanor

Hi LaVolpe,

The original version of Project Scanner cannot handle Chinese characters, and now the new version can. I'd like to know what steps you've taken to deal with Chinese characters? Thanks!

---

You can use WinMerge to see what changed between two VB projects.

Quote:

---

Originally Posted by qvb6

You can use WinMerge to see what changed between two VB projects.

---

Hi qvb6, the tool you recommend is extremely useful, thank you very much.

Quote:

---

Originally Posted by LaVolpe

- Zombie declarations and procedures. Items that are created/declared but not referenced within your code
- Strings that are duplicated within your code. These can be consolidated to constants

---

I haven't downloaded your Project Scanner yet, but from memory; I know that VB6 compiler omits procedures that are not called from anywhere(unless they are Public in a Class, I think). This is called function-level linking in the C world. Also, VB consolidates duplicate string literals into one, so it appears once in the EXE space, but in some cases using constants is better.

Hello LaVolpe, I found a bug in the pvScanProcedures procedure of clsPrjFile. It raises an error in the line:

Code:

---

sToken = Mid$(sLine, iPos + 1, lFlags - iPos - 1)

---

because lFlags is 0.

I traced the error and it is misinterpreting a line that is:

Code:

---

Static sVariableName as Boolean

---

It is interpreting it as it was a Static procedure.

It is a bit strange because I have several other Static variables in the project but they didn't rise the error.

I momentarily fixed it by adding these lines:

Code:

---

    Do
        iPos = 0: sToken = modMain.GetToken(sLine, iPos, chrSpace)
        If lScope = 0 Then
            If sToken = ITEM_STATIC Then
                sToken = modMain.GetToken(sLine, iPos, chrSpace)
            End If
            Select Case sToken
            Case ITEM_PUBLIC, ITEM_PRIVATE, ITEM_FRIEND
                If sToken = ITEM_PRIVATE Then

---

Because even when a procedure is Static, it also must have Sub, Function, Etc.

Update. I found the cause. I was experiencing other anomalies and the cause are some commented lines that end with _ (underscores).

It seems that the scanner intrerprets all lines finished with underscores as continuation to the next line. But that rule doesn't actually apply to comment lines, it is only for code lines.

Also another detail: The procedure named 'Main' in a bas module shouln't be listed as zombie because "it is not used".

Quote:

---

Originally Posted by Eduardo-

Update. I found the cause. I was experiencing other anomalies and the cause are some commented lines that end with _ (underscores).

It seems that the scanner intrerprets all lines finished with underscores as continuation to the next line. But that rule doesn't actually apply to comment lines, it is only for code lines.

Also another detail: The procedure named 'Main' in a bas module shouln't be listed as zombie because "it is not used".

---

Good catches. I do want to return to this project and finish it up. I'll keep these in mind when I come back to this project. If not, I'll ensure that is addressed too.

Sub Main(): I'm not looking at my code, but I thought I only mark it zombie if it isn't the startup routine and no other code calls it.

Underscores on comments: Yep, didn't expect those. Will need to tweak the line parser for that scenario.

Quote:

---

Originally Posted by LaVolpe

Sub Main(): I'm not looking at my code, but I thought I only mark it zombie if it isn't the startup routine and no other code calls it.

---

Yes... I had forgot to select the Sub Main in the project properties (it is a component).
Now that I fixed that, it disappeared from the zombie report.
The scanner is working fine in that regard, then.

Quote:

---

Originally Posted by LaVolpe

Underscores on comments: Yep, didn't expect those. Will need to tweak the line parser for that scenario.

---

Yes, it is then the only thing I'm reporting.

For my case, I already changed those comment lines to avoid underscores at the end.

Thank you.

Line continuations (underscores) *do* work for comment lines like this.

thinBasic Code:

Option Explicit
 
Private Sub Form_Load()
    Rem First line _
        Second line
        
    '-- First line _
        Second line
End Sub

. . . both first and second lines are part of the comment or am I not understanding the problem?

cheers,
</wqw>

@wqweto, that is how I believe I coded the scanner now that I am thinking about it more. I know I've used comments like that in the past -- looks more pleasing to my eyes with just one tick/REM statement

@Eduardo, is this the scenario that was triggering false positives..

Code:

---

Static sVariableName as Boolean ' some comments _

---

If not, could you provide a simple example so I can look at the code in more detail down the road?

It may have interpreted it as a method, but shouldn't have. I'm pretty sure the code requires Sub, Function, Property to flag methods. My guess is that the flags were simply wrong due to failed parsing and 'method' is just a byproduct of bitwise comparison of the faulty flag value.

LaVolpe, in the case of the Static variable, the scan process was silently aborted because of a runtime error. The scanner didn't work at all until I traced the issue to that procedure and made that change.

But after that, I found others issues, this time as false positives like variables not used when they were in fact used. I had several cases like that.

About the issue of line continuations in comment lines, I see what wqweto points (thanks). Then, perhaps it is not that comments lines are handled differently by VB regarding to line continuations, but that line continuations require one space before the last underscore?

Here is a sample of what caused the problem:

Code:

---

' declarations...
' declarations...

'_SOME_COMMENT_
' declarations...
Private mVariable As Long ' mVariable Reported as not used
' declarations...
'_

' code...
' code...

'_SOME_COMMENT_
Private Sub NameOfSub()
    Static sVariable As Boolean ' Static variable that caused the run time error
   
    If Not sVariable Then
        sVariable = True
        ' code...

        ' code...
    End If
End Sub
'_

' code...
' code...

'_SOME_COMMENT_
Private Function F1() As Boolean
    Dim i As Long
 
    ' code...

    i = mVariable ' mVariable is used

    ' code...
End Function
'_

---

Or simpler, causing only the first problem:

Code:

---

' code...
' code...

'_SOME_COMMENT_
Private Sub NameOfSub()
    Static sVariable As Boolean ' Static variable that caused the run time error
   
    If Not sVariable Then
        sVariable = True
        ' code...

        ' code...
    End If
End Sub
'_

---

The problem is likely the trailing underscore. I know I coded to ensure a 'space underscore' is a continuation, but may not have done that for comments. I doubt it is the leading underscore. In any case, I'll need to check the code in more detail.

Thanx Eduardo for the bug report

Quote:

---

Originally Posted by Eduardo-

Code:

---

' code...
' code...

'_SOME_COMMENT_
Private Sub NameOfSub()
    Static sVariable As Boolean ' Static variable that caused the run time error
   
    If Not sVariable Then
        sVariable = True
        ' code...

        ' code...
    End If
End Sub
'_

---

---

After I changed the comments to:

Code:

---

' code...
' code...

'_SOME_COMMENT_1
Private Sub NameOfSub()
    Static sVariable As Boolean ' Static variable that caused the run time error
   
    If Not sVariable Then
        sVariable = True
        ' code...

        ' code...
    End If
End Sub
'_2

---

all the problems went away.

So the problem is that in comments trailing underscore has to be space prefixed to be treated as line continuation by the parser.

Here is another sample where no comment/code continuation should happen

thinBasic Code:

Option Explicit
 
Private Line_ As Long
 
Private Sub Second(A As Long)
 
End Sub
 
Private Sub Form_Load()
    '-- First Line_
        Second Line_
End Sub

Not that final underscore can be part of variable name in normal code lines so space-underscore combo is actually required to be non-ambiguous.

cheers,
</wqw>

I thought of another check that would be useful under the "zombie" category - labels without a corresponding Goto or On Error Goto. It would catch some non-functioning error handlers.

Updated project posted.

Excellent project LaVolpe!

I made a couple very small modifications to this so it can accept a project file through command line arguments and open it directly. That way I can have the compiled .EXE in my MZ-Tools app shortcuts toolbar and launch it for the currently opened project with just one click. It's such a trivial modification it hardly seems worth it to post the code but there's an idea that you might wanna consider implementing yourself that probably takes no more than a few minutes! :)

Quote:

---

Originally Posted by LinkFX

...you might wanna consider implementing yourself that probably takes no more than a few minutes! :)

---

Not a bad idea. Might even want to add command line switches to run silent & auto-save validation reports? Food for thought if I update again. And I probably will update again since this was a complete rewrite, logic-wise, which means I might have a logic error or two not yet found

I tested your Project Scanner today and i don't understand why this Item is in zombie state:

Code:

---

Items in zombie state
  Method: txtCommentEdit_Validate

---

It's the Validate event of a text box control (VBCCR16's TextBoxW).
The CausesValidation property of the text box is set to True.

I want to add that with Krool controls, GotFocus and LostFocus procedures are also reported as zombie.

I'll look into it this weekend. I may have forgotten to ensure the extender events were included with usercontrols or a logic flaw exists. Once that is resolved, extender events won't show up as zombies

edited: yep, logic flaw. Testing for extender events was mistakenly not applied to uncompiled usercontrols - doh. I'll post an update this weekend after a bit more testing and when I have more time.

Done. Project updated and re-uploaded.

Thanks LaVolpe. Now those zombies does not appear any more.

BTW, another issue that I noticed is that public variables of class modules (that are actually properties in practice) appear as zombies if they are not used in the class module.

Quote:

---

Originally Posted by Eduardo-

BTW, another issue that I noticed is that public variables of class modules (that are actually properties in practice) appear as zombies if they are not used in the class module.

---

I'll take a look. It's something that I may have forgotten to address during the rewrite. I know I addressed it in the previous version. Bug reports always welcomed.

Edited: patched & updated

LaVolpe,

Is there any documentation for what things went into the list of things to be flagged and what didn't? Some are self-evident like zombies but some I am guessing at (such as the use of CreateObject or CreateProcess) and I would like to know if my ideas match yours. Thanks.

@MountainMan. Yes, press F1. Then Ctrl+F and search for "Safety Warnings". Its near the bottom of the page

Thanks. I didn't know you had a Help system in the program.

You're welcome. In the clsValidation, you see a method not-best-named: pvListMaliciousDLLs
That would be the complete list if there's any difference in the help page -- not 100% that page is 100% accurate any longer with recent tweaking and updates.

That listing in code is just DLLs. The VB functions on the hit list are in the resource file. Open the string table and item #2 is what you are after. You can scroll in the res editor window, but easier to select all & copy/paste elsewhere.

Edited: Don't mess with the string table, unless you keep the sorting correct. Throughout that project, I use binary searches on strings and CRC values. Very fast, but requires lists to be sorted. Having an unsorted list will break the binary search to the point is almost unusable. Elsewhere, if a list isn't coming from the string table, the sorting is done real-time, as needed.

You might want to modifyyour menu for dummies like me such that you have a Help menu item with the View Validation Descriptions as part of that. What you wrote is very helpful though.

One area I go tripped up on was the malicious code thing. I was thinking "hwy of course my ShellW module has a CreateProces call in it. I wrote it and I know it is okay and not malicious." I wasn't thinking that this would be a useful tool for folks who bring in code from elsewhere without going through it. I don't do that; anything I use I take it apart partly to make sure I understand what is going on and partly to avoid the potentially malicious things that might be in the code. I haven't seen any of that on this forum so I wasn't thinking of having to do that. But I can see where it might be useful to some. Thanks, you have widened my perspective today... :-)

Quote:

---

Originally Posted by MountainMan

One area I go tripped up on was the malicious code thing. I was thinking "hwy of course my ShellW module has a CreateProces call in it. I wrote it and I know it is okay and not malicious." I wasn't thinking that this would be a useful tool for folks who bring in code from elsewhere without going through it. I don't do that; anything I use I take it apart partly to make sure I understand what is going on and partly to avoid the potentially malicious things that might be in the code. I haven't seen any of that on this forum so I wasn't thinking of having to do that. But I can see where it might be useful to some. Thanks, you have widened my perspective today... :-)

---

That was the intent. I actually started that for me and expanded it over time. One of my pet peeves is forgetting to check for SaveSettings and DLLs that tend to write stuff to the registry. If I'm only helping debug it, I don't want registry stuff written. If I'm only downloading out of curiosity, I don't want registry stuff written. Guess you can tell, that get's under my skin :eek:

Minor modifications made.

When conditional compilation directives are used, i.e., #If #Else, it was possible that the scanner could include statements it should not. Fixed.

Added ability to drag/drop a file onto the compiled exe file. The scanner will open and immediately start processing the dropped vbp/vbg file.

Excellent project.

One feature comes to mind, which could be handy. I constantly find it hard for programmers to avoid mishandling dynamically dimensioned arrays especially udt arrays. Typical error, is passing module level array element as an argument to a procedure or function.
https://docs.microsoft.com/en-us/off...ocked-error-10

Well, I am not looking at trying to follow code execution. In your example, one would need to identify fixed arrays (easy enough), but then would need to see if it is passed to a method, then look into that method to see how it is used, i.e., using ReDim on it. That is outside the scope of the scanner.

That is also a reason why the scanner does not attempt to validate that a Public method in a class, usercontrol, etc is in zombie state. It would require the scanner to track usage of objects/variants and more just to see if one of them were declared as the class, form, etc and determine what methods it may be calling. For example, we can assign a class instance to a variable declared as: Object, item in Object(), Variant, item in Variant(), or a Collection item. And from any of those, we can call any public method directly from the object. To make it even more daunting, is that is possible that the reference is passed yet to another routine where, within that other routine, the public method is eventually called from that item.

Quote:

---

Originally Posted by LaVolpe

That is also a reason why the scanner does not attempt to validate that a Public method in a class, usercontrol, etc is in zombie state. It would require the scanner to track usage of objects/variants and more just to see if one of them were declared as the class, form, etc and determine what methods it may be calling. For example, we can assign a class instance to a variable declared as: Object, item in Object(), Variant, item in Variant(), or a Collection item. And from any of those, we can call any public method directly from the object. To make it even more daunting, is that is possible that the reference is passed yet to another routine where, within that other routine, the public method is eventually called from that item.

---

Yes, this is impossible to track. What *is* possible is to detect method names used late-bound in a global list. Then if a public method is not directly used early-bound (which is easier to detect) its *name* can be searched in the global late-bound calls list and if not found there too it's probably dead code (unless it's a public method of a public class of an ActiveX DLL/OCX and can be used by external projects).

cheers,
</wqw>

Quote:

---

Originally Posted by wqweto

Yes, this is impossible to track. What *is* possible is to ...

---

This comment is really intended for others. If I cannot determine zombie state in all scenarios with good confidence, then one can argue it is pointless to try. The results could be 99% correct in 'easy' cases and be less than 50% correct in many other cases. The scanner already has the potential of creating zombie false-positives, but those should be few. I don't want to introduce a scenario where the false positives can be commonplace.

An example of a zombie false-positive. For sake of this argument, a method is not an event. If the scanner checks private methods and a private method is never called, then how can the zombie state be a false-positive? Answer: thunks. Many thunks are created to call private methods of a class, form, etc. No other code in that code page will be calling the method. The thunk calls the method by its pointer, not its name and thunks are 'outside' code, not available until run-time. That private method will be flagged as a zombie even though it is not, but the scanner has no way of knowing that.

As to the larger question. Is it possible to create a 'call tree' for the entire scanned project? Yes. I'll leave that as an exercise for others when they get bored and want to spend a few months on a 'big' project.

DO YOU HAVE CODE FOR SPLIT A function?
can split every part:(public ,private),return type,optional default value

Code:

---

private function sum(byval a as long ,optional byval b as long=12 ) as long 'sum(3,4)=5
 sum=a+b
end function

---

Splitting a function? In the scanner project, that is done because it needs to be done to find the properties of the function:
- start/end of method
- scope
- method type
- return vartype
- parameter count, parameters, parameter vartypes
- executable lines within the method

However, there is no single function in the project that does all of that. The scanner processes code files in two passes. Only if user chooses to validate the project, then a second pass is done to parse out parameters and the executable lines within the method.

If you are asking me to write a routine for you, I will not. It is not that difficult to do, but you have other scenarios you may need to handle. For example, if a method is broken into 2 or more lines using continuation characters. And there are other things that can exist in a method: ParamArray for example, arrays in the parameters and return value. ByRef,ByVal and vartypes are optional also. And scope can be Public, Private, Friend (none are required), and can also include keyword: Static.

If you have any further questions on how to parse something, post it in the general VB forums section. I won't be addressing "how-to" hints and workarounds on this thread regarding that topic. Happy parsing!

I was looking for something like this, so I did a try, I think I found a bug,
I get the report:

Quote:

---

Results for config
Items in zombie state
Variable: fa in method login_setting_render
Variable: kk in method login_setting_render
Variable: ff in method login_setting_render

---

Code:

---

Sub login_setting_render()
    Dim ff&, kk&, fa&, ka&

    Mouse = 0
    engine.Render 7, 70, 188, 0, 0, 660, 185
    engine.Render 7, 70, 373, 0, 480, 660, 25
    engine.Render 7, 80, 211, 10, 1241, 640, 176
    WriteText 17, BS.MHelper(23), 380, 196
    renderOptions 232
End Sub

---

ka is missing.

and the same in another:
Variable: i in method BoxRender

but I have Dim i&, yy& and I cant find neither in the function.

and the same here:
Variable: weak in method ShowMonster
Variable: strong in method ShowMonster
Variable: c in method ShowMonster

Dim a&, b&, c&, strong$, weak$, immune$

and immune should also be reported.
and a couple more places with similar results.

suggestions:
- check if a function is called from "module1" that is resident in "module2" and make sure its not "private"
(I know your program is not checking, since I can put a "Private" function on another module that is needed from another module, and it will not tell) that function need to be changed to Public to work.
sure if I try to compile it will give me an error, but its good to have.
also, do you check like this:

module1: theres a call to "MyFUNC" that is in module1, but theres another MyFUNC in module2. so doublets. one is Private and one if Public.
from module3 I call MyFUNC believing it will take the "Private" one, but it will instead take the "Public" one. so good to report if theres such scenario.

I'll have to double check and make sure when 2+ variables are declared on same line, the splitting routines are not off-by-one in some cases, ignoring the final variable.

For those routines where you see a 'bug', can you zip up the routines? Also include your module/class-level declarations. Don't worry about including other stuff called from those modules -- it does not need to be able to be compiled. I just want to dump those routines to a module or class in a test project and scan those.

I like your idea of looking for duplicate methods in bas-modules only, where one is public & the others are not. As for the other scenario. I thought I was checking for private methods in a bas-module that were not used -- maybe it's something new I was adding? Need to revisit that. However, the project won't check if a method should be public instead of private. One of the key 'rules' for using this tool is that the project must be able to be compiled, otherwise, false results can be reported.

I've been tweaking that project off & on over the past few months and might be time to post an update but I'd like to verify any changes work with what you are reporting.

Quote:

---

Variable: i in method BoxRender

but I have Dim i&, yy& and I cant find neither in the function.

---

baka, the yy& may be a bug mentioned in previous reply where last variable in line might be ignored -- will fix that if that is the case.

But the i&, do you have i declared in the declarations section of that code page or publicly in a bas module? If so, then I have a bug where the i variable was found out of scope of the method & determined not a zombie when it should've been. This question is just to help me narrow down where to look.

Nb : La Volpe, have you seen my message?

I managed to remove a lot and just show a bit and the functions that resulted in the missing variables.

yes its about the last variable.