{"id":3934,"date":"2016-11-23T01:00:27","date_gmt":"2016-11-23T01:00:27","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=3934"},"modified":"2016-11-23T01:23:15","modified_gmt":"2016-11-23T01:23:15","slug":"the-archaeologologogology-1-vbd6-dll-and-vbe7-dll-midi-file","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2016\/11\/23\/the-archaeologologogology-1-vbd6-dll-and-vbe7-dll-midi-file\/","title":{"rendered":"The Archaeologologogology #1 – vbd6.dll and vbe7.dll MIDI file"},"content":{"rendered":"

With this post I start a new series that will talk about ancient code scrolls that are nothing, but a trivia related to some old software. Basically, a stuff of the past, re-visited without any other purpose, but the amusement…<\/p>\n

I will kick it off by inviting you to explore the content of vbe6.dll or vbe7.dll inside your Microsoft Office installation. Using Resource Hacker you can quickly discover that it has a mysterious resource 5432:<\/p>\n

\"vbe_midi\"<\/a>Using the very same Resource Hacker you can immediately play the music file that it recognizes. The md5 of the MIDI resource is 9b90e2e51483460501f711aa80508f7e.<\/p>\n

I am not the first one to discover it, there are a number of posts online<\/a> that discuss it, for example this German post says<\/a> that:<\/p>\n

In the PC Welt (German magazine PC World) 10\/02, it is reported on page 252 that there is a musical Easter egg in the Office 97 or 2000 file vbe6.dll.<\/p>\n

but I was curious what code I can find that is related to this resource – pretty sure that programmers didn’t leave it there as a result of an accident. After checking the usual suspects (vbe6.dll\/vbe7.dll) and not being able to find any quick reference to the resource ID 5432, I assumed that it could be some legacy stuff and no longer present in the code. I then started looking at the older versions of the vbeX.dll .<\/p>\n

That was a good idea and I soon discovered the sequence of code that actually loads and plays the MIDI file:<\/p>\n

\"vbe_code\"<\/a>The playMidi<\/em> function uses mciSendCommandA<\/em> API to play the extracted MIDI file.<\/p>\n

\"vbe_code2\"<\/a>The file created by the code is saved inside %TEMP%\\VB16B.tmp (GetTempFileNameA used to create a temp file path receives the ‘VB’ prefix).<\/p>\n

I also noticed that the code playing the MIDI creates a window (class ‘OfVbEg’, which I guess stands for Office Visual Basic Egg):<\/p>\n

\"vbe_code3\"<\/a><\/p>\n

So yeah… it has the Easter egg written all over it.<\/p>\n

I forced the routine to execute and surely enough, it launched the VB credits<\/a> – a known Easter Egg that can be watched after adding a menu item ‘Show VB Credits’ to Visual Basic IDE. You can follow the steps presented in the video in Office 97 VBA IDE as well and you will see the very same demo:<\/p>\n

\"vbe_easteregg1\"<\/a><\/p>\n

\"vbe_easteregg2\"<\/a>I guess it just confirms how close VBA and VBE really are…<\/p>\n","protected":false},"excerpt":{"rendered":"

With this post I start a new series that will talk about ancient code scrolls that are nothing, but a trivia related to some old software. Basically, a stuff of the past, re-visited without any other purpose, but the amusement… … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[53,44],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3934"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=3934"}],"version-history":[{"count":2,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3934\/revisions"}],"predecessor-version":[{"id":3943,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3934\/revisions\/3943"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=3934"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=3934"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=3934"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}