This update represents a significant leap forward in code analysis and source code recovery. While the AI Helper was introduced in version 12.6 with the aim to improve decompiled C# code, VB Decompiler 12.7 significantly expands its functionality, making the tool more universal, flexible, and accessible for a wide range of users.
There is an opinion among researchers that Visual Basic is a very вшаашсгде programming language to analyze and analyzing and debugging programs on it causes a lot of issues. If the program is compiled in P-Code - they can be partially understood, but as for assembler Native Code, most things is analyzed in the same way as any x86 program code, written for example in C++ or Delphi. But there are a number of tricks. This is what I will share with you in this article.
Recently, there has been an increasing number of articles and materials on the topic of code recovery using artificial intelligence (AI) technologies. This has led to many questions from users about how effective this method is, how applicable it can be for any reverse engineering tasks or source code recovery from compiled exe files of programs, as well as dll and ocx libraries. In this article, I will try to provide a comprehensive answer to these questions.
I am pleased to introduce significant update to our decompiler. Searching for Functions by name, searching for references to functions for C# .NET and Visual Basic .NET, renaming variables and so on. Additionally, we have completely revised VB Decompiler documentation in several languages. This was a massive undertaking, and I believe it will be noticeable even at first glance.
Each new version of the decompiler traditionally brings a lot of changes. But this release is special! It includes several improvements so significant that in fact we can talk about this version as a new product. Start of the new era of decompiling .NET applications into C# code, support for Mac M1 and Steam Deck, Dark Theme, improved obfuscation and so on.
New version of the VB Decompiler has a completely rewritten parsing engine of the TypeLib's information from external ActiveX libraries. Now prototypes always contain the type of the return value, if it is a class or an interface. Written new algorithm for parsing If ... Else ... End If statements. Improved parsing of prototypes in virtual method tables (VTable). Merging the decompiled code with the disassembled one now supports jumping to the desired line. Added experimental support for Windows XP and more other improvements and updates.
A lot of work has been done in new version of the decompiler. We speed up code analyzer and optimizer. In parallel with the decompilation of Native Code and P-Code Visual Basic 6.0, a lot of work is being done on the decompilation of .NET applications. VB Decompiler supports structure decompilation and CIL disassembly of all .NET family languages (C#, Visual Basic, F#, Delphi .NET and other Common Intermediate Language compilers). New version of VB Decompiler extended support for new .NET constructs and fixed many incompatibilities.
A lot of time has passed since the release of the previous version and today I really have something to surprise you! The new version of the decompiler has embodied a lot of little things that significantly increase the convenience of code research. And this functionality has been expected and will be appreciated by absolutely everyone. But first things first.
Especially for criminologists and antivirus analysts, we are pleased to present a new license for VB Decompiler. In the version with automatic analytics features, VB Decompiler can generate a report that contains detailed information about the activity of a decompiled program on a user's computer. The analyst receives a full report on the areas (procedures and functions) of the program that perform various manipulations with files, registry, windows, processes, as well as using service functions of Visual Basic.
Now you can partially debug a program compiled in Native Code and P-Code on the built-in emulator, without running the program on the real CPU! Tracing (or, to be more exact, step-by-step emulation) lets you put the emulation on hold on each line of the assembler code, so that you can check the processor and co-processor registers, the stack, and the variables. Because code is processed by the emulator, not run on the real processor, this feature will be very useful for virus analysts who examine malware in anti-virus labs.
After three months of hard work and several months of preparations, we are happy to introduce a major update of VB Decompiler. Among many things that we have improved, the most important one is probably the completely redesigned Visual Basic native code emulator/decompiler.
Everybody knows that sometimes it is pretty difficult to find a piece of code that handles a click on a form button, a form loading event, or some other UI event. We've known about this problem for quite a long time, and we've been working hard to fix it. And finally, in the new version of our decompiler, we did it!
With each new release of VB Decompiler, we greatly improve decompilation quality. Version 10.6 is yet another confirmation to that fact. We have done a lot of tests to identify previously unsupported rarely-used MSVBVM60.DLL functions, statements, and combinations of different procedures. After spending a great deal of time and effort, we can firmly say that now VB Decompiler supports even more functions of the runtime library.
There were many milestones in the evolution of VB Decompiler: p-code decompilation, native code decompilation, .NET disassembling, VB Decompiler porting from VB6 to Delphi, adding functions for native code tracing without launching the program under study, etc. Seemingly now we could just sit back and confine ourselves to polishing the decompiler. But practice has shown that software developers using VB Decompiler badly wanted the ability to display restored forms or User Controls. Starting from version 10.5, VB Decompiler supports visualization of restored forms and User Controls!
I am happy to present the new version of VB Decompiler that contains tons of improvements and innovations. The main improvement that has had a profound effect on everything, is substantial optimization, refactoring, and runtime performance boost. In version 10.4, you will find a 5-fold increase in the speed of decompilation of applications built in Visual Basic 6.0 with the "native code" option, and a 7-fold increase in the speed of decompilation of .NET applications!
The new version of VB Decompiler brings native-code VB6 program decompilation to a radically new level! Starting from v10.3, VB Decompiler can decompile calls, methods, and properties of external ActiveX components not listed in its database. In addition to that, prototypes of 1853 API functions, including those of system functions, have been added to the database.
After making a lot of changes to VB Decompiler, we are delighted to announce a new version! There are so many significant improvements in versions 10 and 10.1, that we should mention each of them.
After several months of painstaking work, we are happy to introduce a new, much improved version of VB Decompiler. This time we also changed its key feature, native code decompilation. Many VB Decompiler users have been waiting for that, and finally, after a great deal of code refactoring, we succeeded in redesigning and considerably improving the emulator.
I am happy to announce a new version of VB Decompiler. When working on this release, we focused on the decompiler's usability when analyzing a code. The changes have been brewing for quite a long time. Hopefully, now the product will be much easier to use. But let's start from the beginning.
After nearly six months of hard work, I'm happy to introduce VB Decompiler 9.0. You may say, why is it 9.0, not 8.5? There are a few reasons for that. The main one is I've completely ported the project from Visual Basic 6.0 to Delphi XE2. Basically, most of the new version is made from scratch. Though it was impossible to port many things as is, I've done my best to make all features work just like they did in the previous version, or even better.
Many programmers whose work involves studying the internals of binary files sometimes encounter programs written in P-Code. Even if you are a reverse engineer who has never seen Visual Basic and its compiler, you surely have run into pseudo code at least once in your professional career. Unlike standard machine code, which is directly executed by the CPU, p-code is a set of virtual machine mnemonics executed by the msvbvmXX.dll engine.
If you are experienced in analyzing software applications and in localization, then you have surely encountered some programs written in Visual Basic. Doesn't it surprise you that there is almost no information on how to edit VB forms and controls? In this article, I'm going to fill this gap as best as I can. (Actually, I wrote it in early 2007, and all the time since then it had been waiting to be published.)