Decompilation from address

There is very useful function on Utilities menu. It's Decompilation from address. A main feature of this function - it doesn't need that would decompiled file had correct struct and was able to be decompiled by using standard tools.

If you need to decompile any pice of code, you have to set a virtual address of the pice for Native Code / .NET or virtual address of ProcInfo struct for P-Code. ProcInfo struct has address of array of data which used by code. Without this array of data impossible to define with which functions code is works and on what of strings it has pointers. If you work with .Net, after input the address, VB Decompiler will offer to decompile this pice of code as MS IL or disassemble this pice of code. .Net  can contain both MS IL (managed code) and native code (unmanaged code).

If file has opened in VB Decompiler, it's enough to click "Decompilation from offset" and set address of code. If file wasn't opened, VB Decompiler will do it automatically and file will be opened in simple mode.

That function very usefull if code which you need decompile can't be done automatically. In addition It's very useful if file was damaged and can't be decompiled by using standard tools.

Main     News     Products     Documentation     Articles     Plugins     Download     Order now     Contacts