These options are responsible for disassembling the native code:

VB Decompiler Disassembler Options

Relative jump offset sets relative jump offsets instead of jmp addresses.
That is, the string:
loc_00401010   jmps 00401012
is transformed into:
loc_00401010   jmps $+1
besides, you should take into account that $ is the address of the end of floating command.
You should disable this option to make the code more visual.

Add Address shows the address before the assembled string. You are recommended to enable this option when you explore code and disable it when the addresses are not so important as the algorithm itself. Besides, if you disable this option, enable the Relative jump offset option to make it more visual. It will generated a listing comfortable for exploring the algorithm.

Add HEX Dump shows machine codes before each command. It may be useful only when it is necessary to correct the Exe file after its analysis in a HEX Editor.

Main     News     Products     Documentation     Articles     Download     Order now     About us    

Privacy policy