Viewing of code
The code views combine syntax highlighting, collapsible blocks, address-based navigation, and cross-references. Use the high-level listing to understand a procedure and the disassembly and file bytes to check how that result was obtained.
Highlighting and navigating identifiers
Place the caret on a register, variable, or function name to highlight matching occurrences in the current listing. Local variables such as var_XX and str_XX are also highlighted when used as the base of a member expression, for example str_1.Value. Selecting a global_XX identifier highlights its occurrences within the current procedure; this highlighting is separate from a project-wide reference search.
Double-click a recognized procedure call to open the called procedure. Address-like constants can instead lead to the corresponding bytes in the HEX Editor. Use Esc, the navigation arrows, or the mouse Back/Forward buttons to move through viewing history.
Combining decompiled and disassembled code
Right-click the decompiled listing and select Copy to disassembler, or press D in the code view. This merges the reconstructed statements with the low-level listing for the current procedure. To preserve your place, position the caret on the relevant loc_ address before invoking the command.
Keep Add Addresses enabled in the decompilation settings when using this workflow. The Disassembler always displays addresses; Add Addresses controls the Decompiler view.
Renaming variables
For VB5/6 P-Code and Native Code, right-click a variable and select Rename variable, or place the caret on the variable and press N. Enter a meaningful analysis name. The decompiler checks for name collisions and reserved keywords. To revert a rename, use Undo renaming or Ctrl+Shift+Z. This command is independent of ordinary text-editing undo.
Renaming makes the recovered listing easier to analyze; it does not recover a name that was removed by compilation. Treat analyst-assigned names as annotations when communicating findings.
Finding callers and global variable references
To find callers, right-click a procedure in Solution explorer and select Find references, or press X with that procedure selected in the tree. The results list the procedures containing recognized calls to it. Double-click a result to inspect the caller. This workflow supports VB5/6 and .NET; .NET support was added in version 12.4.
To investigate a global variable, place the caret on its identifier in the code view and press X. The same key therefore searches procedure references in the tree and global variable references in code. A list of recognized references does not establish that there are no additional indirect, dynamically resolved, or obfuscated uses.
Context-sensitive shortcuts
| Focus | Shortcut | Action |
|---|---|---|
| Code | N | Rename the variable under the caret (VB5/6). |
| Code | X | Find references to the global variable under the caret. |
| Code | D | Copy the current decompiled code to the Disassembler. |
| Code | F4 | Trace to the address on the current line; requires Tracing features. |
| Code | Ctrl+Shift+Z | Undo renaming of the variable under the caret. |
| Tree | X | Find references to the selected procedure. |
| Tree | G | Open Jump to the section. |
| Tree | Ctrl+C | Copy the selected object's full tree path. |
| Tree | Space or Insert | Mark or unmark the selected item. |
Single-letter shortcuts depend on the focused view and do not replace normal typing in input fields. Use Alt+1 to change focus. See String Search for Ctrl+T and Ctrl+F, Jump to address for tree paths and addresses, and Tracing for emulator limitations.