VB Decompiler News

VB Decompiler v12 has been released (February 8, 2023)

What's new in this version:
- Mac OS on M1 processors compatibility via Parallels
- Increased decompiler loading speed for all licenses
- New Dark Theme and support for custom themes, based on dark and
  light colors. A lot of controls and code refactored and rewritten
  to support this. Also added a lot of new color scheme parameters.
  Fonts (family and size) can be changed separately for Solution
  explorer, Decompiler and HEX Editor. Colors can be changed for
  all parts of Highlighting Code and for all parts of HEX Editor.
  Color Scheme topic in English documentation with information how to
  make your own color theme is also updated.
- Now you can select more than one Font Family for each part of
  the UI control in a color schemes configuration file to support
  Windows, Linux and Mac, where installed font is different.
- Supporting of Dark Theme for Parallels in Mac OS and Wine on
  Linux systems. Partially supported Steam Deck console - menu
  refreshes incorrectly to light colors in a Dark Theme, but other
  features works fine (tested on Wine, not Proton).
- Redrawn about 50 icons to support smooth transparent
  rendering in a Dark Theme.
- New .NET strings mangler and demangler to support special chars
  looking in a code and editing in a String References (.NET)
- Don't show duplicates in a String Reference if duplicate used
  at same method, but show if methods is different
- New parsing algorithms for arguments of the __vbaVarLateMemSt and
  __vbaLateIdSt msvbvmXX.dll APIs. Supports class properties with
  reverse order of the Dispatch ID
- Tracer for P-Code compiled programs is highly improved:
  showing variables and list of a previously decompiled
  code (Tracing features)
- Translations supported for Native Code and P-Code Tracers
  If translation is already available for your language in a "lang"
  subfolder of the VB Decompiler installation folder (Tracing features)
- Native Code Tracer window size is increased and supports
  using only keyboard (Tracing features)
- Replace Courier New font to Liberation Mono for a decompiled code
  if decompiler works under Linux using Wine
- Use less time and memory to find APIs
- BugFix: Opening binary files in VB Decompiler via command line
- BugFix: Show correct virtual address of the API
  wrapper code (API list in solution explorer tree)
- BugFix: Resizing Find Method References (Find Next)
  and String References windows
- BugFix: Refresh strings list in internal .net structures after
  editing string in a String References dialog form (.NET)
- BugFix: Save file after editing in a HEX Editor
  (Error about cannot save read-only file)
- BugFix: Show HEX dump and assembler command for calls
  of API wrapper in a Disassembler tab (Native Code)



VB Decompiler v11.9 has been released (August 29, 2022)

What's new in this version:
- New parser for If ... End If statements
- Right clicking on any loc_XX address in a code and select
  "Copy to disassembler" not only merge decompiled and assembler code
  but also jumps to same code line as in Decompiler tab.
  It helps to analyze large procedures.
- New parser for TypeLib information from external OCX/DLL,
  used in a decompiled file
- Support extended prototype values in VTable (VB5/6)
- Backward compatibility for Windows XP (experimental)
- Parse prototypes of functions/procedure using RTTI
- Support for dynamic size of Events structure
- Filter "_adj_fdivr_m32" API (Native Code)
- Parse "movzx" assembler command (Native Code)
- Ignore "cwd" assembler command (Native Code)
- Support external objects calling by early binding (P-Code)
- Support calling by VTable offset public methods and
  get/set public variables in internal classes (Native Code)
- New parser for assembler "test" command (Native Code)
- Parsing array operand in "imul" command (Native Code)
- Parsing array first operand in "cmp" command (Native Code)
- Decompile calls to basic methods (with VTable offset 1 to 3Ch)
  of OLE objects: AddRef, Release, PropertyBag, etc (P-Code)
- Increased row height for properties list in Designer
- BugFix: Not show Form or Class in a Solution Explorer if this
  class placed before Module without public methods
- BugFix: Ignore analyzing prototype for public "Sub" and "Functions" to
  display correct color of icon in Solution Explorer
- BugFix: Show "(" and pointer to variable as a comment
- BugFix: Parsing variable of "Select Case" statement where
  esi register is not used, but some optimizations used
  during compilation (Native Code)
- BugFix: Type of method ("Sub" or "Function") can be cleared
  in a prototype declaration during analyzing code with unknown prototype



VB Decompiler v11.8 has been released (April 27, 2022)

What's new in this version:
- Show progress of VDD files loading on the splash screen if it
  opened using command line
- Increased string references processing
- Trim string references by vbCrLf
- Detect x64 Delphi 11.1 files
- Show progress status during decompile too large functions (VB5/6)
- Support for FE16 constrained MS IL opcode (.NET)
- Support deobfuscated .NET files with wrong call addresses in a code (.NET)
- Optimizations of the "Replace" function
- Process ResolutionScopeEncoded tables (.NET)
- Add ResolutionScope to local variables and calls (.NET)
- Break disassembling on "int 03h" in unmanaged .NET x64 code (.NET)
- BugFix: Correctly load vdd databases with very large string references
- BugFix: TabOrder in "String References" and "Procedure References" forms
- BugFix: Incorrect size of the "ldloca" il opcode (.NET)
- BugFix: Parsing pointer to pointer in local variables (.NET)
- BugFix: Error on parsing some variant expressions in a stack,
  marked as integer (VB5/6)
- BugFix: Error on show forms with Splitter control, where Min
  value larger than Max value



VB Decompiler v11.7 has been released (November 19, 2021)

What's new in this version:
- Now analytic features for forensics and malware analysts supports
  Visual Studio .NET applications. Supported all x86 and x64 .NET Windows platforms
  (Visual Basic, C#, etc) based on PE EXE/OCX/DLL files.
  VB Decompiler license with Analytic Features can generate a report, that
  contains detailed information about the activity of a decompiled program on
  a user's computer: working with files, registry, network, cryptography,
  .net threads and databases.
- Search and Highlight for any keyword under the cursor. Just click on any operand,
  register or variable name and VB Decompiler highlight all same names in a whole code
  list. You can change highlight fore and back colors for custom color scheme
  by changing INI files in Colors subdirectory of the VB Decompiler.
  Just change UnderCursorBackground and UnderCursorForeground.
- Popup menu for treeview now allows to jump procedure by it's path.
  You can copy path of each procedure using menu "Copy the name of section"
  and jump to this path using "Jump to the section".
  It can be helpful on the large projects.
- Detect return value for P-Code functions without ExitProcCbHresult (P-Code)
- Support dumps with incorrect MethodLinkCount (P-Code)
- Support MethodPtr table and VB Decompiler use it to sort methods (.NET)
- Show tables from the .NET applications if "#~" heap name obfuscated (.NET)
- Hebrew translation of the documentation and GUI by Lihai Konio
- Turkish translation of the documentation and GUI by Murat EKSI
- Changes in documentation on all supported languages
- Analyze prototypes can be disabled in Analytics license for fast
  opening files (as in Business license). At any way if you need an
  Analytics Report then this option must be enabled.
- Support for fchs FPU command (Native Code)
- Improved heuristic type detection for private procedures
  and functions (Native Code)
- Show class name before methods in calls (.NET)
- Make prototypes of each call of function and procedure.
  Supported default parameters and links to a Field table (.NET)
- Make prototypes of each API call (.NET)
- Show TypeNamespace and TypeName of the class where called
  API function is declared (.NET)
- Show parent class name if TypeNamespace is zero (.NET)
- Support parsing TypeSpec blobs in a calls (.NET)
- Parse default parameters of each call of function and procedure (.NET)
- Show null char in a string as "\0" (.NET)
- Support dumps with Entry point higher than size of the file
- BugFix: Show correct address in "Referenced from" for Return and
  GoSub commands (P-Code)
- BugFix: Procedure analyzer on access methods from variable (P-Code)
- BugFix: Decompiler analyze double click on the names same
  with current opened function
- BugFix: First argument in call of private functions and procedures in
  modules processed incorrectly (Native Code)
- BugFix: Correctly show parameters for Property Let
- BugFix: Tracing last line at P-Code procedure
- BugFix: Show error if file has no MethodPtr table (.NET)
- BugFix: Jumps from analytic reports to .NET functions (.NET)



VB Decompiler v11.6 has been released (November 25, 2020)

What's new in this version:
- New perfect feature. Now VB Decompiler can find references to any global
  variable in all forms and modules. Just right click on any global variable
  in a decompiled code and click on "Find references". After search,
  VB Decompiler will show all founded functions in a list and you can
  jump to any function. Saving report, copying each entry and search on
  the list is also supported.
  This feature is for Visual Basic 5.0/6.0 files only.
- Support plugins, written on the Python. Needs for 32 bit Python v3.8 installed.
  Example you can find in pyplugins directory in VB Decompiler folder.
  APIs is same with DLL plugins. Plugin loads by clicking menu with its name.
  You can edit code of the plugin and launch it without restarting VB Decompiler.
  Special thanks for samples to Stanislav Rakovskij
- A lot of changes to support incorrect, dumped and obfuscated files to help
  research labs in analyze malware code.
- Support incorrect dumps with trash in address and size of PE sections
- Support obfuscated incorrect ordinals of VB5/6 APIs
- Support .NET assemblies where "#~" is not a first stream (.NET)
- Support obfuscated VB5/6 files with incorrect pointers
- BugFix: Close non-supported files after analyze
- BugFix: Show loading and decompiling progress in Windows status bar
- BugFix: Processing more than one file with color schemes and translations