VB Decompiler v12.2 has been released (June 26, 2023)
What's new in this version:
- Better support for obfuscated files (.NET)
- Declaring external calls as "public extern" (.NET)
- Adding names of agruments to method declaration (.NET)
- Support for Generic Instantiation via MethodSpec table (.NET)
- Support decompilation to C# for "ldelem" and "stelem" MS IL opcodes (.NET)
- Persian translation of the documentation and GUI by Ehsan Salehi
- BugFix: Incorrect analyzing of temp variable for some exception Handlers (.NET)
- BugFix: Calculating size of some large "~" structures (.NET)
VB Decompiler v12.1 has been released (April 15, 2023)
What's new in this version:
- A new age of .NET decompilation started in VB Decompiler! Version 12.1
provides first version of the C# decompilation from the IL bytecodes.
VB Decompiler started .NET decompilation in 2006 year and improved compatibility
over the past years. This is not a standard .NET decompilation using Reflection
classes. All .NET decompilation in VB Decompiler written from scratch and
doesn't uses the .NET framework. Moreother, all versions of VB Decompiler before
v8.5 can be started in Windows 95 and works perfectly.
All previous years we decompile only .NET structures and disassembly MS IL.
Starting 2023 and v12.1 VB Decompiler supports decompilation of the .NET code!
This code can be written in Visual C# .NET, Visual Basic .NET, or using any other
CIL compatible language.
It can be x86 code or x64 code, managed or unmanaged - VB Decompiler supports
all of this! And as in early versions, VB Decompiler doesn't use .NET framework
in a decompiler. You can decompiler .NET code on a PC without installed .NET
framework!
This is a first version of C# decompilation and some features is not supported.
Already supported Try ... Catch exceptions, Case statements, initializing arrays
on the stack and a lot of MS IL opcodes. Loops recognizing is not supported at this
time and you will see it as "if ... then" blocks. C# wrappers for fast array
initializing is also not supported at this time. But we work on improvement
.NET decompilation solution and it will be added in future.
- Visual Basic obfuscation is highly improved. A lot of code refactored
for better performance
- Compatibility fix with Chinese Windows locale (different processing
non-unicode chars)
- Decompile "type" of the handler for the Small SEH frames (.NET)
- Click to select any address in the Decompiler tab. Next open the Disassembler tab.
VB Decompiler will navigate to the selected address and highlight it
- Click on any address in a comment "Referenced from" in a code to
highlight this address
- Support "Add HEX dump" option for MS IL .NET disassembler (.NET)
- Additions to the Chinese Simplified UI translation by fairycn
- BugFix: decoding branches back (.NET)
- BugFix: Windows XP compatibility fixes
VB Decompiler v12 has been released (February 8, 2023)
What's new in this version:
- Mac OS on M1 processors compatibility via Parallels
- Increased decompiler loading speed for all licenses
- New Dark Theme and support for custom themes, based on dark and
light colors. A lot of controls and code refactored and rewritten
to support this. Also added a lot of new color scheme parameters.
Fonts (family and size) can be changed separately for Solution
explorer, Decompiler and HEX Editor. Colors can be changed for
all parts of Highlighting Code and for all parts of HEX Editor.
Color Scheme topic in English documentation with information how to
make your own color theme is also updated.
- Now you can select more than one Font Family for each part of
the UI control in a color schemes configuration file to support
Windows, Linux and Mac, where installed font is different.
- Supporting of Dark Theme for Parallels in Mac OS and Wine on
Linux systems. Partially supported Steam Deck console - menu
refreshes incorrectly to light colors in a Dark Theme, but other
features works fine (tested on Wine, not Proton).
- Redrawn about 50 icons to support smooth transparent
rendering in a Dark Theme.
- New .NET strings mangler and demangler to support special chars
looking in a code and editing in a String References (.NET)
- Don't show duplicates in a String Reference if duplicate used
at same method, but show if methods is different
- New parsing algorithms for arguments of the __vbaVarLateMemSt and
__vbaLateIdSt msvbvmXX.dll APIs. Supports class properties with
reverse order of the Dispatch ID
- Tracer for P-Code compiled programs is highly improved:
showing variables and list of a previously decompiled
code (Tracing features)
- Translations supported for Native Code and P-Code Tracers
If translation is already available for your language in a "lang"
subfolder of the VB Decompiler installation folder (Tracing features)
- Native Code Tracer window size is increased and supports
using only keyboard (Tracing features)
- Replace Courier New font to Liberation Mono for a decompiled code
if decompiler works under Linux using Wine
- Use less time and memory to find APIs
- BugFix: Opening binary files in VB Decompiler via command line
- BugFix: Show correct virtual address of the API
wrapper code (API list in solution explorer tree)
- BugFix: Resizing Find Method References (Find Next)
and String References windows
- BugFix: Refresh strings list in internal .net structures after
editing string in a String References dialog form (.NET)
- BugFix: Save file after editing in a HEX Editor
(Error about cannot save read-only file)
- BugFix: Show HEX dump and assembler command for calls
of API wrapper in a Disassembler tab (Native Code)
VB Decompiler v11.9 has been released (August 29, 2022)
What's new in this version:
- New parser for If ... End If statements
- Right clicking on any loc_XX address in a code and select
"Copy to disassembler" not only merge decompiled and assembler code
but also jumps to same code line as in Decompiler tab.
It helps to analyze large procedures.
- New parser for TypeLib information from external OCX/DLL,
used in a decompiled file
- Support extended prototype values in VTable (VB5/6)
- Backward compatibility for Windows XP (experimental)
- Parse prototypes of functions/procedure using RTTI
- Support for dynamic size of Events structure
- Filter "_adj_fdivr_m32" API (Native Code)
- Parse "movzx" assembler command (Native Code)
- Ignore "cwd" assembler command (Native Code)
- Support external objects calling by early binding (P-Code)
- Support calling by VTable offset public methods and
get/set public variables in internal classes (Native Code)
- New parser for assembler "test" command (Native Code)
- Parsing array operand in "imul" command (Native Code)
- Parsing array first operand in "cmp" command (Native Code)
- Decompile calls to basic methods (with VTable offset 1 to 3Ch)
of OLE objects: AddRef, Release, PropertyBag, etc (P-Code)
- Increased row height for properties list in Designer
- BugFix: Not show Form or Class in a Solution Explorer if this
class placed before Module without public methods
- BugFix: Ignore analyzing prototype for public "Sub" and "Functions" to
display correct color of icon in Solution Explorer
- BugFix: Show "(" and pointer to variable as a comment
- BugFix: Parsing variable of "Select Case" statement where
esi register is not used, but some optimizations used
during compilation (Native Code)
- BugFix: Type of method ("Sub" or "Function") can be cleared
in a prototype declaration during analyzing code with unknown prototype
VB Decompiler v11.8 has been released (April 27, 2022)
What's new in this version:
- Show progress of VDD files loading on the splash screen if it
opened using command line
- Increased string references processing
- Trim string references by vbCrLf
- Detect x64 Delphi 11.1 files
- Show progress status during decompile too large functions (VB5/6)
- Support for FE16 constrained MS IL opcode (.NET)
- Support deobfuscated .NET files with wrong call addresses in a code (.NET)
- Optimizations of the "Replace" function
- Process ResolutionScopeEncoded tables (.NET)
- Add ResolutionScope to local variables and calls (.NET)
- Break disassembling on "int 03h" in unmanaged .NET x64 code (.NET)
- BugFix: Correctly load vdd databases with very large string references
- BugFix: TabOrder in "String References" and "Procedure References" forms
- BugFix: Incorrect size of the "ldloca" il opcode (.NET)
- BugFix: Parsing pointer to pointer in local variables (.NET)
- BugFix: Error on parsing some variant expressions in a stack,
marked as integer (VB5/6)
- BugFix: Error on show forms with Splitter control, where Min
value larger than Max value
VB Decompiler v11.7 has been released (November 19, 2021)
What's new in this version:
- Now analytic features for forensics and malware analysts supports
Visual Studio .NET applications. Supported all x86 and x64 .NET Windows platforms
(Visual Basic, C#, etc) based on PE EXE/OCX/DLL files.
VB Decompiler license with Analytic Features can generate a report, that
contains detailed information about the activity of a decompiled program on
a user's computer: working with files, registry, network, cryptography,
.net threads and databases.
- Search and Highlight for any keyword under the cursor. Just click on any operand,
register or variable name and VB Decompiler highlight all same names in a whole code
list. You can change highlight fore and back colors for custom color scheme
by changing INI files in Colors subdirectory of the VB Decompiler.
Just change UnderCursorBackground and UnderCursorForeground.
- Popup menu for treeview now allows to jump procedure by it's path.
You can copy path of each procedure using menu "Copy the name of section"
and jump to this path using "Jump to the section".
It can be helpful on the large projects.
- Detect return value for P-Code functions without ExitProcCbHresult (P-Code)
- Support dumps with incorrect MethodLinkCount (P-Code)
- Support MethodPtr table and VB Decompiler use it to sort methods (.NET)
- Show tables from the .NET applications if "#~" heap name obfuscated (.NET)
- Hebrew translation of the documentation and GUI by Lihai Konio
- Turkish translation of the documentation and GUI by Murat EKSI
- Changes in documentation on all supported languages
- Analyze prototypes can be disabled in Analytics license for fast
opening files (as in Business license). At any way if you need an
Analytics Report then this option must be enabled.
- Support for fchs FPU command (Native Code)
- Improved heuristic type detection for private procedures
and functions (Native Code)
- Show class name before methods in calls (.NET)
- Make prototypes of each call of function and procedure.
Supported default parameters and links to a Field table (.NET)
- Make prototypes of each API call (.NET)
- Show TypeNamespace and TypeName of the class where called
API function is declared (.NET)
- Show parent class name if TypeNamespace is zero (.NET)
- Support parsing TypeSpec blobs in a calls (.NET)
- Parse default parameters of each call of function and procedure (.NET)
- Show null char in a string as "\0" (.NET)
- Support dumps with Entry point higher than size of the file
- BugFix: Show correct address in "Referenced from" for Return and
GoSub commands (P-Code)
- BugFix: Procedure analyzer on access methods from variable (P-Code)
- BugFix: Decompiler analyze double click on the names same
with current opened function
- BugFix: First argument in call of private functions and procedures in
modules processed incorrectly (Native Code)
- BugFix: Correctly show parameters for Property Let
- BugFix: Tracing last line at P-Code procedure
- BugFix: Show error if file has no MethodPtr table (.NET)
- BugFix: Jumps from analytic reports to .NET functions (.NET)