VB Decompiler News



VB Decompiler v11.2 has been released (June 18, 2019)

What's new in this version:
- New analytic features for forensics and malware analysts.
  VB Decompiler can generate a report that contains detailed
  information about the activity of a decompiled program on a user's computer.
  Needs additional license.
- Support heuristic prototypes for functions and procedures (P-Code)
- New German documentation
- Slovak translation is updated
- Greek translation is updated
- Support ReDim for zero length arrays (Native Code)
- BugFix: Show pointer to main form as value at argument of procedure (Native Code)
- BugFix: Access Violation on parsing incorrect API references (P-Code)
- BugFix: Auto-created prototypes replaces named prototypes



VB Decompiler v11.1 has been released (March 3, 2019)

What's new in this version:
- Show events list directly by clicking on any object on the form. After double click
  on any event - VB Decompiler show decompiled code. After jumping back - VB Decompiler open
  form on last viewed control (UI Viewer)
- Add new types of objects (2 types of Modules and one type of Form)
- Show unknown external calls in VTable of dumped files (P-Code)
- Open files with fake VB signature (with pointer to out of file)
- Filter wrappers to SetMemObj, GetMemVar, PutMemVar, SetMemVar, GetMemEvent,
  PutMemEvent, SetMemEvent at procedures list (Native Code)
- Add to the form header references to used ActiveX objects
- Now you can mark/unmark any function/procedure at the tree
- New Option "IgnoreCharsConvertions" to disable conversion of the text values
  in a Forms from local non English language to Unicode (like #0000#0001)
- Trying to recovery methods from the Modules of Visual Basic 5.0 files (P-Code)
- Analyze bound imports for supporting some features for VB5 applications
- BugFix: Freezes on some obfuscated procedures (Native Code)
- BugFix: Error on opening some protected/obfuscated files
- BugFix: Error on obfuscating Form without controls but with incorrect number of controls
- BugFix: UDT search in Sub Main
- BugFix: Show "call esi" if esi is unknown function
- BugFix: Error if Import Table at end of file and no free space after last name or ordinal
- BugFix: Incorrect parsing UserControl property "HitBehavior"
- BugFix: If filename contain "&" char then it can't be deleted from recent list



VB Decompiler v11 has been released (May 23, 2018)

What's new in this version:
- New processing engine for __vbaObjSet and __vbaHresultCheckObj (Native Code)
- New processing engine for 24 Late calls: __vbaVarLateMemCallLd, __vbaVarLateMemCallLdRf,
  __vbaVarLateMemCallSt, __vbaVarLateMemSt, __vbaLateMemSt, __vbaVarLateMemStAd,
  __vbaLateMemStAd, __vbaLateIdCall, __vbaLateIdCallLd, __vbaLateIdCallSt, __vbaLateIdSt,
  __vbaLateIdStAd, __vbaLateMemCall, __vbaLateMemCallLd, __vbaLateMemCallSt,
  __vbaLateIdNamedCall, __vbaLateIdNamedCallLd, __vbaLateIdNamedCallSt, __vbaLateIdNamedStAd,
  __vbaLateMemNamedCall, __vbaLateMemNamedCallLd, __vbaLateMemNamedCallSt,
  __vbaLateMemNamedStAd, __vbaRaiseEvent. NamedCall's is partially supported. (Native Code)
- Show "This Control" (variable with assigned active control) and "Temporary This"
  at Tracer window (Tracing features)
- VB .NET decompiler is optimized and refactored
- Tracing is now supported for P-Code functions and procedures. Just
  right click on an address in a decompiled or disassembled code (like
  loc_00401000) and select same menu link. Opened code will be emulated up
  to the selected address and you'll see stack, previous decompiled line,
  and current This object. This function works like a breakpoint on a
  debugger, but no code executed, only emulated. (P-Code)
- New feature "Prototypes Analyzer". Before decompilation, VB Decompiler will
  analyze all Private functions and procedures for prototype. It helps to
  provide correctly decompiled calls to this procedures and functions. This
  feature can be activated in Options and decrease speed of the opening
  file (P-Code and Native Code)
- New option for new feature: Parsing "If" ... "Else" ... "End If"
  blocks (Native Code)
- "Add addresses" option now works in P-Code too
- Support vbaNew2 calls for internal Forms, UserControls and Classes (Native Code)
- Objects is now more strong typized (Native Code)
- Decompile 16777215 as "True" at "If .. Then" statements (Native Code)
- Filter calls to VB Runtime wrappers using VTable (Native Code)
- Ukrainian translation by Dmitry Prigornitsky
- Show operand for msvbvmXX.dll functions MemLdPr, LateIdLdVar, MemLdUI1,
  MemLdI2, MemLdR4, MemLdR8, MemLdFPR4, MemLdFPR8 (P-Code Lite Version)
- Support for global variables as in a P-Code (Native Code)
- Show Dispatch ID and VTable ID for Public and Private
  variables (P-Code and Native Code)
- Support a lot of array in a push, mov, add and sub commands:
  [reg+reg], [reg-reg], [reg+Address], [reg-Address],
  [reg+reg*2] (Native Code)
- Emulator stack size increased to form 16 to 64 dwords (Native Code)
- Decompile "ExitProcCbHresult" with and without arguments differently (P-Code)
- Doesn't calculate the entropy (test for packed/protected) for files larger than 5Mb.
  Increases download speed and is not required for most files.
- Support disassembling of extremely large functions. Correctly find the
  finish part of this functions (for functions with up to 100k lines of code)
- Increase speed for saving to file
- Decompilation of "Err" object with all properties and methods (P-Code and Native Code)
- Increased Native Code decompilation speed
- Database of external OCX/DLL controls is filtered and optimized
- Show all possible arguments at private procedure prototype by
  analyzing code of the procedure (Native Code)
- Use different colors for "Sub" and "Functions"
- Try to detect type of the procedure, declared as Private (Sub or Function)
- Filter "Select Case" jump tables at the end of function (Native Code)
- Declare User Defined Types (UDT) and public variables. For UDT VB Decompiler
  show size of the structure and count of string fields. For Public variables
  VB Decompiler show name and type
- Add support for msvbvmXX.dll APIs: __vbaR8IntI2, __vbaR8IntI4,
  __vbaVargVarCopy, __vbaRedimVar, __vbaVarSetObjAddref, __vbaVarSetUnk,
  __vbaVarSetUnkAddref, __vbaVarSetVarAddref, __vbaVarXor, __vbaVarNot
  __vbaPowerR8, __vbaVarLateMemSt, __vbaStrLike, __vbaStrTextLike,
  __vbaVarLike, __vbaVarTextLike, __vbaVarTextLikeVar, __vbaVarLikeVar,
  __vbaDerefAry1, __vbaVargVarRef (Native Code)
- Add partially support for msvbvmXX.dll APIs: __vbaRecAnsiToUni,
  __vbaRecAssign, __vbaRecDestruct, __vbaRecDestructAnsi, __vbaRecUniToAnsi
- Add support for msvbvm50.dll APIs: __vbaVarTextCmpEq, __vbaVarTextCmpNe,
  __vbaVarMod (Native Code)
- Show variables for msvbvmXX.dll functions: __vbaVarOr,
  __vbaVarNeg, __vbaVarMod, __vbaVarMul, __vbaVarPow, __vbaVarDiv,
  __vbaVarIdiv
- Support RegExp2 class from vbscript.dll
- Support "Select Case" statements with more than 255 cases (Native Code)
- Search in a variables at Tracer window (Tracing features)
- Save current Date/Time to the header of text file (Save all in one module)
- Support for Objects: Form.Controls.X, MDIForm.Controls.X, UserControl.Controls.X,
  PpropertyPage.Controls.X, UserDocument.Controls.X, ListView.Items.X
- Emulation for direct assembler 'Or' command with variables.
  Usually Visual Basic use __vbaVarOr or same APIs, but with __vbaXXXLike
  Visual Basic use native 'Or' (Native Code)
- Support loading 4 and 8 byte floats from address by fild FPU command (Native Code)
- Open binary file from *.lnk file. Pure binary parsing, APIs or WScript is not used.
  Not all types of *.lnk files is supported.
- BugFix: Update decompiled code after editing any string in String References
- BugFix: Decompile names of global variables in classes
  (if it saved to the binary file)
- BugFix: Decompile msvbvmXX.dll function MemLdPr (P-Code)
- BugFix: Decompile msvbvmXX.dll functions: __vbaR4ErrVar, __vbaR8ErrVar,
  __vbaR4Var, rtcRandomNext, __vbaBoolVar
- BugFix: Decompile msvbvm50.dll functions: __vbaRedim, __vbaRedimPreserve
- BugFix: Correctly process prototype of the function with more
  than the nine parameters parameters via the stack
- BugFix: Correctly process "End If" in some cases then this address is filtered
  by "Procedure analyzer and optimizer"
- BugFix: Correctly process object properties Left/Top/Width/Height
  as Single floating point (Native Code)
- BugFix: Correctly process "End If" and other block-closing commands in some cases,
  if "Add Address" option is unchecked (Native Code)
- BugFix: Processing strings with only quote (") and apostrophe (') chars



VB Decompiler History



Main     News     Products     Documentation     Articles     Download     Order now     About us    

Privacy policy