VB Decompiler News

VB Decompiler v12.2 has been released (June 26, 2023)

What's new in this version:
- Better support for obfuscated files (.NET)
- Declaring external calls as "public extern" (.NET)
- Adding names of agruments to method declaration (.NET)
- Support for Generic Instantiation via MethodSpec table (.NET)
- Support decompilation to C# for "ldelem" and "stelem" MS IL opcodes (.NET)
- Persian translation of the documentation and GUI by Ehsan Salehi
- BugFix: Incorrect analyzing of temp variable for some exception Handlers (.NET)
- BugFix: Calculating size of some large "~" structures (.NET)



VB Decompiler v12.1 has been released (April 15, 2023)

What's new in this version:
- A new age of .NET decompilation started in VB Decompiler! Version 12.1
  provides first version of the C# decompilation from the IL bytecodes.
  VB Decompiler started .NET decompilation in 2006 year and improved compatibility
  over the past years. This is not a standard .NET decompilation using Reflection
  classes. All .NET decompilation in VB Decompiler written from scratch and
  doesn't uses the .NET framework. Moreother, all versions of VB Decompiler before
  v8.5 can be started in Windows 95 and works perfectly.
  All previous years we decompile only .NET structures and disassembly MS IL.
  Starting 2023 and v12.1 VB Decompiler supports decompilation of the .NET code!
  This code can be written in Visual C# .NET, Visual Basic .NET, or using any other
  CIL compatible language.
  It can be x86 code or x64 code, managed or unmanaged - VB Decompiler supports
  all of this! And as in early versions, VB Decompiler doesn't use .NET framework
  in a decompiler. You can decompiler .NET code on a PC without installed .NET
  framework!
  This is a first version of C# decompilation and some features is not supported.
  Already supported Try ... Catch exceptions, Case statements, initializing arrays
  on the stack and a lot of MS IL opcodes. Loops recognizing is not supported at this
  time and you will see it as "if ... then" blocks. C# wrappers for fast array
  initializing is also not supported at this time. But we work on improvement
  .NET decompilation solution and it will be added in future.
- Visual Basic obfuscation is highly improved. A lot of code refactored
  for better performance
- Compatibility fix with Chinese Windows locale (different processing
  non-unicode chars)
- Decompile "type" of the handler for the Small SEH frames (.NET)
- Click to select any address in the Decompiler tab. Next open the Disassembler tab.
  VB Decompiler will navigate to the selected address and highlight it
- Click on any address in a comment "Referenced from" in a code to
  highlight this address
- Support "Add HEX dump" option for MS IL .NET disassembler (.NET)
- Additions to the Chinese Simplified UI translation by fairycn
- BugFix: decoding branches back (.NET)
- BugFix: Windows XP compatibility fixes



VB Decompiler v12 has been released (February 8, 2023)

What's new in this version:
- Mac OS on M1 processors compatibility via Parallels
- Increased decompiler loading speed for all licenses
- New Dark Theme and support for custom themes, based on dark and
  light colors. A lot of controls and code refactored and rewritten
  to support this. Also added a lot of new color scheme parameters.
  Fonts (family and size) can be changed separately for Solution
  explorer, Decompiler and HEX Editor. Colors can be changed for
  all parts of Highlighting Code and for all parts of HEX Editor.
  Color Scheme topic in English documentation with information how to
  make your own color theme is also updated.
- Now you can select more than one Font Family for each part of
  the UI control in a color schemes configuration file to support
  Windows, Linux and Mac, where installed font is different.
- Supporting of Dark Theme for Parallels in Mac OS and Wine on
  Linux systems. Partially supported Steam Deck console - menu
  refreshes incorrectly to light colors in a Dark Theme, but other
  features works fine (tested on Wine, not Proton).
- Redrawn about 50 icons to support smooth transparent
  rendering in a Dark Theme.
- New .NET strings mangler and demangler to support special chars
  looking in a code and editing in a String References (.NET)
- Don't show duplicates in a String Reference if duplicate used
  at same method, but show if methods is different
- New parsing algorithms for arguments of the __vbaVarLateMemSt and
  __vbaLateIdSt msvbvmXX.dll APIs. Supports class properties with
  reverse order of the Dispatch ID
- Tracer for P-Code compiled programs is highly improved:
  showing variables and list of a previously decompiled
  code (Tracing features)
- Translations supported for Native Code and P-Code Tracers
  If translation is already available for your language in a "lang"
  subfolder of the VB Decompiler installation folder (Tracing features)
- Native Code Tracer window size is increased and supports
  using only keyboard (Tracing features)
- Replace Courier New font to Liberation Mono for a decompiled code
  if decompiler works under Linux using Wine
- Use less time and memory to find APIs
- BugFix: Opening binary files in VB Decompiler via command line
- BugFix: Show correct virtual address of the API
  wrapper code (API list in solution explorer tree)
- BugFix: Resizing Find Method References (Find Next)
  and String References windows
- BugFix: Refresh strings list in internal .net structures after
  editing string in a String References dialog form (.NET)
- BugFix: Save file after editing in a HEX Editor
  (Error about cannot save read-only file)
- BugFix: Show HEX dump and assembler command for calls
  of API wrapper in a Disassembler tab (Native Code)



VB Decompiler v11.9 has been released (August 29, 2022)

What's new in this version:
- New parser for If ... End If statements
- Right clicking on any loc_XX address in a code and select
  "Copy to disassembler" not only merge decompiled and assembler code
  but also jumps to same code line as in Decompiler tab.
  It helps to analyze large procedures.
- New parser for TypeLib information from external OCX/DLL,
  used in a decompiled file
- Support extended prototype values in VTable (VB5/6)
- Backward compatibility for Windows XP (experimental)
- Parse prototypes of functions/procedure using RTTI
- Support for dynamic size of Events structure
- Filter "_adj_fdivr_m32" API (Native Code)
- Parse "movzx" assembler command (Native Code)
- Ignore "cwd" assembler command (Native Code)
- Support external objects calling by early binding (P-Code)
- Support calling by VTable offset public methods and
  get/set public variables in internal classes (Native Code)
- New parser for assembler "test" command (Native Code)
- Parsing array operand in "imul" command (Native Code)
- Parsing array first operand in "cmp" command (Native Code)
- Decompile calls to basic methods (with VTable offset 1 to 3Ch)
  of OLE objects: AddRef, Release, PropertyBag, etc (P-Code)
- Increased row height for properties list in Designer
- BugFix: Not show Form or Class in a Solution Explorer if this
  class placed before Module without public methods
- BugFix: Ignore analyzing prototype for public "Sub" and "Functions" to
  display correct color of icon in Solution Explorer
- BugFix: Show "(" and pointer to variable as a comment
- BugFix: Parsing variable of "Select Case" statement where
  esi register is not used, but some optimizations used
  during compilation (Native Code)
- BugFix: Type of method ("Sub" or "Function") can be cleared
  in a prototype declaration during analyzing code with unknown prototype



VB Decompiler v11.8 has been released (April 27, 2022)

What's new in this version:
- Show progress of VDD files loading on the splash screen if it
  opened using command line
- Increased string references processing
- Trim string references by vbCrLf
- Detect x64 Delphi 11.1 files
- Show progress status during decompile too large functions (VB5/6)
- Support for FE16 constrained MS IL opcode (.NET)
- Support deobfuscated .NET files with wrong call addresses in a code (.NET)
- Optimizations of the "Replace" function
- Process ResolutionScopeEncoded tables (.NET)
- Add ResolutionScope to local variables and calls (.NET)
- Break disassembling on "int 03h" in unmanaged .NET x64 code (.NET)
- BugFix: Correctly load vdd databases with very large string references
- BugFix: TabOrder in "String References" and "Procedure References" forms
- BugFix: Incorrect size of the "ldloca" il opcode (.NET)
- BugFix: Parsing pointer to pointer in local variables (.NET)
- BugFix: Error on parsing some variant expressions in a stack,
  marked as integer (VB5/6)
- BugFix: Error on show forms with Splitter control, where Min
  value larger than Max value



VB Decompiler v11.7 has been released (November 19, 2021)

What's new in this version:
- Now analytic features for forensics and malware analysts supports
  Visual Studio .NET applications. Supported all x86 and x64 .NET Windows platforms
  (Visual Basic, C#, etc) based on PE EXE/OCX/DLL files.
  VB Decompiler license with Analytic Features can generate a report, that
  contains detailed information about the activity of a decompiled program on
  a user's computer: working with files, registry, network, cryptography,
  .net threads and databases.
- Search and Highlight for any keyword under the cursor. Just click on any operand,
  register or variable name and VB Decompiler highlight all same names in a whole code
  list. You can change highlight fore and back colors for custom color scheme
  by changing INI files in Colors subdirectory of the VB Decompiler.
  Just change UnderCursorBackground and UnderCursorForeground.
- Popup menu for treeview now allows to jump procedure by it's path.
  You can copy path of each procedure using menu "Copy the name of section"
  and jump to this path using "Jump to the section".
  It can be helpful on the large projects.
- Detect return value for P-Code functions without ExitProcCbHresult (P-Code)
- Support dumps with incorrect MethodLinkCount (P-Code)
- Support MethodPtr table and VB Decompiler use it to sort methods (.NET)
- Show tables from the .NET applications if "#~" heap name obfuscated (.NET)
- Hebrew translation of the documentation and GUI by Lihai Konio
- Turkish translation of the documentation and GUI by Murat EKSI
- Changes in documentation on all supported languages
- Analyze prototypes can be disabled in Analytics license for fast
  opening files (as in Business license). At any way if you need an
  Analytics Report then this option must be enabled.
- Support for fchs FPU command (Native Code)
- Improved heuristic type detection for private procedures
  and functions (Native Code)
- Show class name before methods in calls (.NET)
- Make prototypes of each call of function and procedure.
  Supported default parameters and links to a Field table (.NET)
- Make prototypes of each API call (.NET)
- Show TypeNamespace and TypeName of the class where called
  API function is declared (.NET)
- Show parent class name if TypeNamespace is zero (.NET)
- Support parsing TypeSpec blobs in a calls (.NET)
- Parse default parameters of each call of function and procedure (.NET)
- Show null char in a string as "\0" (.NET)
- Support dumps with Entry point higher than size of the file
- BugFix: Show correct address in "Referenced from" for Return and
  GoSub commands (P-Code)
- BugFix: Procedure analyzer on access methods from variable (P-Code)
- BugFix: Decompiler analyze double click on the names same
  with current opened function
- BugFix: First argument in call of private functions and procedures in
  modules processed incorrectly (Native Code)
- BugFix: Correctly show parameters for Property Let
- BugFix: Tracing last line at P-Code procedure
- BugFix: Show error if file has no MethodPtr table (.NET)
- BugFix: Jumps from analytic reports to .NET functions (.NET)