The main window
After selecting a file, pressing the Decompile button and waiting for some time, the structure of the decompiled project will appear on the screen. On the left side of the window is a tree view of forms, modules, and procedures. The content of the selected procedure or function appears in the right-hand section. If the Window style as in Visual Studio is enabled in Options, the object tree placement will be on the right, with code displayed on the left.
Particular attention should be drawn to the elements of the toolbar. Above the object tree are two arrow buttons for navigating forward and backward through the history of viewing functions (appear after opening two or more functions), the name of the internal file format, and two modes of decompilation: Parse stack parameters and Procedure analyzer and optimizer. We will look at each of these elements in more detail below.
The arrow buttons serve for navigating through the history of viewing functions. Sometimes it is useful to return to a previous function when browsing one function of a decompiled program, then go back again. VB Decompiler keeps track of the history of viewed functions and after opening two or more functions, navigation buttons appear. These buttons also remember navigation steps using the Ctrl + G keyboard shortcut or through the corresponding menu option Jump to virtual address.
Next is the name of the internal file format. If we are more precise, this is the type of code that was compiled into the program. This type directly affects the quality of decompilation and the degree of similarity between results and original source code. At present, the following formats are supported: P-Code, Native Code, .NET Assembly. For a detailed description of all these types, see the Description.
Now let's talk about modes of decompilation. Each of these modes works on the fly if Fast decompilation is enabled. If Fast decompilation is disabled, after setting the necessary checkboxes, you must restart the decompilation. Each of the described below modes of decompilation work differently for different file formats.
For P-Code files, Parse from stack parameters includes unrolling stack operations, converting commands like:
push var_b
push Rnd
call %x1(%x2)
to a more understandable form:
call Rnd(var_b)
Disabling this mode is relevant in cases where the function prototype is unknown and the contents of the stack are swallowed by the decompiler and not displayed.
For Native Code, when the Parse stack parameters mode is disabled, code is output in Assembler (so-called machine code). With the mode enabled, the code is processed by an emulator and converted to a more readable form (when Assembler code is transformed into code that is closer to Visual Basic code).
The Procedure analyzer and optimizer mode includes deep optimization of the generated listing. Blocks of commands are combined, unused variables and auxiliary structures are cleaned up. The code becomes closer to the original source. This mode works similarly for P-Code and Native Code.
For .NET Assembly at present, changing modes works similarly to P-Code in that the pseudo code MS IL code is converted into a form that is closer to C# code.
This features will be further developed and improved over time.