Decompiler, Disassembler, HEX Editor - VB Decompiler v9.4
I am happy to announce a new version of VB Decompiler. When working on this release, we focused on the decompiler's usability when analyzing a code. The changes have been brewing for quite a long time. Hopefully, now the product will be much easier to use. But let's start from the beginning.
Though this feature was introduced in the previous version, few people knew about it, and even fewer used it. That's why I'd like to tell you more about it. When a code is analyzed, it is frequently found that functions often call other functions or procedures. Earlier you had to look for the function being called in the tree containing a list of modules and procedures, and then manually go to that function to view it. Now it's so much easier to do-just double-click the called function's name in the code, and that's it. The decompiler will find the function and open it for viewing (the highlighting of links has not been implemented yet). It's easy to go back to the previous function, too-just press the ESC key. You can also navigate between functions by clicking the arrow buttons above the object tree.
Now the decompiler has a built-in HEX editor, state of the art and easy to use. The editor lets you edit the file being analyzed byte-wise or by copying/inserting blocks. You can undo/redo any changes, and you can select and copy code blocks. The editor has a smart "go to the address" feature. You can enter an address as an offset or as a virtual address (VA). You can put the "loc_" prefix before the address. The only condition is that you use a HEX address.
The major change in the new version of the product is the tabbed interface used for the main screen containing the code. Now the "Disassembler" tab displays the low-level code. For projects compiled to native code, that's the assembler language; for P-Code, that's the VB pseudo code. The built-in HEX editor also provides a program-editing window. When you go to any function, it is automatically processed and displayed in all windows, and the beginning address of the function is selected in the HEX editor.
The automatic moving to the beginning of the object being viewed in the HEX editor can also be used for forms. For that purpose, go to the settings and turn on the "Show offsets" option in the "Forms" section.
Beginning from version 9.4, the decompiler supports the processing of "If ... Else ... End If" constructs in projects compiled to native code. To enable the processing of "If" constructs, go to the settings and turn on the "Process If ... End If blocks" option in the "Decompilation" section. For example, you are analyzing this code:
The code will be displayed as follows:
It should be noted that if you turn off the above-mentioned option, the code will be displayed without the "If" constructs processed but still with more details than earlier. Beginning from version 9.4, the decompiler marks the addresses in the code to which jumps occur. Each address is marked as a reference, with specifying the address from which the jump occurred:
By popular demand, we have modified VB Decompiler's user interface so that it is correctly displayed if a medium or larger font (125 or 150 percent, respectively) is set in Windows.
We have redesigned the installer. Now, when the decompiler is being installed, the language used in the operating system's user interface is automatically detected. If that language is supported by the decompiler, it is used by default for the user interface. Alternatively, you can manually select another language when installing the decompiler.
Many translations of VB Decompiler's user interface have been done by our customers living in different countries. If you find a translation error, please be so kind to inform us about that by email.
Starting from version 9.4, a number of functions for accessing disassembled code have been added to the Plugins SDK. Now you can read the decompiled code of a function, and also disassembled code. There are functions for accessing code from the active program window (for accessing the code of the function being analyzed by the user), as well as for accessing any function of the program (if the "Fast decompilation" option is turned off).
Some annoying bugs that caused plugin errors when reading data returned by the decompiler were fixed too. Now the plugins are much more stable!
Please keep in mind that we are still offering you a deal: Write a useful plugin to get a free license for VB Decompiler! So if you have any interesting ideas about plugins, make sure to contact us. If we are interested in your idea and you implement it in a new plugin, we'll be happy to provide you a licensed copy of VB Decompiler.
When working on the new version, we also improved our product usability-wise in many ways. Now, if you click a function or a procedure in the object tree, the focus will automatically move to the code, and the selected item in the tree will stay highlighted, so that you know which function or procedure have been selected.
Right-clicking any item in the object tree opens a context menu that allows you to copy the path in the tree. That's very useful if you work in a team and frequently need to explain to other team members where the piece of code is located.
The saving of the decompiler window's location has been fixed. Now not only the size of the window, but also its location on the screen is saved.
Yet another nice improvement is the filtering out of empty folders in the object tree. If the program being analyzed doesn't contain any forms, the Forms folder will not be displayed. The same goes for the UserControls and Project folders if the project contains only modules.
Going from function to function
Though this feature was introduced in the previous version, few people knew about it, and even fewer used it. That's why I'd like to tell you more about it. When a code is analyzed, it is frequently found that functions often call other functions or procedures. Earlier you had to look for the function being called in the tree containing a list of modules and procedures, and then manually go to that function to view it. Now it's so much easier to do-just double-click the called function's name in the code, and that's it. The decompiler will find the function and open it for viewing (the highlighting of links has not been implemented yet). It's easy to go back to the previous function, too-just press the ESC key. You can also navigate between functions by clicking the arrow buttons above the object tree.
HEX Editor
Now the decompiler has a built-in HEX editor, state of the art and easy to use. The editor lets you edit the file being analyzed byte-wise or by copying/inserting blocks. You can undo/redo any changes, and you can select and copy code blocks. The editor has a smart "go to the address" feature. You can enter an address as an offset or as a virtual address (VA). You can put the "loc_" prefix before the address. The only condition is that you use a HEX address.
New format of the main window
The major change in the new version of the product is the tabbed interface used for the main screen containing the code. Now the "Disassembler" tab displays the low-level code. For projects compiled to native code, that's the assembler language; for P-Code, that's the VB pseudo code. The built-in HEX editor also provides a program-editing window. When you go to any function, it is automatically processed and displayed in all windows, and the beginning address of the function is selected in the HEX editor.
The automatic moving to the beginning of the object being viewed in the HEX editor can also be used for forms. For that purpose, go to the settings and turn on the "Show offsets" option in the "Forms" section.
Decompilation of "If" constructs to native code
Beginning from version 9.4, the decompiler supports the processing of "If ... Else ... End If" constructs in projects compiled to native code. To enable the processing of "If" constructs, go to the settings and turn on the "Process If ... End If blocks" option in the "Decompilation" section. For example, you are analyzing this code:
Source code
Private Sub Command1_Click()
sTest = Rnd
If sTest = "15" Then
MsgBox "Test complete", vbInformation, "Message header"
Else
MsgBox "Test fail", vbInformation, "Message header"
End If
End Sub
The code will be displayed as follows:
It should be noted that if you turn off the above-mentioned option, the code will be displayed without the "If" constructs processed but still with more details than earlier. Beginning from version 9.4, the decompiler marks the addresses in the code to which jumps occur. Each address is marked as a reference, with specifying the address from which the jump occurred:
Support for medium and larger fonts in Windows
By popular demand, we have modified VB Decompiler's user interface so that it is correctly displayed if a medium or larger font (125 or 150 percent, respectively) is set in Windows.
Automatic selection of the user interface language
We have redesigned the installer. Now, when the decompiler is being installed, the language used in the operating system's user interface is automatically detected. If that language is supported by the decompiler, it is used by default for the user interface. Alternatively, you can manually select another language when installing the decompiler.
Many translations of VB Decompiler's user interface have been done by our customers living in different countries. If you find a translation error, please be so kind to inform us about that by email.
Fixed and improved support for plugins
Starting from version 9.4, a number of functions for accessing disassembled code have been added to the Plugins SDK. Now you can read the decompiled code of a function, and also disassembled code. There are functions for accessing code from the active program window (for accessing the code of the function being analyzed by the user), as well as for accessing any function of the program (if the "Fast decompilation" option is turned off).
Some annoying bugs that caused plugin errors when reading data returned by the decompiler were fixed too. Now the plugins are much more stable!
Please keep in mind that we are still offering you a deal: Write a useful plugin to get a free license for VB Decompiler! So if you have any interesting ideas about plugins, make sure to contact us. If we are interested in your idea and you implement it in a new plugin, we'll be happy to provide you a licensed copy of VB Decompiler.
Other nice improvements
When working on the new version, we also improved our product usability-wise in many ways. Now, if you click a function or a procedure in the object tree, the focus will automatically move to the code, and the selected item in the tree will stay highlighted, so that you know which function or procedure have been selected.
Right-clicking any item in the object tree opens a context menu that allows you to copy the path in the tree. That's very useful if you work in a team and frequently need to explain to other team members where the piece of code is located.
The saving of the decompiler window's location has been fixed. Now not only the size of the window, but also its location on the screen is saved.
Yet another nice improvement is the filtering out of empty folders in the object tree. If the program being analyzed doesn't contain any forms, the Forms folder will not be displayed. The same goes for the UserControls and Project folders if the project contains only modules.
August 17, 2013
(C) Sergey Chubchenko, VB Decompiler's main developer