VB Decompiler is an application which can reconstruct Visual Basic 5.0/ 6.0 source code (to some extent) from the compiled P-Code or native executable. (This free Lite build only disassembles it, but that can still be useful.)
This can be a life-saver if you're a programmer, and have lost your original source, as VB Decompiler should be able to recover at least some of it for you.
The application is also useful when you need to analyse what a program does. VB is sometimes used to write malware, for example, and by decompiling the executable you're able to get many more details on how it works.
VB Decompiler Lite's opening interface is very straightforward. Click the "Browse" button, choose your target executable, and wait a few seconds for the results to appear.
A left-hand pane displays a tree of your project structure. Forms expand to reveal controls, and you're able to browse modules and individual procedures.
Click any of these in VB Decompiler Lite and you'll see a disassembly of the relevant code. Most of it won't mean very much, even to experts (it's all "mov eax, arg_8", "mov ecx, var_34", "mov [eax], ecx" and so on), but the program helps out by expanding references to strings, functions and so on.
So, for example, in our test project VB Decompiler Lite expanded "call [00401078h]" to add "On Error Resume Next()"; "mov edx, 004554ACh" was actually a pointer to the string "SELECT Index,Caption FROM Win32_DiskDrive WHERE Size > 0", and "call [00401144h]" turned out to be the function "Open %x4 For <?open?>%x1 <?open?> As #%x3 Len = %x2".
Paying for the commercial version also gets you a Decompiler tab with a reconstruction of the original code, as much as possible. If your executable was compiled to native code then there are limits on what VB Decompiler can do, and you shouldn't expect to just save and open it in VB as before, but there's more than enough here to help you understand how it works.
Version 10.6 (Changelog):
What's new in this version:
- Show values from the .NET tables as text by clicking each table (.NET)
- Decompile "GenericParamConstraint" table (.NET)
- Decompile msvbvm functions: __vbaGosubFree, __vbaGosubReturn, __vbaStrTextCmp,
__vbaVarTextTstEq, __vbaVarTextTstGe, __vbaVarTextTstGt, __vbaVarTextTstLe,
__vbaVarTextTstLt, __vbaVarTextTstNe, __vbaForEachCollVar, __vbaI4Sgn,
__vbaCopyBytes, VBDllGetClassObject, GetMem2, GetMem4, GetMem8, GetMemStr, GetMemVar,
GetMemObj, PutMem2, PutMem4, PutMem8, PutMemStr, SetMemVar, SetMemObj, GetMem1,
PutMem1, __vbaRefVarAry, __vbaVarIndexLoadRefLock, __vbaVarIndexStore,
__vbaStrUI1, __vbaVarIdiv, __vbaStrBool, __vbaR8ErrVar, __vbaI2Abs,
__vbaI2Sgn, __vbaR8ForNextCheck, __vbaCheckType, __vbaStr2Vec, __vbaUnkVar,
__vbaVargVar, __vbaVerifyVarObj, __vbaObjAddref, __vbaFpCDblR4, __vbaFpCDblR8,
__vbaCheckTypeVar, __vbaStrCompVar, __vbaVarLateMemCallSt, __vbaLateIdStAd (Native Code)
- Decompile msvbvm50 functions: __vbaUI1I2, __vbaUI1I4 (Native Code)
- Decompile P-Code functions: VerifyVarObj, LateIdStAd, VarIndexSt,
EraseDestruct, EraseDestrKeepData (P-Code)
- Support for Case Else in Select Case statement (Native Code)
- BugFix: Correcly decompile "CustomAttribute" table (.NET)
- BugFix: Correcly select string after jumping from the String References to theDisassembler window
- BugFix: Strings Viewer for #US heap (.NET)
- BugFix: Add brace symbol for GUIDs of unregistered OCX files to the VBP Project file
- BugFix: Procedure analyzer and optimizer correctly parse GoSub, GoSubFree and Return commands (Native Code)
- BugFix: Procedure analyzer and optimizer correctly parse array index variables
- BugFix: Decompile msvbvmXX.dll function __vbaNextEachCollVar, __vbaVarIndexLoad,
__vbaI2Var (Native Code)
- BugFix: Show strings with "%" chars (P-Code)
- BugFix: Decompile msvbvmXX.dll function VarIndexLdVar (P-Code)
- BugFix: Don't clean some fields in a controls cache after previous decompilation (VB5/6)
- BugFix: Emulation of "jmpf" assembler command (Native Code)
- BugFix: Decompile some types of Select Case statements (Native Code)