Download a decompiler for all exe files. Decompilers collection

Year/Date of Issue: 2012
Version: v9.2
Developer: Copyright © 2001 - 2013, DotFix Software
Bit depth: 32bit
Interface language: Multilingual (Russian is present)
Tablet: Present

System Requirements:
Windows XP/Vista/7/2008/8

VB Decompiler is a decompiler for programs (EXE, DLL, OCX) written in Visual Basic. As you know, programs developed in Visual Basic can be compiled either into interpreted p-code or into executable native code. Since p-code represents high-level commands, it appears real opportunity restore the original code from this. VB Decompiler recovers quite a lot of picod instructions and despite the fact that the generation of a source code that can be compiled is still a long way off, the decompiler will greatly simplify the task of analyzing the algorithms of the program under study and partially restore its source code.

____________________________

Possibilities:

Universal unpacking of packaged applications (UPX, NSPack and many other well-known EXE packers)
Decompiling forms (frm and frx) and usercontrols (ctl)
Complete decompilation of p-code into source-like code (including decompilation of GUID objects)
3 p-code decompilation modes (with stack processing, without stack processing and procedure analyzer function with subsequent simplification of the code and improvement of its readability)
Disassembling native code (using a powerful Pentium Pro disassembler)
Syntax highlighting in decompiled code
Partial decompilation of Native Code constructs
Indexing strings found in decompiled code and quick string search functions
High decompilation speed
Obfuscator for VB5/6 programs
Possibility of patch for VB5/6 programs
Saving the decompiled result to the database
Disassembling .NET code
Saving procedure names to a MAP file, IDC script or HIEW Names file

Additionally:
If the program was compiled into native code, then restoring the source from machine instructions is out of the question. But VB Decompiler will help analyze the program here too. It has a built-in powerful disassembler that supports all Pentium Pro commands including MMX and SSE. This allows all functions to be disassembled. There is also a code analyzer that will track all API function calls and all line references in the disassembled code and insert them as a comment on the line being analyzed.
In general, VB Decompiler is an ideal tool for analyzing programs and is ideal in case of loss of source codes and the need to partially restore the project.

What's new:
VB Decompiler v9.2 has been released (11/12/12)

What's new in this version:
-Windows 8 is fully supported
- Decode UTF8 names (.NET)
- Jumping by clicking on a procedure name
- Popup menu for the treeview is now allow to copy a name of the item
- Popup menu for the code view with the Copy and Select All operations
- Show the virtual addresses of the string references in code (.NET)
- Syntax highlighting for branches (.NET)
- Show TypeDef table content (.NET)
- Process filters for SEH handlers (.NET)
- String references dialog is now sizable
- Caching the color highlighted procedures in standard control
- Splash screen (show loading process at decompiler start)
- Saves parameters of the main window (left, top, width, height and splitter position)
to the registry and restoring it after launching the VB Decompiler.
- New code highlighting control based on SynEdit sources
- New color scheme and code highlighting scheme
- Drag"n"drop files is accepted to the whole form
- Show the different icon in the API declarations (.NET)
- BugFix: Correctly update checkboxes after resizing the windows
- BugFix: Correctly process ldloc and stloc opcodes (.NET)
- BugFix: Correctly process tables alignment (.NET)
- BugFix: Correctly process tables if count is more than 44 (.NET)
- BugFix: Correctly patch data using Patch data dialog
- BugFix: Correctly process parameters of the last MethodDef table field (.NET)
- BugFix: Correctly emulate labels and finally markers (Native Code)
- BugFix: Correctly process user classes with the incorrect RTTI (Native Code)
======================================

• From:
• Registered: 2014.07.08
• Posts: 3,973
• Likes: 547

Topic: Decompilation, unpacking .exe archive in Delphi

Decompilation in Delphi

Reading programming forums, sometimes you come across a question like: “I have a compiled Delphi program. How can I get its source code?” Typically, this question arises when a programmer has lost the project files and only has .exe left. As a rule, it is impossible to completely restore the source code in a high-level language. Does this mean that others will also not be able to restore the source code of your program? Hmm... yes and no...

To begin with, I will immediately say that it is definitely impossible to restore the source code exactly as it was, since there is no decompiler in the world that could do this.

After compiling and linking the project and obtaining the executable file, all names used in the program are converted into addresses. Losing names will mean that the decompiler will create unique name for every constant, variable, function and procedure. Even if we achieve some success in decompiling the executable file, we will get a different program syntax. This problem is due to the fact that during compilation, almost identical pieces of code can be compiled into different sequences of machine commands (ASM), which are present in the .exe file.
Naturally, the decompiler does not have such a degree of intelligence to decide what the sequence of high-level language instructions was in the original project.

2 Reply by PunBB

• From: Moscow, Sovkhoznay 3, apt. 98
• Registered: 2014.07.08
• Posts: 3,973
• Likes: 547

When is decompilation used? There are quite a few reasons for this. Here are some of them:
- Restoring the source code;
- Transferring the application to another platform;
- Determining the presence of viruses in the program code or malicious code;
- Correcting errors in the program, in case the application creator does not intend to do this

Is all this legal? Although decompilation is not a hack, it is quite difficult to answer this question in the affirmative. Programs are generally protected by copyright law, but most countries make an exception for decompilation. In particular, when it is necessary to change the program interface for a specific country, but the application service does not allow this.

On at the moment Borland does not provide any software that can decompile executable files (.exe) or compiled Delphi modules (.dcu) into source code (.pas).

If you still decide to try to decompile the executable file, then you need to know the following things. Delphi source codes are usually stored in two types of files: the source itself in ASCII encoding (.pas, .dpr) and resource files (.res, .rc, .dfm, .dcr). Dfm files store the properties of the objects contained in the form. When creating the final .exe, Delphi copies information from the .dfm files into it. Every time we change form coordinates, button descriptions or events associated with them, Delphi writes these changes to .dfm (except for procedure code. It is saved in pas/dcu files). And finally, in order to get a .dfm file during decompilation, you need to know what types of resources are stored inside the Win32 executable module.

3 Reply by PunBB

• From: Moscow, Sovkhoznay 3, apt. 98
• Registered: 2014.07.08
• Posts: 3,973
• Likes: 547

Re: Decompiling, unpacking .exe archive in Delphi

All programs compiled in Delphi have the following sections: CODE, DATA, BSS, .idata, tls, .rdata, .rsrc. The most important sections for decompilation are CODE and .rsrc. The article "Adding functionality to a Delphi program" provides some interesting facts about Delphi executable formats, as well as information about classes and DFM resources. There is one in this article interesting point under the heading: "How to add your own event handler to an already compiled file, for example, to change the text on a button."

Among the many types of resources that are stored in the .exe file, one of interest is RT_RCDATA, which stores information that was in the DFM file before broadcast. To extract DFM data from an .exe file, we can call the EnumResourceNames API function.

The art of decompiling has traditionally been the domain of craftsmen familiar with assembler and debuggers. Some Delphi decompilers give the impression that anyone, even with limited technical knowledge, can modify most Delphi executables at will.

4 Reply by PunBB

• From: Moscow, Sovkhoznay 3, apt. 98
• Registered: 2014.07.08
• Posts: 3,973
• Likes: 547

Re: Decompiling, unpacking .exe archive in Delphi

If you are interested in decompilation, then I offer you several Delphi decompilers:

DeDe
DeDe is a pretty fast program that allows you to analyze exe files compiled in Delphi. After decompilation, DeDe gives you the following:
- All dfm files. You will be able to open and edit them in Delphi
- All declared methods with well-commented assembly code with links to strings, imported functions, methods and components in the unit, Try-Except and Try-Finally blocks.
- Large quantity additional information.
- You can create a Delphi project folder with all dfm, pas, dpr files. Don't forget that pas files contain assembly code.

Revendepro
Revendepro finds almost all structures (classes, types, procedures, etc.) in a program, and generates their Pascal representation, the procedures will naturally be represented in assembly language. Unfortunately, the resulting assembly code cannot be recompiled. The source code of this decompiler is also available. Unfortunately, this decompiler is not entirely working - it generates an error during decompilation.

MRIP
Allows you to extract any resources from a Delphi application: cursors, icons, dfm files, pas files, etc. But its main feature is the ability to extract files stored in other files. More than 100 file formats are supported. MRip runs under DOS.

Exe2Dpr
This program can recover partially lost project sources. Has no interface and works with command line, for example: "exe2dpr [-o] exeFile" (project sources will be created in the current directory).

Resource Tuner is about the only tool you are likely to trust to modify resources in a PE executable. Discover unique properties this resource editor, including how to open problematic executables and edit hidden data that other editors simply can't see, wide range supported resource types, UPX unpacking, and much more. You will learn an industry standard program for translating and customizing user interfaces.

Resource tuner with a huge amount features that make it an essential tool for anyone setting up another program. Have fun personalizing any app to your unique taste. With the help of the powerful Resource Tuner, you no longer need to suffer with ugly default icons and pictures. Usage is very simple, just run the program and select the EXE or DLL file to read data from.

Once you try this, we think you will find it difficult to go back to another hacking tool resource.