p-code is the intermediate code that was used in Visual Basic (before .NET). I would like to know where I can find resources/tools related to analysis of these virtual machine codes.
-
about P32Dasm , on their page, they mention "IDA Visual Basic debugger plugin" for debugging with IDA , but this plugin is impossible to find... does anyone know about this?– George DimaCommented Aug 25, 2013 at 13:49
-
Here's an old RE-Reddit thread asking a similar question reddit.com/r/ReverseEngineering/comments/djhb7/…– alexanderhCommented Aug 29, 2013 at 23:20
Add a comment
|
3 Answers
Alex Ionescu, co-author of the latest "Windows Internals" book and contributor to ReactOS, wrote a good paper on the topic of VB decompilation quite a while ago. Here the direct link to the PDF (originally from http://www.alex-ionescu.com/vb.pdf).
The paper documents the structures and constants of the file format itself and probably goes a long way in accompanying the information on the opcode list from the other answer.
answered Apr 5, 2013 at 11:43
They are some tools can be useful in reversing p-code binary
vb-decompiler lite (free ver): very good decompiler can be download from vb-decompiler official site
P32Dasm: another p-code decompiler see here and see below of page how they debug p-code with IDA
WKTVBDE: p-code debugger, I don't work with it but good to try, to download search tuts4you.com site
A very comprehensive resource on the p-code was on the site of vb vb-decompiler. Luckily there is a backup in the wayback machine, link here.
