According to the README in https://github.com/bontchev/pcodedmp :
"As each VBA line is entered into the VBA editor, it is immediately compiled into p-code"
"when you open the source of a macro module in the VBA editor, what is displayed is not the decompressed source code but the p-code decompiled into source"
This means that there is a line-to-line correspondence between the p-code and the VBA source code that generates it.
Is there a tool that can take the dumped p-code and get the VBA source code that generated it?
So for example, the input would be something like
Line #0: FuncDefn (Private Sub Document_Open()) Line #1: LitStr 0x001D "This could have been a virus!" Ld vbOKOnly Ld vbInformation Add LitStr 0x0006 "Virus!" ArgsCall MsgBox 0x0003 Line #2: LitStr 0x0008 "calc.exe" Paren ArgsCall Shell 0x0001 Line #3: EndSub
Private Sub Document_Open() MsgBox "This could have been a virus!", vbOKOnly + vbInformation, "Virus!" Shell("calc.exe") End Sub