According to the README in https://github.com/bontchev/pcodedmp :

"As each VBA line is entered into the VBA editor, it is immediately compiled into p-code"

"when you open the source of a macro module in the VBA editor, what is displayed is not the decompressed source code but the p-code decompiled into source"

This means that there is a line-to-line correspondence between the p-code and the VBA source code that generates it.

Is there a tool that can take the dumped p-code and get the VBA source code that generated it?

So for example, the input would be something like

Line #0:
    FuncDefn (Private Sub Document_Open())
Line #1:
    LitStr 0x001D "This could have been a virus!"
    Ld vbOKOnly
    Ld vbInformation
    LitStr 0x0006 "Virus!"
    ArgsCall MsgBox 0x0003
Line #2:
    LitStr 0x0008 "calc.exe"
    ArgsCall Shell 0x0001
Line #3:

and output

Private Sub Document_Open()
    MsgBox "This could have been a virus!", vbOKOnly + vbInformation, "Virus!"
End Sub

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.