1

According to the README in https://github.com/bontchev/pcodedmp :

"As each VBA line is entered into the VBA editor, it is immediately compiled into p-code"

"when you open the source of a macro module in the VBA editor, what is displayed is not the decompressed source code but the p-code decompiled into source"

This means that there is a line-to-line correspondence between the p-code and the VBA source code that generates it.

Is there a tool that can take the dumped p-code and get the VBA source code that generated it?

So for example, the input would be something like

Line #0:
    FuncDefn (Private Sub Document_Open())
Line #1:
    LitStr 0x001D "This could have been a virus!"
    Ld vbOKOnly
    Ld vbInformation
    Add
    LitStr 0x0006 "Virus!"
    ArgsCall MsgBox 0x0003
Line #2:
    LitStr 0x0008 "calc.exe"
    Paren
    ArgsCall Shell 0x0001
Line #3:
    EndSub

and output

Private Sub Document_Open()
    MsgBox "This could have been a virus!", vbOKOnly + vbInformation, "Virus!"
    Shell("calc.exe")
End Sub
| improve this question | |
  • How do you get p-code without source-code, except MS-Access Databases? For them have a look at everythingaccess mdeconversion. They can recover most of source code from ms-access p-code in compiled db's(.ADE, .ACCDE, . MDE) – ComputerVersteher Jun 15 '19 at 5:10
  • You can get the p-code from documents containing macro's with the tool github.com/bontchev/pcodedmp However, you can only fetch the binary and not convert it back into the written source-code form – hyk Jun 17 '19 at 9:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.