According to the README in https://github.com/bontchev/pcodedmp :

"As each VBA line is entered into the VBA editor, it is immediately compiled into p-code"

"when you open the source of a macro module in the VBA editor, what is displayed is not the decompressed source code but the p-code decompiled into source"

This means that there is a line-to-line correspondence between the p-code and the VBA source code that generates it.

Is there a tool that can take the dumped p-code and get the VBA source code that generated it?

So for example, the input would be something like

Line #0:
    FuncDefn (Private Sub Document_Open())
Line #1:
    LitStr 0x001D "This could have been a virus!"
    Ld vbOKOnly
    Ld vbInformation
    LitStr 0x0006 "Virus!"
    ArgsCall MsgBox 0x0003
Line #2:
    LitStr 0x0008 "calc.exe"
    ArgsCall Shell 0x0001
Line #3:

and output

Private Sub Document_Open()
    MsgBox "This could have been a virus!", vbOKOnly + vbInformation, "Virus!"
End Sub
  • How do you get p-code without source-code, except MS-Access Databases? For them have a look at everythingaccess mdeconversion. They can recover most of source code from ms-access p-code in compiled db's(.ADE, .ACCDE, . MDE) Commented Jun 15, 2019 at 5:10
  • You can get the p-code from documents containing macro's with the tool github.com/bontchev/pcodedmp However, you can only fetch the binary and not convert it back into the written source-code form
    – hyk
    Commented Jun 17, 2019 at 9:25
  • 1
    Did you try pcode2code? github.com/Big5-sec/pcode2code Commented Mar 1, 2021 at 4:05


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.