2

I have to reverse-engineer a VB P-CODE mode program. I had the program's P-CODE, but I don't know what it means. For example:

Proc: 421840
421100: 04 FLdRfVar                local_0098
421103: 04 FLdRfVar                local_0094
421106: 05 ImpAdLdRf:              435aec
421109: 24 NewIfNullPr             408868
42110C: 0d VCallHresult            CVBApplication::get_

I have to find the tools to reverse a program.I want to know what the P-CODE means.Thanks

|improve this question
  • 1
    google first hit says p-code means packed-code en.wikipedia.org/wiki/Microsoft_P-Code supposed to be executed by a visual basic virtual machine (msvbvmXXX.dll abandoned after vb6 in favour of clr and .net and a hunch search yields several decompiers for that code like p32dasm , vb-decompiler etc – blabb Apr 22 '15 at 8:15
4

Here are the two best free and available resources about Microsoft's VB P-Code. First one, the list of opcodes (here). Second one, a 12 pages document written by Alex Ionescu on how to decompile and analyze VB binaries (here).

|improve this answer
2

VB Decompiler Pro decompiles VB P-Code to Visual Basic code. See below for an example of the decompilation output:

Decompilation

Alternatively, if you're looking for help in analyzing the raw P-Code itself, you can check out the following links in addition to the links that yaspr posted:

|improve this answer
0

In addition to the Alex Ionescu paper, there's also a useful 27-page paper, VISUAL BASIC REVERSED - A decompiling approach by Andrea Geddon.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.