46
Page | 2
© Decompiler-VB.net – VBReFormer User Manual
2
User Manual
I.
Overview
VBReFormer : Decompiler or not decompiler ?
VBReFormer is the most advanced publically available software in Visual Basic 5 & 6 decompilation
technology.
A.
Design recovery
First, it allows you to recover the design of each form and control, with all properties, values, all
reference to external controls (OCX files), and all pictures. Then with VBReFormer you can obtain
the necessary information to re-write the graphical design of your application without executable
Visual Basic code...
Design recovery means recovery of information about the user interface structure of the
executable you want to analyze. These informations could be size of forms and controls, position
of controls, texts, colors, pictures, name of controls, type of controls, captions, and all others
properties.
B.
Design edition
With VBReFormer it's now possible to edit the design properties easily, as with other resource
editors which could edit the design of non-VB executables, working directly on your binary (to
translate your application into another language for example). The string properties aren't
limited in size because VBReFormer includes an engine which integrally recreates the binary code
that holds the form design information.
VBReFormer also allows to add unused properties to an existing control in the executable. An
unused property is a property which kept it default value after the compilation. The Visual Basic
compilator doesn’t include unused properties of a control into the executable, so the possibilities
of change one of these unused properties wasn’t possible with classical editors. But now
VBReFormer allows the possibility of adding these unused properties for each controls.
For example, even if a « ForeColor » properties of the controls named « Label1 » have been let to
it default value, then you can change it.
C.
Code recovery
VBReFormer is able to disassemble all the forms and all controls in your application (if it was
compiled with the native code option), recover all subroutines, runtime and API calls.
The disassemblage is a complex process which allows to translates machine language in the
executable into assembly language, formatted for human-readability , performing the inverse
operation to that of an assembler.
After the disassemblage, VBReFormer attempts a native decompilation of basic code, without
warranty of success because it's an experimental decompilation process. VBReFormer can only
recover about 3% of the basic code in the most favorable cases.
Note: VBReFormer is unable to disassemble and attempt decompilation if the executable is
compiled to « PCode » mode because of the rarity of these executable (default mode is
« native »).
63
Page | 3
© Decompiler-VB.net – VBReFormer User Manual
3
User Manual
D.
Feature
Operating System: Microsoft Windows XP, 2000, Me, 98, NT
Supported format for header informations : all Windows 32 bits executables
(PE format)
Supported format for Visual Basic analyze: « exe », « ocx » and « dll » files
compiled with Microsoft Visual Basic 5 & Microsoft Visual Basic 6.
Shows executable headers informations (EXE Header, PE Header, Optional
Header, and Section Header)
Shows import table
Recovers project file « vbp »
Recovers GUI files (« frm »; « ctl »; « pag » ; « dsr »)
Identifies externals components : ActiveX™ technology
Recovers resources GUI files (« frx » ; « ctx » ; « pgx »)
Allows to edit properties of objects and save them to the executable (with no size limitation
for string properties)
Allows to add an unused property for an object and save it directly to the executable
Allows to change the resources user interface pictures (« Picture » property for example)
Identifies procedures from Sub Main(), Forms, Classes, Usercontrols, PropertyPages, and
UserDocuments *
Disassembles these procedures (machine language into assembly language) *
Allows to patch the disassembly code (to fix a bug or to update the executable for example) *
A pre-decompiling engine analyze the disassembled code *
Recovers the Runtime Calls *
Recovers the API declarations *
Recovers of some Visual Basic code (attempt to decompile; « MsgBox » for example) *
Syntax coloration of recovered code (assembly and Visual Basic code).
Free support for any problem with setup, and using VBReFormer
Free update of VBReFormer
*Only executable compiled with « native » mode.
E.
Conclusion
VBReFormer tries to decompile only a few parts of the basic code. It's an experimental
decompiler and it's being updated often. So, we can consider VBReFormer to be a half-
decompiler for visual basic applications, but not as a full decompiler
. For any complete
decompilation, contact us partner Decompiler.org.
49
Page | 4
© Decompiler-VB.net – VBReFormer User Manual
4
User Manual
II.
User interface environment
A.
Menu Bar
The menu bar is a fast mean to access all the V ReFormer’s functions. There is two menus : « File »
menu, which allows to access the files related functions, « Tools » menu, which allows to call the
additional tools of VBReFormer.
1.
« File » menu :
a.
« Open »:
Click here to open the executable / libraries / screensaver
or ActiveX control you want to analyze with VBReFormer.
b.
« Save binary as … »:
Allows to save the changes directly into the binary
executable. This menu is only activated after a change in
the executable.
c.
« Save project as … »:
Allows to save the project, forms, usercontrols, classes,
propertypages to a Visual Basic project which can be open
into Microsoft Visual Basic 5 or 6.
d.
« Save picture as … »:
This submenu is only activated when you are browsing a
picture into the Visual Basic resources of the executable. It
allows to save or extract the browsed picture into a
picture format.
e.
« Language »:
Here you can choose a language for VBReFormer. The
main languages are French and English, but a translator file allows to add news
languages. VBReFormer is also partially
translated into the following languages:
“Deutsh”, “Italiano”, “Español” and “Česko”.
f.
« Recent document list (1;2;3;4) »:
Here is a list of the last four recent executables you opened with VBReFormer.
g.
« Exit »:
Click here to close VBReFormer.
A. Menu Bar
B. Tool Bar
C. Debug Box
49
Page | 5
© Decompiler-VB.net – VBReFormer User Manual
5
User Manual
2.
« Tools » menu:
a.
« Search for imported libraries… »:
Show a tool which allows to list the needed libraries
(*.ocx; *.dll; *.tlb; etc.) for an executable.
b.
« Search for VB programs »:
Show a tools which allows to search the Visual Basic 5
and/or Visual Basic 6 executables in your computer.
c.
« Library explorer »:
Show a tools which allows to explore the members of an
ActiveX library.
d.
« Patch »:
Show the tools that allows to patch the assembly code. That sub-menu is enabled
only if you are browsing an assembly with VBReFormer.
e.
« Options - preferences »:
Show the options/preferences box.
3.
« Help » menu:
a.
« About… »:
B.
ToolBar
The toolbar is a second fast mean to access to V ReFormer’s functions.
1.
« Tools » toolbar :
« Search for imported libraries… »
« Search for VB programs »
« Library explorer »
2.
« File » toolbar :
« Open »
« Save binary as … »
« Save project as … »
« Save picture as … »
3.
« Search » toolbar (only available on VBReFormer 5) :
This toolbar, only available on VBReFormer 5, will allows to search text on the current
project.
A. Tools
B. File
9
Page | 6
© Decompiler-VB.net – VBReFormer User Manual
6
User Manual
C.
Debug Bar and Debug Box
That debug bar allows to load the debug box which allows to check the analyzing of the file in
order to detect problems at analysis. If there is problem disassembling of a file, please copy the
text in debug box and sent it at contact@decompiler-vb.net for solving and fixing the problem.
24
Page | 7
© Decompiler-VB.net – VBReFormer User Manual
7
User Manual
III.
Project Interface
That interface is shown after loading a new project and allows to navigate into the executable
project (disassembly, resources, GUI code, properties, and libraries of the analyzed
executable).
A.
Executable Tree View
That tree view list the internal EXE structure (PE informations, Import Table, and headers) and
the internal VB structure of the executable (project information, forms informations, assemblies,
etc).
1.
« Executable Informations » node :
This node lists all the internal EXE structure for executable with PE (Portable Executable)
format. That includes « EXE Header », « Coff Header », « Optional Header » and the « Data
Directories » of « Optional Header », « Section Header », and the « Import Table » which
shows the external API libraries called in the executable.
This node only shows a kind of Information panel called « Data Informations »: an
information panel which shows the related information of « Executable Informations » node.
A. Executable Tree View
B. Panel Information
28
Page | 8
© Decompiler-VB.net – VBReFormer User Manual
8
User Manual
2.
« Visual Basic Informations » node :
This node lists all the internal VB structure for executable. This node is only visible if the
opened executable is a VB executable.
a.
« <Name of project> (Project) » node:
The first child of this node « <Name of project> (Project) » represents the « <Name
of project>.vbp » file, and shows the content of this file into the « Visual Basic
Code » panel:
b.
« Graphical User Interface » node:
This second child represents the GUI contents. What is GUI contents ? GUI contents
is the static information (properties of Forms, Usercontrols, Userdocuments, etc).
That node shows the GUI contents into the « Visual Basic Code » panel and list the
properties into « Object Properties » panel.
The « Visual Basic Code » panel allows you to view the GUI code content and to modify the STRING
script, for example “Form1”.
The « Object Properties » panel allows you to view the properties of each controls and to modify
existing properties or add unused properties.
c.
« Source Code » node:
This node list all the components (forms, usercontrols, classes, etc.) executable code
in assembly language. That node shows the procedures members, and their names
(for public procedures).
9
Page | 9
© Decompiler-VB.net – VBReFormer User Manual
9
User Manual
d.
« Visual Basic Resources » node:
This node list all the components Visual Basic resources (image used, multiline text)
from FRX, CTX, PGX files.
Image resource can be exported or replaced by another image file.
62
Page | 10
© Decompiler-VB.net – VBReFormer User Manual
10
User Manual
IV.
Visual Basic Code
VBReFormer provide an access to all the VB internal structure of an executable compiled with
Microsoft Visual Basic compiler. These information are in text format. Here some sample of these
codes.
A.
Sample of Project code:
Type=Exe
Reference=*\G{8B217740-717D-11CE-AB5B-
D41203C10000}#1.0#0#C:\WINDOWS\system32\TLBINF32.DLL#TypeLib Information
Reference=*\G{00020430-0000-0000-C000-
000000000046}#2.0#0#C:\WINDOWS\system32\stdole2.tlb#OLE Automation
Object={831FDD16-0C5C-11D2-A9FC-0000F8754DA1}#2.0#0; C:\WINDOWS\system32\MSCOMCTL.OCX
Object={3B7C8863-D78F-101B-B9B5-04021C009402}#1.2#0; C:\WINDOWS\system32\RICHTX32.OCX
Object={BDC217C8-ED16-11CD-956C-0000C04E4C0A}#1.1#0; C:\WINDOWS\system32\TABCTL32.OCX
Object={F9043C88-F6F2-101A-A3C9-08002B2F49FB}#1.2#0; C:\WINDOWS\system32\COMDLG32.OCX
Object={5E9E78A0-531B-11CF-91F6-C2863C385E30}#1.0#0; C:\WINDOWS\system32\MSFLXGRD.OCX
Object={86CF1D34-0C5F-11D2-A9FC-0000F8754DA1}#2.0#0; C:\WINDOWS\system32\MSCOMCT2.OCX
Object={248DD890-BB45-11CF-9ABC-0080C7E7B78D}#1.0#0; C:\WINDOWS\system32\MSWINSCK.OCX
Form=SocketWarning.frm
Module=mdlGraphic; mdlGraphic.bas
Form=frmWebcam.frm
Startup="SocketWarning"
Name="Client"
Title="Projet1"
Description=""
HelpFile=""
HelpContextID="0"
ExeName32="ControlPad2"
CompilationType="0"
StartMode=0
RequireLicenseKey=0
Unattended=0
Retained=0
ThreadPerObject=0
MaxNumberOfThreads=1
OptimizationType=0
FavorPentiumPro(tm)=0
CodeViewDebugInfo=0
NoAliasing=0
BoundsCheck=0
OverflowCheck=0
FlPointCheck=0
FDIVCheck=0
UnroundedFP=0
In this sample we can see all informations which can be restored. V ReFormer …
determines the type of project.
identifies all the files used in the project and creates filenames for them as the original
filenames are not present in the compiled program.
recovers the filenames of custom controls and uses a look-up table to recreate the full
entry for the « .vbp ».
determines the startup mode of the program.
identifies whether p-code or native compilation was used.
Documents you may be interested
Documents you may be interested
