You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Visual Basic can be compiled into binary or P-Code - bytecode for VB virtual machines. Add VBHeader parsing and dumping to fileinfo. Description.
How to do it:
When Visual Basic is detected, look at EP where should be push offset 0x????????. VBHeader should be at this offset. Some of its records are pointers to other structures (e.g. ProjectInfo).
Add detection of P-Code (aNativeCode == 0), tag the input as bytecode, warn users that decompiling this is not a good idea.
Visual Basic can be compiled into binary or P-Code - bytecode for VB virtual machines. Add VBHeader parsing and dumping to fileinfo. Description.
How to do it:
push offset 0x????????
. VBHeader should be at this offset. Some of its records are pointers to other structures (e.g.ProjectInfo
).aNativeCode == 0
), tag the input as bytecode, warn users that decompiling this is not a good idea.This might help: https://github.com/SekoiaLab/pe-tools
Also some pictures from IDA where these structures were defined and used:
The text was updated successfully, but these errors were encountered: