Visual Basic decompilation is a narrow field, documented by a handful of people over some thirty years. Microsoft never published the internal structure of the executables its VB compilers produced; everything known about the format was established by reverse engineering and then pooled on forums that have since disappeared. This article lists the tools, their authors and their dates.
1994: VBDis, the first Visual Basic decompiler
Hans-Peter Diettrich, a German developer known by the pseudonym DoDi, had been reverse engineering since 1986: first on the Atari ST, then on Amiga and HP-UX, where he wrote disassemblers and C decompilers.
In 1994 he established that executables produced by Visual Basic 3 retained enough information to rebuild the project, and published VBDis3. VBDis4 and VBDis5 followed, far less complete, the format having changed in the meantime. The journalist Tim Anderson, who used the tool on a real case, notes that the code comes back but that variable names are "mangled" and their purpose has to be guessed.
The tool met a particular fate: it was itself decompiled, then ported to VB6 by a third party.
1997: the technical break of Visual Basic 5
Up to Visual Basic 4, the compiler produced only one kind of output: P-Code, run by a virtual machine shipped with the application. Visual Basic 5 added a second target, compilation to x86 machine code, handled by the Visual C++ optimising compiler. That fork split the field into two lasting and distinct problems.
P-Code target
A bytecode in which each instruction maps to a language operation. Reconstruction is largely mechanical.
The only target available up to VB4, then a minority option, native becoming the default setting.
Native code target
Optimised x86: instructions reordered, constants propagated, types not declared.
The format of most applications actually shipped from VB5 onwards.
That distinction governs everything else in the field. It is covered in detail in from P-Code to MSIL and in what a binary gives back depending on its compilation mode.
Two families of tools
The tooling divides into two approaches, rarely combined.
Static analysis
- Reads the file without running it
- Rebuilds project, forms, controls, procedures
- VBDis, VBReFormer, VB RezQ, P32Dasm, Semi VB Decompiler, vbdec
- Limit: whatever the compiler discarded is gone
Dynamic analysis
- Observes the program while it runs
- Hooks the runtime's handlers, traces calls
- WKTVBDE, NuMega SmartCheck, vb6tracer
- Limit: returns no source code, and assumes a runnable binary
The 2000s: knowledge held in common
The VB6 format being documented nowhere, its description was reconstructed collectively. The main gathering point was the forum decompiler.theautomaters.com, now retired: project description structures, the P-Code opcode table and COM object memory layouts were traded there freely. The contributors credited by the tools of the period are Sarge, Napalm, Mr. Unleaded, Moogman, _aLfa_, Alex Ionescu, Brad Martinez and Warning (Sylvain Bruyere).
Part of that work was published as articles, which make up the field's reference literature.
| Author | Publication |
|---|---|
| Alex Ionescu | Visual Basic Image Internal Structure Format |
| Andrea Geddon | Visual Basic Reversed — A decompiling approach |
| John Chamberlain | Microsoft's P-Code Implementation (2001) |
| Richard Marko (Eset) | VB Wearing the Inside Out (2002) |
| Mr Silver | VB P-code Information |
| Sanchit Karve | Disassembling Visual Basic Applications, I and II |
| Reginald Wong | IDA script for VB6 (vb.idc) |
| Jurriaan Bremer, Marion Marschalek | VB6 Tracer presentation |
The tools
VBReFormer was written from 1999 by Sylvain Bruyere, then still at secondary school, under the pseudonym Warning; the first licence was sold in 2000 or 2001. By October 2002 the tool was at version 3.1 and downloadable from a page hosted on Lycos under the name HexOrciser, alongside VBEditor by Hexman. It did one thing at that stage: recreate the visual side of a project — forms, controls, interface. The site later moved through decompiler-vb.tk before its current domain.
| Tool and author | Origin | Known activity | Approach | Status |
|---|---|---|---|---|
| VBDis 3, 4, 5 Hans-Peter Diettrich (DoDi) | Germany | 1994 → early 2000s | Static — VB1, VB2 and VB3; VBDis4 and VBDis5 far less complete | Discontinued |
| NuMega SmartCheck NuMega | United States | October 1997 | Dynamic — runtime debugging, shipped in DevPartner Studio | Abandoned |
| VBReFormer Warning (Sylvain Bruyere) | France | 1999 → V6, V7 announced | Static — VB5 and VB6, P-Code and native | ActiveMaintainedSupportV7 soon |
| Semi VB Decompiler vbgamer45 | — | 2004 → 2.0, June 2026 | Static — P-Code, native, .NET | ActiveMaintainedOpen source |
DotFix Software | Russia | 2005 → 2026 | Static — P-Code and native | ActiveMaintainedCommercial |
| P32Dasm | — | 2000s → 2.8, March 2016 | Static — P-Code, VB5 and VB6 | Discontinued |
| VB RezQ | — | 2001 → 3.3 | Static — project skeleton, VB4/32 to VB6 | Discontinued |
| WKTVBDE Mr Silver, Mr Snow | — | 2000s → 4.3 | Dynamic — P-Code debugger | Discontinued |
| RACEVB6 | — | 2000s | Static | Discontinued |
| vbdec David Zimmer (sandsprite) | — | — | Static and dynamic — format, P-Code, debugger | ActiveFree |
| vb6tracer Jurriaan Bremer, Marion Marschalek | — | 2010s | Dynamic — tracing | Published |
Chronology
Durations first: who lasted, and for how long. Only three tools span more than twenty years with no documented interruption.
Solid: documented period. Gradient: imprecise or unknown boundary — unknown start for P32Dasm, imprecise end for VBDis, unknown end for VB RezQ. WKTVBDE, RACEVB6, vbdec and vb6tracer have no usable date and do not appear here.
And the milestones, tool by tool.
The state of the field in 2026
Of the eleven tools listed, four are still developed or available: VBReFormer, Semi VB Decompiler, and vbdec. The others stopped, the last of them in 2016. The founding forum has gone, and part of the literature now exists only in archives.
The format itself has not changed since 1998: a VB6 executable compiled today would have the same structure as in 1998, and the runtime library remains supported by Microsoft for the support lifetime of each version of Windows. Knowledge accumulated about that format therefore does not expire.
VBReFormer's coverage is published function by function and instruction by instruction, with its denominators: 1,153 documented correspondences. The free edition indicates within seconds which format a binary belongs to and what it holds.