リソース
ブログ
Visual Basic 6 アプリケーションの逆コンパイル、コード再構築、保守に関する技術記事。
DarkCloud: how Malva.RE extracts a VB6 stealer's configuration with VBReFormer
Malva.RE has integrated VBReFormer Gen2 to decompile VB5/VB6 malware. A worked case on DarkCloud 4.9: from native x86 PE to rebuilt sources and on to the SMTP configuration, without ever running the sample.
VBReFormer now opens UPX-packed VB5/VB6 executables, without ever running them
VBReFormer Gen2 unpacks UPX-packed VB5/VB6 binaries on opening, without running them, and rebuilds the original PE structure: 186 binaries measured, 0 failures, a project identical to the original's.
Legacy vs V7 — what the measurement gave
We ran both of our decompilers over the same binaries, then held their output against the original VB6 source. Here is everything the measurement gave, with recompilation updated on 25 October 2026: 154 projects out of 154.
VBReFormer Online enters beta: your VB6 project, with nothing to install
VBReFormer Online enters beta: drop a VB5/VB6 executable in your browser and walk away with a .vbp project. The free tier goes far — full disassembly, full P-code, designer, resources.
VBReFormer V7 — ten years of research, an engine rewritten from scratch
VBReFormer V7: engine rewritten in .NET, abstract interpretation of native code, full P-code at the same level, 3,849 automated tests and 119 of the 149 bench projects recompiling in VB6.
VB6 application support: what actually breaks, and what does not
The application still runs after twenty years, and that is not luck: Microsoft supports the runtime for the lifetime of every Windows release. What gives way is elsewhere — and it is almost never the language.
A history of Visual Basic decompilers, from VBDis to today
Thirty years of Visual Basic reverse engineering tooling: the twelve known tools, their authors, their dates, and the community that documented a format Microsoft never published.
A history of Visual Basic: how Ruby and Embedded Basic merged in 1991
Visual Basic is the assembly of two unrelated projects: a form generator bought from Alan Cooper and a Basic engine written for a database. Their marriage was decided by a Bill Gates memo in August 1989 — and the seam is still legible in the executables.
VB6 decompiler or disassembler: which one do you need?
A disassembler shows you the instructions; a decompiler tries to reconstruct the source. Both outputs on the same procedure, and how to choose according to what you are trying to obtain.
From P-Code to MSIL: the history of Visual Basic told through its binaries
Visual Basic produced three binary formats in thirty years. Each decides what decompilation can give back — and explains why reading a .NET assembly is free while rebuilding a VB6 executable is not.
Analysing VB6 malware: our partnership with Malva.RE
Malva.RE uses VBReFormer to decompile malicious Visual Basic 6 binaries. Why native VB6 code remains a blind spot for modern tooling, and what decompilation actually changes for an analyst.
Free and open-source .NET decompilers: which one to use
VBReFormer handles Visual Basic 5 and 6, not .NET. If you need to decompile a .NET assembly, these are the tools that do it — all free, most of them open source.
Why malware campaigns keep coming back to Visual Basic 6
A 1998 language at the heart of 2025 attacks: Visual Basic 6 is enjoying an unexpected second life among malware authors. A look at the technical reasons and the recent campaigns.
Running a VB6 application on Windows 10 and 11
Good news: the Visual Basic 6 runtime is still supported on Windows 10 and 11. Here's what works, what breaks, and what to do when an application refuses to start.
Migrating a VB6 application to .NET: where to start
Modernizing a Visual Basic 6 application to .NET is a project in its own right. Here are the key steps, the classic pitfalls, and the role decompilation plays when the source code is missing.
Lost VB6 source code: how to recover it from the executable
The developer has left, the server was reinstalled, the backup is corrupt — but the application still runs. What exactly comes back from the .exe alone, and what does not.
Decompile P-Code or native code: what your VB6 binary gives back
A VB6 executable was compiled one of two ways, and what decompilation yields depends entirely on which. The mode is written in the file, and each gives back something different.
Case study: decompiling a VB6 CrackMe to understand its algorithm
A hands-on reverse engineering exercise: how decompiling a Visual Basic 6 binary reveals the logic behind its validation key.
Modifying a compiled Visual Basic 6 application without the source code
Changing a label, an image or an interface property directly inside a VB6 executable, without ever having the original source files. Why it works, and where the boundary lies.