Delphi tool—decompile Delphi (3)

Section 3 Delphi decompilation tool

Reverse engineering has always been considered an art reserved for technical wizards, requiring familiarity with assembly language and debuggers. The following Delphi decompilers allow anyone to decompile most Delphi executables, even with limited technical knowledge.

If you are interested in reverse engineering Delphi programs, I suggest you take a look at the following "decompilers":

DeDe

DeDe is a very fast program for analyzing Delphi compiled executable files. After decompilation, DeDe will provide the following information:

• All target dfm files. You can open and edit them with Delphi;
• All published methods with well-commented ASM code, which involves strings, input function calls, class method calls, unit components, Try-Except and Try-Finally blocks. By default, DeDe only gets the source code of published methods, but you can also process other procedures in the executable if you know the RVA offset by using the Tools | Disassemble PRoc menu.
• Lots of additional information.
• You can create a Delphi project folder with all dfm, pas, and dpr files. Note: The pas file contains the well-commented ASM code mentioned above. They cannot be recompiled!

Revendepro

Revendepro can find almost all structures in the program (classes, types, procedures, etc.) and generate pascal expressions, and the procedures are written in the form of assemblers. Due to certain limitations of the assembler, the generated results cannot be compiled. The source code of this decompiler is freely available. Unfortunately, this is the only decompiler I can't use - I get an exception when trying to decompile certain Delphi executables with it.

MRip

This purpose-built file splitter can find and extract files from other files. MRIP splits over 100 file formats. The most important thing for us is that MRipper can decompile any Delphi executable. This tool can extract all resources from Delphi applications: cursors (cursors), icons (icons), dfm files, pas files and other resources. The pas file does not contain event procedure execution. MRIP is a DOS tool.

DfmExplorer

Here is the description of DfmExplorer (including source material):

• Load executable modules (EXE/DLL/BPL/DPL) in memory by calling the "LoadLibrary" or "LoadLibraryEx" function of the Win32 API.
• Find RCDATA resources through the "EnumResourceName" function of the Win32 API.
• Load each found DFM block, decode it and store it in memory as a table (including their names).
• In the main window of the program we can visualize in text format all DFMs of all loaded executable files.
• Finally, the program can be saved to a disk of DFM's choice, as an ASCII file (.RC) or as a binary block (DAT) concatenated into an executable file.

Exe2Dpr

If you are trying to loosen your project source code, this Delphi project source code rescuer can rescue the missing source code parts. The rescuer generates all project forms and data modules with assigned properties and events. The generated event procedure does not have a main program (it is not a decompiler), but is at the code address in the executable file. This tool has no GUI - it uses the command line form: 'exe2dpr [-o] exeFile'. The project source code is created in the current directory. If you want to overwrite any existing files in the current directory, use option '-o'.