Dede: Delphi Decompiler

This is an interesting tools i've got from my partner in Surabaya. An application used to decompile executable files created from Delphi. I've been so long waiting for this since it has special feature that never exist yet from others previous similar tools.

So,what is the special feature? Dede can completely rebuild the projects (DPR), forms (DFM) & units (PAS) files from an existing uncompressed EXE. The previous tools named ExeScope & ResHacker doing only retrieving the DFM meta informations.

I've tried to rebuild all of this from a sample i made from Delphi. It consist of a single form named Test & a unit files named UUtama.pas. I compiled until it created an executable Test.exe file. Then, i open this executable from Dede:

Click to enlarge...

Next, i tried saved to Delphi projects space:

Click to enlarge...

Then below is the result:



I re-open the DPR files over Delphi & this below is the result pasted from the editor:

{This file is generated by DeDe Ver 2.43 Copyright (c) 1999-2000 DaFixer}
Project Test;
Uses
UUtama in 'UUtama.pas' {TForm1};
{$R *.RES}
begin
{
0044DD9C 55 push ebp
0044DD9D 8BEC mov ebp, esp
0044DD9F 83C4F0 add esp, -$10
0044DDA2 B82CDC4400 mov eax, $0044DC2C
|
0044DDA7 E8B887FBFF call 00406564
}
end.
Analyzed by your self & you might be see something ;-). Anyway, by now, you - as the Delphi programmer - should be carefull to secure your public released projects since this application could crack something over your current application.

Sincerelly,

Eko Wahyudiharto
PS: If you've benefit from this blog,
you can support it by making a small contribution.

Enter your email address:

Delivered by FeedBurner

Post a Comment Bookmark and Share

 

  1. Anonymous Anonymous said,

    Tuesday, March 11, 2008 8:13:00 AM

    So WHERE does one find this decompiler?!???

  2. Anonymous Anonymous said,

    Thursday, May 01, 2008 2:51:00 PM

    http://www.softpedia.com/get/Programming/Debuggers-Decompilers-Dissasemblers/DeDe.shtml

    It’s a good program. I plan on using it to decompile "patch.exe" from netbus 1.7 and remake the code unique...for...some...reason
    (shifty eyes)

    -Oblivion

  3. Anonymous PWDhunter said,

    Wednesday, May 27, 2009 6:37:00 PM

    Nice Job ;)

  4. Anonymous Anonymous said,

    Thursday, November 05, 2009 1:52:00 AM

    -Oblivion

    You have no clue what you're doing. You might want to check out hex editors and even if you did get that old thing to not be detected you would have to test it to see if the executable even works. Because it probably wouldn't. Reason being there could be multiple sigs and with such a small .exe I really doubt you can change any of the code because it is all needed for it to work. AV writers are not dumb, they know how to reverse too. Good luck newbs

  5. Blogger Administrator said,

    Wednesday, October 10, 2012 9:02:00 PM

    Unfortunately this work only for not encrypted files, otherwise use another tool to decrypt

    http://exolink.blogspot.de

Post a Comment

Leave comments here...