Dede: Delphi Decompiler
This is an interesting tools i've got from my partner in Surabaya. An application used to decompile executable files created from Delphi. I've been so long waiting for this since it has special feature that never exist yet from others previous similar tools.
So,what is the special feature? Dede can completely rebuild the projects (DPR), forms (DFM) & units (PAS) files from an existing uncompressed EXE. The previous tools named ExeScope & ResHacker doing only retrieving the DFM meta informations.
I've tried to rebuild all of this from a sample i made from Delphi. It consist of a single form named Test & a unit files named UUtama.pas. I compiled until it created an executable Test.exe file. Then, i open this executable from Dede:
Next, i tried saved to Delphi projects space:
Then below is the result:
I re-open the DPR files over Delphi & this below is the result pasted from the editor:
So,what is the special feature? Dede can completely rebuild the projects (DPR), forms (DFM) & units (PAS) files from an existing uncompressed EXE. The previous tools named ExeScope & ResHacker doing only retrieving the DFM meta informations.
I've tried to rebuild all of this from a sample i made from Delphi. It consist of a single form named Test & a unit files named UUtama.pas. I compiled until it created an executable Test.exe file. Then, i open this executable from Dede:
Next, i tried saved to Delphi projects space:
Then below is the result:
I re-open the DPR files over Delphi & this below is the result pasted from the editor:
Analyzed by your self & you might be see something ;-). Anyway, by now, you - as the Delphi programmer - should be carefull to secure your public released projects since this application could crack something over your current application.
{This file is generated by DeDe Ver 2.43 Copyright (c) 1999-2000 DaFixer}
Project Test;
Uses
UUtama in 'UUtama.pas' {TForm1};
{$R *.RES}
begin
{
0044DD9C 55 push ebp
0044DD9D 8BEC mov ebp, esp
0044DD9F 83C4F0 add esp, -$10
0044DDA2 B82CDC4400 mov eax, $0044DC2C
|
0044DDA7 E8B887FBFF call 00406564
}
end.
| PS: If you've benefit from this blog, you can support it by making a small contribution. |
Tuesday, March 11, 2008 8:13:00 AM
So WHERE does one find this decompiler?!???
Thursday, May 01, 2008 2:51:00 PM
http://www.softpedia.com/get/Programming/Debuggers-Decompilers-Dissasemblers/DeDe.shtml
It’s a good program. I plan on using it to decompile "patch.exe" from netbus 1.7 and remake the code unique...for...some...reason
(shifty eyes)
-Oblivion
Wednesday, May 27, 2009 6:37:00 PM
Nice Job ;)
Thursday, November 05, 2009 1:52:00 AM
-Oblivion
You have no clue what you're doing. You might want to check out hex editors and even if you did get that old thing to not be detected you would have to test it to see if the executable even works. Because it probably wouldn't. Reason being there could be multiple sigs and with such a small .exe I really doubt you can change any of the code because it is all needed for it to work. AV writers are not dumb, they know how to reverse too. Good luck newbs
Wednesday, October 10, 2012 9:02:00 PM
Unfortunately this work only for not encrypted files, otherwise use another tool to decrypt
http://exolink.blogspot.de