Manual contents · PDF manual

Quick start

Open a supported Win32 or Win64 VCL application written in Delphi or built with C++Builder. Inspect the recovered project structure and compare code with native instructions. High-level code decompilation, AI Helper and the HEX Editor require a commercial license; Free Lite provides form inspection, native disassembly and string references.

  1. Select File > Open program and choose the binary to examine. Let DE Decompiler finish its initial processing.
  2. Expand Code in the project tree. Select a unit to examine its recovered declarations, then select a class or procedure.
  3. Compare Decompiler and Disassembler. Use HEX Editor when an address or instruction needs to be checked against the file bytes.
  4. Expand Forms, select a recovered form, and open Designer (read only). Inspect its controls and properties, and use recovered event entries to open the corresponding handler code.
  5. Use Ctrl+T to find a procedure, Ctrl+F to search displayed text, and Tools > String references to investigate recognized string literals.
  6. Save an analysis database through File > Data Base when you need to return to the analysis later.

Saving recovered material

Use File > Save decompiled project to export a recovered Delphi project, or File > Save all in one module for a combined .pas listing. Before opening recovered code in an IDE, manually correct decompilation inaccuracies and incompatibilities and provide missing dependencies. Keep an unmodified copy of the analyzed binary with your investigation material.

Choosing a processing mode

Fast decompilation processes individual procedures when you open them. Enable Analyze prototypes for preliminary analysis of procedure signatures. Before searching all high-level text, disable Fast decompilation and process the file again. Project and combined-listing exports process procedures as needed; review their completion messages. See Processing modes and caching.

A useful first check

Start with a known form and one event-related method or public function. Check the recovered declarations, follow the code, and compare a few statements with disassembly. This establishes how much useful structure DE Decompiler has recognized in that particular build.