{
	"id": "f00adac9-03ff-46b0-a4c1-81fd57ba5305",
	"created_at": "2026-04-06T03:36:53.527237Z",
	"updated_at": "2026-04-10T13:13:01.997475Z",
	"deleted_at": null,
	"sha1_hash": "a5f2b89a2bffc3c16301167b2e5a532e77897874",
	"title": "GitHub - bontchev/pcodedmp: A VBA p-code disassembler",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 87356,
	"plain_text": "GitHub - bontchev/pcodedmp: A VBA p-code disassembler\r\nBy bontchev\r\nArchived: 2026-04-06 03:23:26 UTC\r\nIntroduction\r\nIt is not widely known, but macros written in VBA (Visual Basic for Applications; the macro programming\r\nlanguage used in Microsoft Office) exist in three different executable forms, each of which can be what is actually\r\nexecuted at run time, depending on the circumstances. These forms are:\r\nSource code. The original source code of the macro module is compressed and stored at the end of the\r\nmodule stream. This makes it relatively easy to locate and extract and most free DFIR tools for macro\r\nanalysis like oledump or olevba or even many professional anti-virus tools look only at this form.\r\nHowever, most of the time the source code is completely ignored by Office. In fact, it is possible to remove\r\nthe source code (and therefore make all these tools think that there are no macros present), yet the macros\r\nwill still execute without any problems. I have created a proof of concept illustrating this. Most tools will\r\nnot see any macros in the documents in this archive it but if opened with the corresponding Word version\r\n(that matches the document name), it will display a message and will launch calc.exe . It is surprising\r\nthat malware authors are not using this trick more widely.\r\nP-code. As each VBA line is entered into the VBA editor, it is immediately compiled into p-code (a pseudo\r\ncode for a stack machine) and stored in a different place in the module stream. The p-code is precisely what\r\nis executed most of the time. In fact, even when you open the source of a macro module in the VBA editor,\r\nwhat is displayed is not the decompressed source code but the p-code decompiled into source. Only if the\r\ndocument is opened under a version of Office that uses a different VBA version from the one that has been\r\nused to create the document, the stored compressed source code is re-compiled into p-code and then that p-code is executed. This makes it possible to open a VBA-containing document on any version of Office that\r\nsupports VBA and have the macros inside remain executable, despite the fact that the different versions of\r\nVBA use different (incompatible) p-code instructions.\r\nExecodes. When the p-code has been executed at least once, a further tokenized form of it is stored\r\nelsewhere in the document (in streams, the names of which begin with __SRP_ , followed by a number).\r\nFrom there it can be executed much faster. However, the format of the execodes is extremely complex and\r\nis specific for the particular Office version (not VBA version) in which they have been created. This makes\r\nthem extremely non-portable. In addition, their presence is not necessary - they can be removed and the\r\nmacros will run just fine (from the p-code).\r\nSince most of the time it is the p-code that determines what exactly a macro would do (even if neither source code,\r\nnor execodes are present), it would make sense to have a tool that can display it. This is what prompted us to\r\ncreate this VBA p-code disassembler.\r\nhttps://github.com/bontchev/pcodedmp\r\nPage 1 of 5\n\nInstallation\r\nThe script will work both in Python version 2.6+ and in Python 3.x. The simplest way to install it is from PyPi\r\nwith pip :\r\npip install pcodedmp -U\r\nThe above command will install the latest version of pcodedmp (upgrading an older one if it already exists),\r\nwhile also installing all the necessary dependencies (currently only oletools and win_unicode_console but\r\nthere might be additional ones in the future).\r\nIf you would rather install it from the GitHub repository, you can do it like this:\r\ngit clone https://github.com/bontchev/pcodedmp.git\r\ncd pcodedmp\r\npip install .\r\nUsage\r\nThe script takes as a command-line argument a list of one or more names of files or directories. If the name is an\r\nOLE2 document, it will be inspected for VBA code and the p-code of each code module will be disassembled. If\r\nthe name is a directory, all the files in this directory and its subdirectories will be similarly processed. In addition\r\nto the disassembled p-code, by default the script also displays the parsed records of the dir stream, as well as\r\nthe identifiers (variable and function names) used in the VBA modules and stored in the _VBA_PROJECT stream.\r\nThe script supports VBA5 (Office 97, MacOffice 98), VBA6 (Office 2000 to Office 2009) and VBA7 (Office\r\n2010 and higher).\r\nThe script also accepts the following command-line options:\r\n-h , --help Displays a short explanation how to use the script and what the command-line options are.\r\n-v , --version Displays the version of the script.\r\n-n , --norecurse If a name specified on the command line is a directory, process only the files in this directory;\r\ndo not process the files in its subdirectories.\r\n-d , --disasmonly Only the p-code will be disassembled, without the parsed contents of the dir stream or the\r\nidentifiers in the _VBA_PROJECT stream.\r\n-b , --verbose The contents of the dir and _VBA_PROJECT streams is dumped in hex and ASCII form. In\r\naddition, the raw bytes of each compiled into p-code VBA line are also dumped in hex and ASCII.\r\n-o OUTFILE , --output OUTFILE Save the results to the specified output file, instead of sending it to the standard\r\noutput.\r\nhttps://github.com/bontchev/pcodedmp\r\nPage 2 of 5\n\nFor instance, using the script on one of the documents in the proof of concept mentioned above produces the\r\nfollowing results:\r\npython pcodedmp.py -d Word2013.doc\r\nProcessing file: Word2013.doc\r\n===============================================================================\r\nModule streams:\r\nMacros/VBA/ThisDocument - 1517 bytes\r\nLine #0:\r\n FuncDefn (Private Sub Document_Open())\r\nLine #1:\r\n LitStr 0x001D \"This could have been a virus!\"\r\n Ld vbOKOnly\r\n Ld vbInformation\r\n Add\r\n LitStr 0x0006 \"Virus!\"\r\n ArgsCall MsgBox 0x0003\r\nLine #2:\r\n LitStr 0x0008 \"calc.exe\"\r\n Paren\r\n ArgsCall Shell 0x0001\r\nLine #3:\r\n EndSub\r\nFor reference, it is the result of compiling the following VBA code:\r\nPrivate Sub Document_Open()\r\n MsgBox \"This could have been a virus!\", vbOKOnly + vbInformation, \"Virus!\"\r\n Shell(\"calc.exe\")\r\nEnd Sub\r\nKnown problems\r\nOffice 2016 64-bit only: When disassembling variables declared as being of custom type (e.g., Dim\r\nSomeVar As SomeType ), the type ( As SomeType ) is not disassembled.\r\nOffice 2016 64-bit only: The Private property of Sub , Function and Property declarations is not\r\ndisassembled.\r\nOffice 2016 64-bit only: The Declare part of external function declarations (e.g., Private Declare\r\nPtrSafe Function SomeFunc Lib \"SomeLib\" Alias \"SomeName\" () As Long ) is not disassembled.\r\nOffice 2000 and higher: The type of a subroutine or function argument of type ParamArray is not\r\ndisassembled correctly. For instance, Sub Foo (ParamArray arg()) will be disassembled as Sub Foo\r\nhttps://github.com/bontchev/pcodedmp\r\nPage 3 of 5\n\n(arg) .\r\nAll versions of Office: The Alias \"SomeName\" part of external function declarations (e.g., Private\r\nDeclare PtrSafe Function SomeFunc Lib \"SomeLib\" Alias \"SomeName\" () As Long ) is not disassembled.\r\nAll versions of Office: The Public property of custom type definitions (e.g., Public Type SomeType ) is\r\nnot disassembled.\r\nAll versions of Office: The custom type of a subroutine or function argument is not disassembled correctly\r\nand CustomType is used instead. For instance, Sub Foo (arg As Bar) will be disassembled as Sub Foo\r\n(arg As CustomType) .\r\nIf the output of the program is sent to a file, instead of to the console (either by using the -o option or by\r\nredirecting stdout ), any non-ASCII strings (like module names, texsts used in the macros, etc.) might not\r\nbe properly encoded.\r\nI do not have access to 64-bit Office 2016 and the few samples of documents, generated by this version of Office,\r\nthat I have, have been insufficient for me to figure out where the corresponding information resides. I know where\r\nit resides in the other versions of Office, but it has been moved elsewhere in 64-bit Office 2016 and the old\r\nalgorithms no longer work.\r\nTo do\r\nImplement support of VBA3 (Excel95).\r\nWhile the script should support documents created by MacOffice, this has not been tested (and you know\r\nhow well untested code usually works). This should be tested and any bugs related to it should be fixed.\r\nI am not an experienced Python programmer and the code is ugly. Somebody more familiar with Python\r\nthan me should probably rewrite the script and make it look better.\r\nChange log\r\nVersion 1.2.6:\r\nChanged it not to require the win_unicode_console module when it is not available - e.g., when not\r\nrunning on a Windows machine or when running under the PyPy implementation of Python, thanks to\r\nPhilippe Lagadec.\r\nVersion 1.2.5:\r\nAdded a sanity check to avoid errors when parsing object declarations\r\nThe functions that produce output now have the output file (default is stdout ) as a parameter, for better\r\nintegration with other tools, thanks to Philippe Lagadec.\r\nVersion 1.2.4:\r\nhttps://github.com/bontchev/pcodedmp\r\nPage 4 of 5\n\nImplemented support for module names with non-ASCII characters in their names. Thanks to Philippe\r\nLagadec for helping me with that.\r\nFixed a parsing error when disassembling object declarations.\r\nRemoved some unused variables.\r\nImproved the documentation a bit.\r\nVersion 1.2.3:\r\nFixed a few crashes and documented better some disassembly failures.\r\nConverted the script into a package that can be installed with pip . Use the command pip install\r\npcodedmp .\r\nVersion 1.2.2:\r\nImplemented handling of documents saved in Open XML format (which is the default format of Office\r\n2007 and higher) - .docm , .xlsm , .pptm .\r\nVersion 1.2.1:\r\nNow runs under Python 3.x too.\r\nImproved support of 64-bit Office documents.\r\nImplemented support of some VBA7-specific features ( Friend , PtrSafe , LongPtr ).\r\nImproved the disassembling of Dim declarations.\r\nVersion 1.2.0:\r\nDisassembling the various declarations ( New , Type , Dim , ReDim , Sub , Function , Property ).\r\nVersion 1.1.0:\r\nStoring the opcodes in a more efficient manner.\r\nImplemented VBA7 support.\r\nImplemented support for documents created by the 64-bit version of Office.\r\nVersion 1.0.0:\r\nInitial version.\r\nSource: https://github.com/bontchev/pcodedmp\r\nhttps://github.com/bontchev/pcodedmp\r\nPage 5 of 5",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://github.com/bontchev/pcodedmp"
	],
	"report_names": [
		"pcodedmp"
	],
	"threat_actors": [],
	"ts_created_at": 1775446613,
	"ts_updated_at": 1775826781,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/a5f2b89a2bffc3c16301167b2e5a532e77897874.pdf",
		"text": "https://archive.orkl.eu/a5f2b89a2bffc3c16301167b2e5a532e77897874.txt",
		"img": "https://archive.orkl.eu/a5f2b89a2bffc3c16301167b2e5a532e77897874.jpg"
	}
}