: Use the "Procedures" tab to see a list of internal functions. This is useful for identifying core business logic. Exporting to Delphi
The analyst locates the OnClick event for the target button and notes its virtual memory address (Offset).
: DeDe automatically identifies strings, object names, and calls to the VCL (Visual Component Library).
is a file analysis and decompilation tool specifically designed for Windows executables ( .exe ) and dynamic link libraries ( .dll ) compiled with Borland Delphi (versions 2 through 7, and partially for newer versions like 2005-2010). delphi decompiler dede
Understanding DeDe: The Legendary Delphi Decompiler Reverse engineering compiled code requires tools that can reconstruct meaning from binary data. For software built with Embarcadero Delphi (formerly Borland Delphi), standard decompilers often struggle due to Delphi's unique object-oriented structure, custom memory management, and specialized event-driven architecture.
(also known as Dark Deeds or just DeDe ) is a decompiler for Delphi and C++ Builder executables. It extracts forms, events, and source code structure from compiled binary files ( .exe , .dll , .bpl ). It does not produce original Pascal source code perfectly, but it reconstructs:
DeDe analyzes the binary signatures to determine which version of Delphi or C++Builder was used to compile the file (e.g., Delphi 3 through Delphi 7). : Use the "Procedures" tab to see a
return handlers
DeDe maps button clicks and other events to their specific addresses in the code.
Dede uses a combination of disassembly and decompilation techniques to recover the source code from a compiled Delphi program. Here is a high-level overview of the decompilation process: : DeDe automatically identifies strings, object names, and
The NSA’s Ghidra is a free, state-of-the-art reverse engineering tool. While it does not understand Delphi forms natively, community scripts exist to load Delphi RTTI into Ghidra. This is the modern, heavy-duty solution for complex Delphi binaries.
Download a freeware Delphi program, run it through DeDe, and see if you can find the "About" dialog box component. From there, the world of legacy code recovery opens up.
In a standard disassembler, finding the code that runs when a user clicks "Register" requires tedious tracing. DeDe looks at the OnClick property of that specific button component in the metadata, reads the internal memory offset assigned to it, and points you directly to the exact assembly address where the validation logic begins. 3. Analyzing the Assembly