class ComponentType(Enum): TFORM = "TForm" TBUTTON = "TButton" TEDIT = "TEdit" TMEMO = "TMemo" TLABEL = "TLabel" TCOMBOBOX = "TComboBox" TLISTBOX = "TListBox" TCHECKBOX = "TCheckBox" TRADIOBUTTON = "TRadioButton" TPANEL = "TPanel" TMAINMENU = "TMainMenu" TTIMER = "TTimer" UNKNOWN = "Unknown"

DeDe analyzes the binary signatures to determine which version of Delphi or C++Builder was used to compile the file (e.g., Delphi 3 through Delphi 7).

| Tool | Type | Supports Delphi Decompilation? | |------|------|-------------------------------| | | Decompiler | Yes – more advanced, active until ~2015 | | Delphi Decompiler (by GExperts?) | Partial | No – form recovery only | | dnSpy (for .NET) | Decompiler | Not applicable (Delphi is native) | | Ghidra / IDA Pro | Disassembler | With Delphi scripts – partial form/RTTI parsing | | DelphiLens | Analyzer | No decompilation – code navigation only |

Event handlers mapping user actions (like clicking a button) to specific memory addresses.

if len(sys.argv) < 2: print("Usage: python delphi_decompiler.py <delphi_executable>") print("Example: python delphi_decompiler.py myapp.exe") return

The DeDe Delphi Decompiler holds a permanent place in the hall of fame for reverse engineering utilities. It proved that complex, natively compiled object-oriented binaries could be structured and understood logically. While modern analysts working with 64-bit applications or RAD Studio layouts will need to utilize modern tools like IDR or Ghidra, studying DeDe provides timeless insights into how the Delphi engine ticks under the hood.

DeDe stands out because it targets the specific structural design patterns of Borland Delphi and C++Builder binaries. 1. Form and DFMCreator Reconstruction

DeDe is fundamentally a 32-bit (x86) Windows application designed to analyze 32-bit binaries. It cannot process 64-bit (x64) executables.

When an old enterprise application needs to connect to a modern API, but the original vendor is out of business, decompiling the binary helps developers understand internal data structures to build compatible wrappers. Limitations of DeDe

DeDe parses the executable’s internal structures to map out the entire class hierarchy. It reveals: Published methods and properties. Virtual Method Tables (VMTs). Class names and parent-child relationships. 4. Disassembler and Assembler References

Excellent for initial triage to determine exactly which version of the Delphi compiler was used and whether the file is packed. Conclusion

Procedure TForm1.Button1Click(Sender: TObject); begin // Address: 00451234 push ... call ShowMessage ... end;

Look for a component named something like btnVerify or Button1 . Switch to the sub-tab. Look for the OnClick event.

The tool scans the binary for the RTTI structure, VCL components, and event tables.