{"categories":[{"label":"Utilities","url":"https://skillfed.io/packages/category/utilities/2"},{"label":"Security","url":"https://skillfed.io/packages/category/security"},{"label":"Disassemblers","url":"https://skillfed.io/packages/category/software-development-disassemblers"}],"enrichment":{"capability":"Disassembles VBA p-code from Microsoft Office documents to reveal the compiled macro instructions that actually execute, regardless of whether source code is present.","skillfed_tags":["malware-analysis","reverse-engineering","dfir"],"use_cases":["Analyze suspicious Office documents during incident response to understand what embedded macros will execute, bypassing obfuscation or source-code removal.","Reverse-engineer malware samples that use VBA macros as a delivery mechanism, extracting execution logic from p-code when source is unavailable.","Validate macro behavior in legacy Office documents (Office 97\u20132009) where p-code format is stable and well-understood.","Supplement other macro analysis tools that focus on source code by examining the compiled form that Office actually runs."],"what_it_does":"pcodedmp is a command-line tool and Python library that extracts and disassembles VBA p-code from Microsoft Office documents. VBA macros exist in three executable forms\u2014source code, p-code (pseudo-code for a stack machine), and execodes\u2014but p-code is what actually runs most of the time. Many DFIR and antivirus tools only inspect the source code form, which can be removed while leaving p-code intact and executable. This tool fills that gap by parsing OLE2 document streams and converting p-code instructions into human-readable assembly-like output, making it possible to analyze what a macro will actually do even when source code is hidden or absent.\n\nThe tool supports VBA5 (Office 97\u201398), VBA6 (Office 2000\u20132009), and VBA7 (Office 2010+). It can process single files or recursively scan directories, and offers options to dump raw stream contents, display variable and function identifiers, or focus only on disassembled p-code. Output can be sent to stdout or saved to a file. However, the package is no longer maintained\u2014its last commit was in June 2021 and latest release in July 2019\u2014so it will not receive updates for newly discovered p-code variants or modern Office versions.","worth_installing":"Yes, with conditions. Install if you need to analyze VBA p-code in legacy Office documents (Office 97\u20132009) or conduct DFIR work on macro-based malware. The low install friction and lack of known vulnerabilities make it safe to add. However, do not rely on it for modern Office versions (2010+) without testing\u2014the package is abandoned and has known disassembly gaps in 64-bit Office 2016. For current macro analysis, consider pairing it with actively maintained tools."},"id":"pcodedmp","links":{"html":"https://skillfed.io/packages/pcodedmp","md":"https://skillfed.io/packages/pcodedmp.md","pypi":"https://pypi.org/project/pcodedmp/"},"maintenance":{"status":"abandoned"},"meta":{"latest_release":"2019-07-30","license_spdx":null,"license_treatment":"copyleft","name":"pcodedmp","python_support":"unspecified","summary":"A VBA p-code disassembler"},"popularity":{"monthly_downloads":7645131,"position":1710,"tier":"top_5000"},"security":{"n_vulnerabilities":0},"version":"1.2.6"}