pcodedmp

What it is and what it does

pcodedmp is a command-line tool and Python library that extracts and disassembles VBA p-code from Microsoft Office documents. VBA macros exist in three executable forms—source code, p-code (pseudo-code for a stack machine), and execodes—but p-code is what actually runs most of the time. Many DFIR and antivirus tools only inspect the source code form, which can be removed while leaving p-code intact and executable. This tool fills that gap by parsing OLE2 document streams and converting p-code instructions into human-readable assembly-like output, making it possible to analyze what a macro will actually do even when source code is hidden or absent.

The tool supports VBA5 (Office 97–98), VBA6 (Office 2000–2009), and VBA7 (Office 2010+). It can process single files or recursively scan directories, and offers options to dump raw stream contents, display variable and function identifiers, or focus only on disassembled p-code. Output can be sent to stdout or saved to a file. However, the package is no longer maintained—its last commit was in June 2021 and latest release in July 2019—so it will not receive updates for newly discovered p-code variants or modern Office versions.

Use it for:

• Analyze suspicious Office documents during incident response to understand what embedded macros will execute, bypassing obfuscation or source-code removal.
• Reverse-engineer malware samples that use VBA macros as a delivery mechanism, extracting execution logic from p-code when source is unavailable.
• Validate macro behavior in legacy Office documents (Office 97–2009) where p-code format is stable and well-understood.
• Supplement other macro analysis tools that focus on source code by examining the compiled form that Office actually runs.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Disassembles VBA p-code from Microsoft Office documents to reveal the compiled macro instructions that actually execute, regardless of whether source code is present.

Yes, with conditions. Install if you need to analyze VBA p-code in legacy Office documents (Office 97–2009) or conduct DFIR work on macro-based malware. The low install friction and lack of known vulnerabilities make it safe to add. However, do not rely on it for modern Office versions (2010+) without testing—the package is abandoned and has known disassembly gaps in 64-bit Office 2016. For current macro analysis, consider pairing it with actively maintained tools.

Install

pcodedmp on PyPI

pip install pcodedmp

uv add pcodedmp

poetry add pcodedmp

Installing pcodedmp

Before you install

Low friction installation with only two runtime dependencies (oletools and win-unicode-console). However, the package is abandoned—last commit was 2021-06-12 and no releases since 2019-07-30. It remains marked Production/Stable and works with Python 2.7 and Python 3.x, but will not receive updates or security patches.

License in practice

Licensed under GPLv3 (copyleft). Any derivative work or distribution must also be open-source under GPL v3 terms. This is a strong copyleft restriction suitable for security research and analysis tools but may constrain commercial or proprietary use.

Quickstart

pip install pcodedmp
python -m pcodedmp document.doc
# or programmatically:
from pcodedmp import pcodedmp
pcodedmp.processFile('document.doc')

Requires an OLE2-format Office document (Word, Excel, etc. with embedded VBA); modern Office formats (.docx, .xlsx) use different structures and are not supported.

Verify before relying

• Whether the package correctly handles all VBA7 (Office 2010+) p-code variants, given known limitations in 64-bit Office 2016 disassembly.
• Current compatibility with modern Python versions beyond 3.6, since classifiers list only up to 3.6.
• Whether oletools dependency has received security updates since pcodedmp's last release.

Package facts

Evidence: pcodedmp-1.2.6-py2.py3-none-any.whl

Keywords: vba, p-code, disassembler

Tags

More Utilities packages