In this post, we’ll explore what Dede is, how it works, why it was revolutionary, and where it stands in 2025. Dede is a static analysis tool specifically designed for binaries compiled with Borland Delphi (versions 2 through 7, and partially 2005-2010). Unlike a traditional disassembler (like IDA Pro or Ghidra) that shows raw x86 assembly, Dede understands Delphi’s Form DFM resources , RTTI (Run-Time Type Information) , and VCL (Visual Component Library) structures.
Today, it sits on the shelf like an old oscilloscope – not something you’d use for new work, but when you encounter a dusty Delphi 5 binary from two decades ago, Dede still lights up and whispers the secrets of TForm and TButton . Delphi Decompiler Dede
0042A1B0 push ebp 0042A1B1 mov ebp, esp 0042A1B3 push ecx 0042A1B4 mov eax, [ebp+$08] ... 0042A1D0 call TListBox::Items::Add You now know the button adds something to a listbox. With manual analysis, you can rewrite a functional equivalent. In this post, we’ll explore what Dede is,
If you do legacy Windows reversing, keep a copy in your toolkit. And if you’re a young reverse engineer, exploring Dede’s output side-by-side with a debugger will teach you more about Delphi’s internals than any book. Have you used Dede or IDR to recover a lost project? Share your war stories in the comments below. Today, it sits on the shelf like an
Load the EXE into Dede. Step 2: The "Forms" tab instantly shows MainForm contains TButton , TEdit , TListBox . Step 3: Click on Button1 . Dede lists its OnClick handler at address 0x0042A1B0 . Step 4: Switch to "Procedures", locate TMainForm.Button1Click , and view the disassembly:
If you’ve been in the Windows reverse engineering or legacy software maintenance space for more than a decade, one name still echoes through forums and tool libraries: Dede .