The RTL is well documented on the website of Embarcadero which bought Delphi (don't waste your time searching on the Borland website).ĭelphi uses the fastcall convention, however it is different than Windows fastcall. It is possible to export data from IDR to an IDC script and load it in IDA, the IDA signatures should be reapplied after as the IDC will remove some function names.

IDR also has its own set of signatures and can sometimes provide other useful information like class names and decompiled code. Properly identifying and naming library functions can save you a lot of time, if using IDA make sure the appropriate FLIRT signatures are applied (probably one of the bds signature for recent applications). Components code is usually placed at the beginning of the executable by the compiler and user code is placed after. This results in large binaries with a large number of functions. Libraries and required functions from the RTL (Delphi Run Time Library) are usually statically compiled in the application binary. Here are some things specific to Delphi that I found important to know when reversing such applications.

Delphi uses an object-oriented language based on Pascal, it is similar in many ways to reversing C++.

Download decompile delphi