pe-bear v0.7.0

风吹屁屁凉

Features and details

• handles PE32 and PE64
• views multiple files in parallel
• recognizes known packers (by signatures)
• fast disassembler – starting from any chosen RVA/File offset
• visualization of sections layout
• selective comparing of two chosen PE files
• adding new elements (sections, imports)
• and more…
  

Special thanks to Ange Albertini – for valuable advises and excellent set of corner-case samples

Issues? Feature requests?
Any suggestions/bug reports are welcome. I am waiting for your e-mails and comments.The preferred ways of reporting an issue is via Github Issues (here).

ScreenshotsSee the sections and visualization of their layout:


PE-bear comes also with a simple, interactive disassembler:


https://hshrzd.wordpress.com/pe-bear/
https://github.com/hasherezade/pe-bear/releases

v0.7.0
FEATURE

• Updated to build with Qt6
• Added support for ARM64 PEs
• New icon
• Upgraded sig_finder: faster search; allow for patterns with masked nibbles
  

BUGFIX

• Allow to open files from Unicode paths from the Explorer menu (and commandline) ( Issue #56 )
• Fixed invalid mapping of NT 3.1 executables ( Issue #45 )
• Fixed wrong interpretation of the section flag ( Issue #54 )
  

WARNING: The Windows build with vs10 suffix is built with Qt4 (legacy) - in contrast to the other builds that are with Qt5 (recommended). It is prepared for the purpose of backward compatibility with old versions of Windows (i.e. XP).

File	Qt	OS	Depends	Info
PE-bear_0.7.0_qt6_x64_win_vs19.zip	6	64-bit, Windows, portable	requires: VS2019 Redistributables	test build, for Windows 10 and above
PE-bear_0.7.0_qt5_x64_win_vs19.zip	5	64-bit, Windows, portable	requires:VS2019 Redistributables	recommended
PE-bear_0.7.0_qt5_x86_win_vs19.zip	5	32-bit, Windows, portable	requires: VS2019 Redistributables
PE-bear_0.7.0_qt4_x86_win_vs10.zip	4	32-bit, Windows, portable		legacy build for Windows XP (not recommended)
PE-bear_0.7.0_qt6_x64_macos.app.zip	6	64-bit, MacOS, portable
PE-bear_0.7.0_qt5_x64_macos.app.zip	5	64-bit, MacOS, portable
PE-bear_0.7.0_qt6.2_x64_linux.tar.xz	6.2.4	64-bit, Linux	requires Qt installation
PE-bear_0.7.0_qt5.15_x64_linux.tar.xz	5.15.3	64-bit, Linux	requires Qt installation

冥界3大法王

本帖最后由 风吹屁屁凉 于 2024-12-19 10:49 编辑


特点和细节
处理 PE32 和 PE64
并行查看多个文件
识别已知打包程序（通过签名）
快速反汇编程序 – 从任意选定的 RVA/文件偏移量开始
部分布局可视化
选择性比较两个选定的 PE 文件
添加新元素（部分、导入）
等等……
特别感谢Ange Albertini – 提供宝贵的建议和出色的极端情况示例

问题？功能要求？
欢迎任何建议/错误报告。我等待您的电子邮件和评论。报告问题的首选方式是通过 Github Issues（此处）。

屏幕截图查看其布局的部分和可视化：


PE-bear 还附带一个简单的交互式反汇编器：https://hshrzd.wordpress.com/pe-bear/ https://github.com/hasherezade/pe-bear/releases v0.7.0 功能






已更新以使用 Qt6 构建
增加了对 ARM64 PE 的支持
新图标
升级版 sig_finder：搜索速度更快；允许使用带掩码的半字节模式
错误修正
允许从资源管理器菜单（和命令行）打开来自 Unicode 路径的文件（问题#56）
修复了 NT 3.1 可执行文件的无效映射（问题#45）
修复了部分标志的错误解释（问题#54）
警告：带有 vs10 后缀的 Windows 版本使用 Qt4（旧版）构建 - 与其他使用 Qt5（推荐）的版本不同。它是为了向后兼容旧版 Windows（即 XP）而准备的。

liuyanglei

很好，正需要，谢谢

lhptvro

看不懂也要点赞！辛苦啦！

xieyinghao

看不懂,很好的资源，谢谢！

Elaborate

这工具太棒了

retsyo

看上去不错啊，谢谢分享

vihp

大佬牛B,膜拜一下！

leishe2023

不明觉厉  谢谢分享

waitfor

感谢分享，支持一下