hasherezade/pe_utils

A set of small utilities, helpers for PIN tracers

PE utils

Set of small, self-contained utilities to be used in other toolkits, i.e. as helpers for PIN Tools (example).

• syscall_extractor - Extract syscalls from system DLLs (ntdll.dll, win32u.dll) into a CSV file
• dll_load - Loads a given DLL. Calls exported functions if supplied.
• pe_check - Checks the bitness of the PE and outputs it as a return value.
• kdb_check - Checks if the Kernel Debugger is enabled (no elevation required). Outputs the status as a return value.

You can display the returned values of pe_check and kdb_check by:

echo %errorlevel%

pe_utils's Issues

pe_unmapper

Hello, hasherezade! I'm not sure if it's right place for this question, but still...

I tried to use your tool as it intended to be used. 2 dll dumped from memory are successfully converted. But 1 of them results in 0 bytes...
Here is that die hard dll
Could you check why pe_unmapper produces 0 bytes output from that dll, please?

I got your tool from here
BTW, why that repo no longer exist? Or it was renamed to something else?
Anyways, thank you for that piece of soft.

pe_check produces no output

Could be me but when I test the pe_check.exe release 1.0 on a couple of PE files it isn't producing any output/nothing to stdout

.