petoolse/petools

PE Tools - Portable executable (PE) manipulation toolkit

PE Tools - portable executable (PE) manipulation toolkit.

Table of contents

• Description
• Features
  • PE Editor
  • File Location Calculator
  • PE Files Comparator
  • Process Viewer and Manager
  • PE Dumper
  • PE Rebuilder
  • PE Sniffer
• System Requirements
• Limitations
• To do
• What's new
• Creators
• Contacts

Description

PE Tools lets you actively research PE files and processes. Process Viewer and PE files Editor, Dumper, Rebuilder, Comparator, Analyzer are included. PE Tools is an oldschool reverse engineering tool with a long history since 2002. PE Tools was initially inspired by LordPE (yoda).

Features

PE Editor

• PE and DOS Headers Editor
• PE Sections Editor
• PE Directory Viewer and Editor
• Export Directory Editor
• Import Directory Editor
• Resource Directory Viewer
• Exception Directory Viewer
• Relocation Directory Viewer
• Debug Directory Viewer
• TLS Directory Editor
• Load Config Directory Editor
• Bound Directory Editor

File Location Calculator (FLC)

• Virtual Address
• Relative Virtual Address
• Raw File Offset

PE Files Comparator

• Side-by-side comparison of headers and characteristics of two PE files

Process Viewer and Manager

• Show basic process information
• Show process modules

PE Dumper

• Running process dumper
  • Full Dump
  • Partial Dump
  • Region Dump
• Dumper Server (accessible via Dumper Server SDK)

PE Rebuilder

• Dump Fixer
• Relocation Wiper
• Resource Directory Rebuilder
• PE file Validation
• Imports Binder
• ImageBase Changer

PE Sniffer

• Signature analysis of PE files
• Packer detection

HEX Editor

• HEX Editor available in:
  • Section Editor via section context menu
  • Every Data Directory in Directory Editor

Plugins

• PE Tools Plugin SDK available

What's new in recent major releases

PE Tools v1.9

Complete PE Tools v1.9 announces:

• PE Tools v1.9 announce in English
• PE Tools v1.9 announce in Russian

Entropy View

• Entropy Viewer available in:
  • Main PE Editor dialog
  • Section Editor via section context menu
  • File Compare dialog for both compared files

64-bit Disassembler

• diStorm v3.3.4
• Shows jmp / call direction

Load Config Directory Editor

• IMAGE_LOAD_CONFIG_DIRECTORY support
• Additional Load Config Directory values and size support (non-standard sizes)

High-DPI display modes support

• 192 DPI supported
• DPI modes supported and tested: 96, 120, 144, 192
• Graphics redrawn:
  • Main Application Icon
  • Logo
  • Toolbar icons

Bug-fixes and minor changes

See HISTORY

System Requirements

• Latest tested Operating System: Windows 10
• Supported Windows versions: Windows 10, Windows 8.1, Windows 8, Windows 7
• Minimal Operating System: Windows XP
• Administrative rights for SeDebugPrivilege
• macOS supported via Wine (tested Wine 3.4, 3.0, 2.16)
• ReactOS natively supported (tested ReactOS 0.4.7)

Limitations

• No large files support (over 4 GB)
• No ARM disassembler support (ARM architecture supported by Windows 10 Mobile, Windows RT, Windows Phone, Windows IoT Core, Windows Embedded Compact)

Source code

throw std::exception(“​PE Tools source code is not available”);

• If you want to add some features, write ready-to-use snippet (C/C++) and post it in Issues

To do

• Win64 version
• File Overlay Analyzer and Extractor
• Authenticode Viewer
• Rich Signature Editor
• Relocations Checker
• Enhance Debug Directory Remover: remove debug section if empty
• Corkami binaries testing and support
• .NET Directory Viewer
• External Tools support (preliminary list):
  • x64dbg
  • Scylla Imports Reconstruction
  • Hiew
  • r2
  • Resource Hacker
• Structures Export to readable formats like JSON / YAML
• Crypto tools (hash, decryption / decryption)
• ARM disassembler (far-far-away)

Distribution

File	Description	Lang
PETools.exe	main PE Tools executable
HEdit.dll	Hex-editor
RebPE.dll	PE Rebuilder
Signs.txt	PEiD signatures for PE Sniffer
ReadMe_EN.md	ReadMe	EN
WhatsNew_EN.md	What's New	EN
WhatsNew_RU.md	What's New	RU
petools.sha1	Checksums SHA-1

DOWNLOAD

• github.com/petoolse/petools/releases

Licensing

See LICENSE

Creators

PE Tools

• NEOx [uinC] - versions up to 1.5, 2002-2006
• Jupiter - versions from 1.5, 2007-2018
• PainteR - versions from 1.8, 2017-2018
• EvilsInterrupt aka NtVisigoth - versions from 1.5, 2012-2014

Additional modules

• yoda (author of LordPE): original HEdit32 component

Contacts

Feel free to contact via Twitter @petoolse.

petools's Issues

Show SeDebugPrivilege warning at app start

Понятно, что пользовать программы достаточно умный человек. Reversing Engineering привлекает далеко не простых глупых людей, но тем неменее нужно бы решить проблему с этим warning-ом. Возможно дописать мини-инструкцию куда-либо с описанием почему оно появляется и чем грозит, если грозит, пользователю? Если ничего нельзя сделать, то пояснить как пользователю это поправить у себя в системе

Calculation of entry

Sorry to bother, but do you have any Idea on how to calculate the entry point of a PE Executable. Since the source code is unavailable I have no idea on how petools does it and was wondering you could tell me.

Section Add - Virtual Address Alignment

Section Add - Virtual Address Alignment

Info

Incorrect calculation of Virtual Address while adding new section.

Details

Example with PETools.exe. Adding section, getting wrong values.

How to reproduce:

• Open PETools.exe in PE Tools (not running copy, sure).
• Open Section Editor -> Add Section

Two last sections details after adding new section

Previous section:

Name	Value	Remaks
Raw Size	00006400
Raw Offset	00112A00
Virtual Size	00006360
Virtual Address	0011B000

New section:

Name	Value	Remaks
Raw Size	00000200
Raw Offset	00118E00
Virtual Size	00001000
Virtual Address	0011C000	Invalid. Should be 00122000

Source to fix

• SectionsDlg.cpp
  • CreateSectionsDlg
  • AddNewSection
  • AddSection_File
  • AddSection_FillZero
  • AddSection_HeaderOnly

PETools detected as malware

See https://www.virustotal.com/#/file/8fd1a1cc1a253fd58693c181895d392ba20fc2a638aaecbc2e8f5d004db8fc27/detection
Why is this?

Triggers Chrome and half the world's AVs?

What is this new version doing that would cause half the world's AVs to flag it, and make Chrome refuse to download it with no option to continue at own risk?

https://www.virustotal.com/gui/file/2198c71f1bbf4809a1f4af58e0b11aac9c33edfee0be7ef29f6fe798dc7b6e8d/detection

v1.5 only triggers 3 AVs, and isn't flagged by Chrome.

Section Editor - Disassembler decodes just 2 bytes

Info

It is not clear why the disassembler shows just 2 bytes decoded
Expectation is to have all the section (or say 1K) to be disassembled

Details

Drop a file onto the tool, go to the Section Editor
Locate .text section (this is a file compiled by MS VS)
Right click - Disassemble Section
just 2 bytes (CC) being disassembled:
http://prntscr.com/jg8go0

is it a known limitation or... ?

At the same time other sections when asked are showing way much more asm lines

Can't dump 64-bit programs with PETools

I am trying to dump a program that is 64-bit, for some reason it doesn't let me.

I recorded a video of me trying to dump the program which can be viewed here:

PEToolsDumpProblem.mp4

Is there anything that I am doing wrong? I am using the latest version from GitHub + the program opens as administrator, so I have no idea what I am doing wrong. Thank you!

Changing DLL Names on Import Directory is not working

By some reason change the DLL Names on Import Directory is not possible with this PE Tools build.
This don't occurs with olders PE Tools versions (tested with v1.5 RC7)

Files used: megatools-1.10.2-win32.zip (3833 kB) , https://megatools.megous.com/

What the mean of the "question mark" button?

Relocs Listing

Relocation listing interrupted when VirtualAddress is zero

Description

When IMAGE_BASE_RELOCATION.VirtualAddress is equal to zero, PE Tools interrupts listing of relocations. But Windows PE loader checks only address range (OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress.Size).

Discovery

Reported by ntldr

Open Source license

Why is this project being hosted on GitHub without its sources being available? Have you ever considered making it open? What is the point of hosting proprietary software on Git?

Digital Signature corruption on adding new import

Info

Once you add a new dll into Import Section the existing "Digital Signatures" tab stops to show in File Properties

Details

Open up your exe with Digital Signature present
go to Directories -> Import Directory
Right click on dll list, click "Add Imports..."
Fill in

• new section name
• Dll name
• API name

click OK
Save your file

open up File properties in explorer - "DIgital SIgnatures" section is gone.

Here is a visual comparison of added section data (left) and old certificate data that was corrupted (right)

http://prntscr.com/jbcdnf

Tool used - http://prntscr.com/jbcee0

Latest Release is Infected

I downloaded PE Tools v1.9.762.2018, which was the latest release in this github repository, and extracted the 7z archive with WinRAR. When I tried to run it, avast warned me that it was a PUP. I put the exe file into virustotal, and got back bad results:
Virustotal Scan

'File Alignment' Setting Does Not Change File Alignment on Rebuild

The "File Alignment" Setting under "PE Rebuilder" in the preferences does not change the file alignment on the executable while rebuilding. It seems that the file alignment is defaulted to 1024 (400 in hex), regardless of the setting.