pe-format 开源项目推荐（144 个）

hasherezade /pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

hasherezade /pe-bear

带有友好图形界面的 Portable Executable 逆向工具

guidedhacking /GuidedHacking-Injector

The BEST DLL Injector Library.

hasherezade /libpeconv

A library to load, manipulate, dump PE files. See also: https://github.com/hasherezade/libpeconv_tpl

horsicq /XPEViewer

PE file viewer/editor for Windows, Linux and MacOS.

trailofbits /pe-parse

Principled, lightweight C/C++ PE parser

hasherezade /pe-bear-old

PE-bear (builds only)

lepotekil /MsfMania

Python AV Evasion Tools

saferwall /pe

A ⚡ lightweight Go package to parse, analyze and extract metadata from Portable Executable (PE) binaries. Designed for malware analysis tasks and robust against PE malformations.

MrSmith33 /vox

Vox language compiler. AOT / JIT / Linker. Zero dependencies

tgrysztar /fasmg

flat assembler g - adaptable assembly engine

HoShiMin /formatPE

A bunch of parsers for PE and PDB formats in C++

hasherezade /IAT_patcher

Persistent IAT hooking application - based on bearparser

jovibor /Pepper

PE32 (x86) and PE32+ (x64) binaries analysis tool, resources viewer/extractor.

AlexanderBagel /ProcessMemoryMap

Deep memory analysis for Windows processes — the tool that saves you hours of debugging

jovibor /libpe

Library for parsing internal structures of PE32/PE32+ binary files.

packing-box /peid

Python implementation of the Packed Executable iDentifier (PEiD)

Fleynaro /SDA

SDA is a rich cross-platform tool for reverse engineering that focused firstly on analysis of computer games. I'm trying to create a mix of the Ghidra, Cheat Engine and x64dbg. My tool will combine static and dynamic analysis of programs. Now SDA is being developed.

Fatmike-GH /PELoader

A Windows PE loader / manual mapper for executables (x86 and x64) with full TLS (Thread Local Storage) support.

Fatmike-GH /Fatpack

A Windows PE packer for executables (x64) with LZMA compression and with full TLS (Thread Local Storage) support.