[转帖]PeStudio-安全工具-看雪-安全社区|安全招聘|kanxue.com

[转帖]PeStudio

发表于: 2010-9-4 11:44 5095

[转帖]PeStudio

linhanshi

2010-9-4 11:44

5095

PeStudio shows you many security relevant details about any application, like:
all libraries that are used by an application
all functions that are imported by an application
all functions (also anonymous) that are exported by an application
all functions that are forwarded to other libraries
all obsolete functions that are exported and imported by an application
whether the Data Execution Prevention (DEP) Windows security mechanism is used
whether the Address Space Layout Randomization (ASLR) Windows security mechanism is used
whether Structured Exception Handling - SEH Windows security mechanism is used
whether some sections are compressed
whether an application is 64-Bit capable
whether an application contains IL Code
which Execution Level will be requested by an application
and many more details...

http://www.winitor.net/tools/PeStudio.zip

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

#[other]

收藏・2

免费・1

支持

最新回复 (19)
tmxfh 雪币： 101 活跃值： (154) 能力值： ( LV3，RANK：20 ) 在线值：发帖 19 回帖 142 粉丝 0 关注私信	tmxfh 2 楼我看不懂英文，我不喜欢老外 2010-9-7 17:12 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 3 楼 PeStudio v3.30 2010-10-14 Changelog - Corrected duplicated items in Exported functions list - Put Evidences in XML file - Show COM Server support in Evidences - Test COM Server Support Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-10-15 00:34 0
cache 雪币： 201 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 14 回帖 57 粉丝 1 关注私信	cache 4 楼运行不了。。 2010-10-15 12:59 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 5 楼 PeStudio v3.31 2010-10-16 Changelog - Resolve crash on Window 64 bit Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-10-17 01:49 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 6 楼 PeStudio v3.32 2010-10-20 Changelog - IAT size estimation for Evidences adjusted - Show Obsolete Imported functions as Evidence - Show Obsolete Exported functions as Evidence - Show usage of HTTP functions as Evidence - Show usage of RAS functions as Evidence - Show usage of Winsock functions as Evidence Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-10-21 10:51 0
cntrump 雪币： 1708 活跃值： (586) 能力值： ( LV15，RANK：670 ) 在线值：发帖 204 回帖 2062 粉丝 19 关注私信	cntrump 13 7 楼这个程序的界面很大 1024*768 都要被占满。 2010-10-21 11:07 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 8 楼 PeStudio v3.33 2010-10-26 Changelog - Show unused image file space (Caves) as Evidence Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-10-27 00:00 0
快雪时晴雪币： 370 活跃值： (15) 能力值： ( LV9，RANK：170 ) 在线值：发帖 34 回帖 2272 粉丝 1 关注私信	快雪时晴 4 9 楼今天正好用到，到官方打不开网页，直接下zip竟然可以，谢谢 2010-10-27 01:15 0
fenggebb 雪币： 206 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 29 粉丝 0 关注私信	fenggebb 10 楼谢谢谢谢谢谢! 2010-10-28 00:15 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 11 楼 PeStudio v3.34 2010-10-27 Changelog - Corrected problem with upx compressed files - Show usage of Hooking functions as Evidence Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-10-28 01:09 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 12 楼 PeStudio v3.35 2010-10-29 Changelog - Show usage of Debugging functions as Evidence Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-10-30 20:36 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 13 楼 PeStudio v3.36 2010-11-01 Changelog - Handle invalid Directories - Handle sectionless files - Number of imported symbols as Evidence - Show whether the Section Names are standard as Evidence Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-11-1 15:25 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 14 楼 PeStudio v3.37 2010-11-04 Changelog - Added support for a single Command Line parameter: e.g PeStudio.exe %1 will open the file to analyse - Make Dos Stub size available - Make functions addresses available - Make Preferred Base Address available for Libraries Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-11-6 10:53 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 15 楼 PeStudio v3.38 2010-11-05 Changelog - Make Windows Network Functions as Evidence - PeStudio.exe %1 and PeStudio.exe "%1" are now supported Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-11-6 10:53 0
cntrump 雪币： 1708 活跃值： (586) 能力值： ( LV15，RANK：670 ) 在线值：发帖 204 回帖 2062 粉丝 19 关注私信	cntrump 13 16 楼井喷更新期，真蛋疼呀。 2010-11-6 20:52 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 17 楼更新的速度的確可以作者吵架的 Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-11-6 21:02 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 18 楼 PeStudio v3.40 2010-11-09 Changelog - Added empty Checksum as Evidence - Added number of Sections as Evidence - Added other (Borland) standard sections as known sections - Added support for a single Command Line parameter: e.g PeStudio.exe %1 will open the file to analyse - Corrected problem with upx compressed files - Handle invalid Directories - Handle sectionless files - IAT size estimation for Evidences adjusted - Make Dos Stub size available - Make functions addresses available - Make Preferred Base Address available for Libraries - Make size of DosStub (very small or very big) as Evidence - Make Windows Network Functions as Evidence - Number of imported symbols as Evidence - PeStudio.exe %1 and PeStudio.exe "%1" are now supported - Resolve crash on Window 64 bit - Show Obsolete Exported functions as Evidence - Show Obsolete Imported functions as Evidence - Show unused image file space (Caves) as Evidence - Show usage of Debugging functions as Evidence - Show usage of Hooking functions as Evidence - Show usage of HTTP functions as Evidence - Show usage of NetBios functions as Evidence - Show usage of RAS functions as Evidence - Show Usage of Service Control Manager (SCM) functions as Evidence - Show usage of Winsock functions as Evidence - Show whether the Section Names are standard as Evidence Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-11-10 13:57 0
cntrump 雪币： 1708 活跃值： (586) 能力值： ( LV15，RANK：670 ) 在线值：发帖 204 回帖 2062 粉丝 19 关注私信	cntrump 13 19 楼告别 3.3x了，这个必须得更新。 2010-11-11 11:36 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 20 楼 PeStudio v3.41 2010-11-17 Changelog - Added Custom Resource Types as Evidence - Added Detection of programmatic loading of libraries as Evidence - Added Image Bound detection as Evidence - Added Image Digital Signature test as Evidence - Added ImageHelp as functions group - Added Large Address Space awareness as Evidence - Added OLE as functions group - Added Resource Section size bigger as Code Section size as Evidence - Added Setup API as functions group - Added Structured Storage as functions group - Added Thread Local Storage (TLS - static) usage as Evidence. - Addet Thread Local Storage (TLS - dynamic) as functions group Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-11-20 15:31 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

linhanshi

9256

发帖

27966

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (19)
tmxfh 雪币： 101 活跃值： (154) 能力值： ( LV3，RANK：20 ) 在线值：发帖 19 回帖 142 粉丝 0 关注私信	tmxfh 2 楼我看不懂英文，我不喜欢老外 2010-9-7 17:12 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 3 楼 PeStudio v3.30 2010-10-14 Changelog - Corrected duplicated items in Exported functions list - Put Evidences in XML file - Show COM Server support in Evidences - Test COM Server Support Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-10-15 00:34 0
cache 雪币： 201 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 14 回帖 57 粉丝 1 关注私信	cache 4 楼运行不了。。 2010-10-15 12:59 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 5 楼 PeStudio v3.31 2010-10-16 Changelog - Resolve crash on Window 64 bit Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-10-17 01:49 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 6 楼 PeStudio v3.32 2010-10-20 Changelog - IAT size estimation for Evidences adjusted - Show Obsolete Imported functions as Evidence - Show Obsolete Exported functions as Evidence - Show usage of HTTP functions as Evidence - Show usage of RAS functions as Evidence - Show usage of Winsock functions as Evidence Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-10-21 10:51 0
cntrump 雪币： 1708 活跃值： (586) 能力值： ( LV15，RANK：670 ) 在线值：发帖 204 回帖 2062 粉丝 19 关注私信	cntrump 13 7 楼这个程序的界面很大 1024*768 都要被占满。 2010-10-21 11:07 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 8 楼 PeStudio v3.33 2010-10-26 Changelog - Show unused image file space (Caves) as Evidence Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-10-27 00:00 0
快雪时晴雪币： 370 活跃值： (15) 能力值： ( LV9，RANK：170 ) 在线值：发帖 34 回帖 2272 粉丝 1 关注私信	快雪时晴 4 9 楼今天正好用到，到官方打不开网页，直接下zip竟然可以，谢谢 2010-10-27 01:15 0
fenggebb 雪币： 206 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 29 粉丝 0 关注私信	fenggebb 10 楼谢谢谢谢谢谢! 2010-10-28 00:15 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 11 楼 PeStudio v3.34 2010-10-27 Changelog - Corrected problem with upx compressed files - Show usage of Hooking functions as Evidence Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-10-28 01:09 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 12 楼 PeStudio v3.35 2010-10-29 Changelog - Show usage of Debugging functions as Evidence Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-10-30 20:36 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 13 楼 PeStudio v3.36 2010-11-01 Changelog - Handle invalid Directories - Handle sectionless files - Number of imported symbols as Evidence - Show whether the Section Names are standard as Evidence Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-11-1 15:25 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 14 楼 PeStudio v3.37 2010-11-04 Changelog - Added support for a single Command Line parameter: e.g PeStudio.exe %1 will open the file to analyse - Make Dos Stub size available - Make functions addresses available - Make Preferred Base Address available for Libraries Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-11-6 10:53 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 15 楼 PeStudio v3.38 2010-11-05 Changelog - Make Windows Network Functions as Evidence - PeStudio.exe %1 and PeStudio.exe "%1" are now supported Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-11-6 10:53 0
cntrump 雪币： 1708 活跃值： (586) 能力值： ( LV15，RANK：670 ) 在线值：发帖 204 回帖 2062 粉丝 19 关注私信	cntrump 13 16 楼井喷更新期，真蛋疼呀。 2010-11-6 20:52 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 17 楼更新的速度的確可以作者吵架的 Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-11-6 21:02 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 18 楼 PeStudio v3.40 2010-11-09 Changelog - Added empty Checksum as Evidence - Added number of Sections as Evidence - Added other (Borland) standard sections as known sections - Added support for a single Command Line parameter: e.g PeStudio.exe %1 will open the file to analyse - Corrected problem with upx compressed files - Handle invalid Directories - Handle sectionless files - IAT size estimation for Evidences adjusted - Make Dos Stub size available - Make functions addresses available - Make Preferred Base Address available for Libraries - Make size of DosStub (very small or very big) as Evidence - Make Windows Network Functions as Evidence - Number of imported symbols as Evidence - PeStudio.exe %1 and PeStudio.exe "%1" are now supported - Resolve crash on Window 64 bit - Show Obsolete Exported functions as Evidence - Show Obsolete Imported functions as Evidence - Show unused image file space (Caves) as Evidence - Show usage of Debugging functions as Evidence - Show usage of Hooking functions as Evidence - Show usage of HTTP functions as Evidence - Show usage of NetBios functions as Evidence - Show usage of RAS functions as Evidence - Show Usage of Service Control Manager (SCM) functions as Evidence - Show usage of Winsock functions as Evidence - Show whether the Section Names are standard as Evidence Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-11-10 13:57 0
cntrump 雪币： 1708 活跃值： (586) 能力值： ( LV15，RANK：670 ) 在线值：发帖 204 回帖 2062 粉丝 19 关注私信	cntrump 13 19 楼告别 3.3x了，这个必须得更新。 2010-11-11 11:36 0
linhanshi 雪币： 98824 活跃值： (201059) 能力值： (RANK：10 ) 在线值：发帖 9256 回帖 27966 粉丝 460 关注私信	linhanshi 20 楼 PeStudio v3.41 2010-11-17 Changelog - Added Custom Resource Types as Evidence - Added Detection of programmatic loading of libraries as Evidence - Added Image Bound detection as Evidence - Added Image Digital Signature test as Evidence - Added ImageHelp as functions group - Added Large Address Space awareness as Evidence - Added OLE as functions group - Added Resource Section size bigger as Code Section size as Evidence - Added Setup API as functions group - Added Structured Storage as functions group - Added Thread Local Storage (TLS - static) usage as Evidence. - Addet Thread Local Storage (TLS - dynamic) as functions group Download Portable: http://www.winitor.net/tools/PeStudio.zip Программное обеспечение выпуска и Windows Crack Обучение Нам-Dabei Guanyin Бодхисаттва Нам без митабха 2010-11-20 15:31 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复