-
-
[转帖]PE Anatomist 0.2.13218.1416（20楼）
-
发表于: 2020-1-11 08:45
-
更新日期：2020年10月22日
版本：0.1.18
下载：https://rammerlabs.alidml.ru/files/PEAnatomist-0.1.18.zip
Version 0.1.18 (2020-10-21): [#] Fixed error displaying data from ~GUID in .NET metadata tables [+] Added description of flags for entries in .NET metadata tables [#] Fixed bug with positioning child windows on multi-monitor configurations [+] Added creation of a minidump in case of an unhandled exception [#] Updated @feat.00 flag description [#] Changed description text for several IDs in Rich Signature [#] Rewrote a part of the code to enumerate the 'Section' objects [+] Added a column to the ExceptionsData X64 table to display the size of the stack allocation [+] Added a request to start a new copy of the program when the restriction on starting the only instance of the program is enabled and running copy does not respond [#] ExceptionsData X64 chain table format changed to more verbose [#] Fixed error in determining the allocation size for UWOP_ALLOC_LARGE (1) [+] Added a page for xFG hash values for OBJ files [+] Added ExceptionsData x64, ARM64 and ARM for OBJ files [#] Fixed a bug with working with sections in OBJ files in the presence of BSS with a certain set of parameters [#] Fixed a bug with parsing unwind codes for ARM and ARM64 (in PE and OBJ files), which could appear on small files or in presence of a large number of epilogues in a function [#] Cleaning up and slight optimization of the IA64 unwind codes parser [+] Added a description of the section and an offset in it to the COFF symbol, which is referenced by the CodeView symbol in the corresponding forms of debug information [+] Added options to search any value less or greater than the specified [+] Added setting of the initial search position based on: the last found line, the selected line, or forced from the beginning of the list [+] Added full-text search in all columns of the list (minimum query length - 2 characters, search is case insensitive only for ANSI characters) [+] Added the ability to search in any list [#] Fixed a bug with displaying the type name from TypeDef in the .NET metadata token description in rare cases (only the method
PE Anatomist - PE files internals
PE Anatomist shows almost all known data structures inside a PE file and makes some analytics
VERSION 0.1.10.97 (2020-01-10)
PEAnatomist.exe SHA256:F70267636B32CD7F8CE6E566ABAC9D9BE63CFF9BB3F7F2CD19F3249229FD7291
Added mapping of redirects to another UNWIND_INFO between managed / unmanaged code in the ExceptionsData table for x64
Added parsing of tables and metadata of dotNET
_ https://rammerlabs.alidml.ru/index-eng.html
_https://rammerlabs.alidml.ru/files/PEAnatomist-0.1.9.zip
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
最后于 2024-8-24 06:52
被linhanshi编辑
，原因：
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
