PE-bear v0.7.0

PE-bear is a multiplatform reversing tool for PE files with a friendly GUI.

Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files.

Features

•  handles PE32 and PE64

•  views multiple files in parallel

•  recognizes known packers (by signatures)

•  fast disassembler – starting from any chosen RVA/File offset

•  visualization of sections layout

•  selective comparing of two chosen PE files

•  adding new elements (sections, imports)

•  and more…

V0.7.0  (2024-09-14)

FEATURE

 •  Updated to build with Qt6

 •  Added support for ARM64 PEs

 •  New icon

 •  Upgraded sig_finder: faster search; allow for patterns with masked nibbles

BUGFIX

 •  Allow to open files from Unicode paths from the Explorer menu (and commandline) ( Issue #56 )

 •  Fixed invalid mapping of NT 3.1 executables ( Issue #45 )

 •  Fixed wrong interpretation of the section flag ( Issue #54 )

PE-bear

https://hshrzd.wordpress.com/pe-bear/

https://github.com/hasherezade/pe-bear

https://github.com/hasherezade/pe-bear/releases

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！