Exetools

Exetools (https://forum.exetools.com/index.php)
-   Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)
-   -   PE-bear v0.3.7 (x86 & x64 & Linux) (https://forum.exetools.com/showthread.php?t=16198)

Utshiha 09-23-2014 00:44

PE-bear v0.3.7 (x86 & x64 & Linux)
 
Quote:

PE-bear is a new reversing tool for PE files
with PE Bear you can view file signatures
and view packers which have been used.

Download :



x86

HTML Code:

http://filecloud.io/rgc3ul7p

x64

HTML Code:

http://filecloud.io/1gvs4xfl

Linux


HTML Code:

http://filecloud.io/mn5yw8rg

dj-siba 09-23-2014 17:05

PE-bear
Code:

http://hasherezade.net/PE-bear

traf0 01-13-2022 18:01

PE-bear is a freeware reversing tool for PE files. Its objective was to deliver fast and flexible “first view” tool for malware analysts, stable and capable to handle malformed PE files.

"I officially discontinued the project in April 2014 after releasing 0.3.7 (23.03.2014). However, as per user requests, in April 2018 I released a version 0.3.8 with bugfixes. That release has been downloaded 15,918 times – that exceeded my expectations. Due to the fact that this project still has a group of active users and gets positive reviews, I decided to reopen development."

v0.5.5.1 - latest

Code:

https://github.com/hasherezade/pe-bear-releases/releases/

JMP-JECXZ 09-18-2022 20:11

Surprise! PE bear is Open Source now!
Code:

https://github.com/hasherezade/pe-bear

blue_devil 11-13-2023 19:35

PE-Bear v0.6.6 released
 
PE-Bear v0.6.6

BUGFIX
  • Use NumberOfRvaAndSizes to specify the count of Data Directory entries
  • Fixed parsing of GuardCFFunctionTable
  • Fixed error in Checksum calculation
  • Fixed PE-bear hanging on loading a PE with too many sections
  • Fixed PE-bear hanging on loading a PE with too many imports

FEATURE
  • Added ImpHash
  • Added Rich Header hash
  • Added a localization option (currently supported languages: English, Chinese)


WARNING: The Windows build with vs10 suffix is built with Qt4 (legacy) - in contrast to the other builds that are with Qt5 (recommended). It is prepared for the purpose of backward compatibility with old versions of Windows (i.e. XP).


REPO:
Code:

https://github.com/hasherezade/pe-bear
RELEASE/DOWNLOAD
Code:

https://github.com/hasherezade/pe-bear/releases

blue_devil 01-09-2024 16:51

PE-Bear v0.6.7 released
 
PE-Bear v0.6.7

BUGFIX
  • Fixed parsing a PE header in file with oversized DOS stub
  • Fixed incorrectly decoded Timestamp for Borland IMAGE_RESOURCE_DIRECTORY
  • Fixed crashes on edit via hex editor. Stability improvements.
  • Validate relocation block before parsing (skip invalid)

FEATURE
  • Added Strings tab (displaying ANSI and Unicode strings)
  • Search for defined binary patterns within a selected file
  • Added detection if the loaded PE is a memory dump in a virtual format (and needs remapping)
  • Added remapping of a file with one click (new button on the Sections' Tab toolbar)

WARNING: The Windows build with vs10 suffix is built with Qt4 (legacy) - in contrast to the other builds that are with Qt5 (recommended). It is prepared for the purpose of backward compatibility with old versions of Windows (i.e. XP).

REPO:
Code:

https://github.com/hasherezade/pe-bear
RELEASE/DOWNLOAD:
Code:

https://github.com/hasherezade/pe-bear/releases


All times are GMT +8. The time now is 07:29.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX