PE-bear v0.3.7 (x86 & x64 & Linux)
 

Download :



x86


x64


Linux

PE-bear

PE-bear is a freeware reversing tool for PE files. Its objective was to deliver fast and flexible “first view” tool for malware analysts, stable and capable to handle malformed PE files.

"I officially discontinued the project in April 2014 after releasing 0.3.7 (23.03.2014). However, as per user requests, in April 2018 I released a version 0.3.8 with bugfixes. That release has been downloaded 15,918 times – that exceeded my expectations. Due to the fact that this project still has a group of active users and gets positive reviews, I decided to reopen development."

v0.5.5.1 - latest

Surprise! PE bear is Open Source now!

PE-Bear v0.6.6 released
 

PE-Bear v0.6.6

BUGFIX

• Use NumberOfRvaAndSizes to specify the count of Data Directory entries
• Fixed parsing of GuardCFFunctionTable
• Fixed error in Checksum calculation
• Fixed PE-bear hanging on loading a PE with too many sections
• Fixed PE-bear hanging on loading a PE with too many imports

FEATURE

• Added ImpHash
• Added Rich Header hash
• Added a localization option (currently supported languages: English, Chinese)

WARNING: The Windows build with vs10 suffix is built with Qt4 (legacy) - in contrast to the other builds that are with Qt5 (recommended). It is prepared for the purpose of backward compatibility with old versions of Windows (i.e. XP).


REPO:
RELEASE/DOWNLOAD

PE-Bear v0.6.7 released
 

PE-Bear v0.6.7

BUGFIX

• Fixed parsing a PE header in file with oversized DOS stub
• Fixed incorrectly decoded Timestamp for Borland IMAGE_RESOURCE_DIRECTORY
• Fixed crashes on edit via hex editor. Stability improvements.
• Validate relocation block before parsing (skip invalid)

FEATURE

• Added Strings tab (displaying ANSI and Unicode strings)
• Search for defined binary patterns within a selected file
• Added detection if the loaded PE is a memory dump in a virtual format (and needs remapping)
• Added remapping of a file with one click (new button on the Sections' Tab toolbar)

WARNING: The Windows build with vs10 suffix is built with Qt4 (legacy) - in contrast to the other builds that are with Qt5 (recommended). It is prepared for the purpose of backward compatibility with old versions of Windows (i.e. XP).

REPO:
RELEASE/DOWNLOAD:

PE-Bear v0.7.0.4
 

PE-Bear v0.7.0.4 (13.04.2025)

PE-Bear v0.7.0.4

BUGFIX

• Fixed crash on adding import via wizard (import AutoAdd)
• Fixed crash on the attempt to move a Data Directory into a section with not enough space
• Fixed comparison window in Qt4 version
• Always display the main menu on the top of window (issue with some themes on Linux and MacOS)
• Other small fixes

FEATURE

• In Qt6 version: automatically use the Dark Theme if the Dark Mode was selected in the system

WARNING: The Windows build with vs10 suffix is built with Qt4 (legacy) - in contrast to the other builds that are with Qt5 (recommended). It is prepared for the purpose of backward compatibility with old versions of Windows (i.e. XP).

REPO:
RELEASE/DOWNLOAD:

Pe-Bear v0.7.1
 

Pe-Bear v0.7.1 released 26.04.2025

BUGFIX

• Important stability fixes. Fixed crashing on file resizing. (Issue #66)
• Fixed file resizing via editing values in General Panel
• Fixed resetting to the default system language when en_US was selected (Issue #67)
• Improved Chinese translation to follow changes in the interface (Issue #68)
• Internal refactoring

Repo
Download