|
Hi RamMerLabs,
It is a nice PE dumper at the moment.
I like how you handle things like RICH signature (not sure if someone documented it, or it is product of your own research? Anw, good job) and certificates.
Lots can be done towards improving it, though i'm not sure if it's your purpose to go towards this direction:
Make it a PE Editor, rather than a dumper (make fields editable).
Add an embedded hexeditor window, to show things like contents of buffers (or certificates).
etc, etc.
Anw, its a nice project, that at least adds something new (to the tools i was accustomed to). Good job.
|