PE Anatomist

[TQN]

Check with last version, 0.2.11320.1732
PEAnatomist will crash with DLLs that export API by oridinal when click on Export at tree left
For examples, check with all MFC Dlls: Mfcxxx.dll
And with many other Dlls

[RamMerLabs]

There is a new version (0.2.11322.0120) aimed at fixing exactly this error.
I don't always post on the forum about new versions. It will be safer to check for a new version on the program's website or via the RSS feed.

EDIT:

Update 0.2.11401.0000 (2023-02-01):

• Fixed bug with listing records in dotNet VTableFixups table
• Fixed handling of WM_CANCELMODE in some dialogs
• Fixed determining of Cpp EH RVA in IMAGE_LOAD_CONFIG_DIRECTORY.SEHandlerTable table in some cases

Homepage # Changelog # PEAnatomist 0.2

[RamMerLabs]

Update 0.2.11511.1500 (2023-03-11):

• Added parsing of Export, Import and DelayImport tables for emulated architecture in ARM64X
• Updated IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICS flag values (WinBuild 25309)
• Fixed a number of errors in processing PE and OBJ

Homepage # Changelog # PEAnatomist 0.2

[RamMerLabs]

Update 0.2.11909.2000 (2023-07-09):

• Added support for DBG and MS PDB (Program Database) files
• Added reading Codeview version C11 in all supported file formats
• Fixed loading some PE with overlay
• Fixed error counting IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE records in the DVRT table
• Description of RVA in PE is supplemented with information about method addresses from the dotNet VTableFixups table

The size of supported MS PDBs is limited to ~700 MB as a result of mapping the entire file into the address space of a 32bit process.
Opening large files may be slightly delayed, it takes time to build indexes of Codeview types from TPI and IPI.
The program works with MS PDB in MSF v7 (DS) format, MSF v2 (JG) format is not supported yet.

Homepage # Changelog # PEAnatomist 0.2

[RamMerLabs]

Update 0.2.11931.2211 (2023-07-31):

• Added support for MS PDB debug information files in MSF version 2 (JG) format
• Fixed a number of errors in working with PDB
• Fixed flag description error in Ready2Run header

Homepage # Changelog # PEAnatomist 0.2

[RamMerLabs]

Update 0.2.12104.1940 (2023-09-04):

• Added support for long section names in PE and OBJ for the case when the size of the COFF string table exceeds 9999999 bytes
• Fixed possible OOB reading during description preparation for some CodeView symbols in PDB
• Fixed processor architecture description error in Codeview symbol S_HYBRIDRANGE

Homepage # Changelog # PEAnatomist 0.2

[RamMerLabs]

Update 0.2.12223.1950 (2023-10-23):

• The description for RVA is supplemented with information from many tables, such as ExceptionData, .net Metadata, Ready2Run, HybridPE
• Added decoding of fixup signatures in the R2R section READYTORUN_SECTION_IMPORT_SECTIONS
• Added parsing of R2R section READYTORUN_SECTION_INSTANCE_METHOD_ENTRYPOINTS
• Fixed a number of bugs

Homepage # Changelog # PEAnatomist 0.2

[RamMerLabs]

Update 0.2.12224.1953 (2023-10-24):

• Fixed buffer overflow when copying lines containing RVA descriptions for methods from the READYTORUN_SECTION_INSTANCE_METHOD_ENTRYPOINTS table to the clipboard
• Fixed a bug in copying lines containing RVA descriptions for .net metadata tokens, Ready2Run and .net method and type signatures to the clipboard

Homepage # Changelog # PEAnatomist 0.2

[RamMerLabs]

Update 0.2.12506.0000 (2024-01-06):

• Eliminated a crash due to the false positive detect of some PE-files as containing a VB5/6-specific headers
• Added ExceptionsData table parsing for DEC Alpha and Alpha64 in PE
• Added handling of exception unwinding information for DEC Alpha and Alpha64 in PE
• Added recognition of VisualBasic 5/6 specific headers for DEC Alpha
• Significantly expanded support for Visual Basic 5/6-specific headers and structures in PE
• Added several new settings

Homepage # Changelog # PEAnatomist 0.2

[RamMerLabs]

Update 0.2.12509.1612 (2024-01-09):

• Fixed a use-after-free error on the CxxFH3, CxxFH4 tabs of the exception unwinding detail pages (all supported architectures) and the SEH table (x86)

Homepage # Changelog # PEAnatomist 0.2

[RamMerLabs]

Update 0.2.12517.1445 (2024-01-17):

• Fixed an error converting RVA from the OMAP_TO_SRC and OMAP_FROM_SRC tables in DBG files
• Fixed error in generating method signatures for VisualBasic5/6 if a built-in control is used as a data type
• Fixed an error displaying S_ENVBLOCK property values

Homepage # Changelog # PEAnatomist 0.2

[RamMerLabs]

Update 0.2.12915.2200 (2024-05-15):

• Implemented the ability to work with PDB files of any size (including those exceeding 4 GB) allowed by the MSFv7 format
• Added parsing of tables with CodeView data in PDB: DEBUG_S_FILECHKSMS, DEBUG_S_CROSSSCOPEIMPORTS, DEBUG_S_CROSSSCOPEEXPORTS
• Viewing the contents of PE file resources has been moved from a separate dialog to a built-in one
• Fixed a number of bugs

Homepage # Changelog # PEAnatomist

[RamMerLabs]

Update 0.2.13012.1820 (2024-06-12):

• Fixed a program crash due to writing outside the allocated buffer when working with some PDBs
• The set of collected information from the tables CORCOMPILE_IMPORT_SECTION, CORCOMPILE_VERSION_INFO, CORCOMPILE_DELAYLOADINFO has been expanded for different versions of NGEN

Homepage # Changelog # PEAnatomist

[RamMerLabs]

Update 0.2.13218.1416 (2024-08-18):

• Several bugs have been fixed
• Clarified description of several values from Rich signatures
• Added parsing of CORCOMPILE_HEADER and CORCOMPILE_VERSION_INFO headers for NGEN from preview versions of dotNet 1.2, 2.0, 4.5.2, 4.5.3

Homepage # Changelog # PEAnatomist