PE Anatomist

[RamMerLabs]

Release 0.2.6 (2021-11-08):

• Fixed a number of errors in the parser of import tables for modified PE
• Updated information about new Codeview symbols from VS2022
• Clarified interpretation of some build numbers from Rich signature
• Expanded dataset for describing CoffGroups in the IMAGE_DEBUG_TYPE_POGO table
• Numerous minor fixes

Homepage # Changelog # PEAnatomist 0.2.6

[Kurapica]

Excellent work.

Respect+

[RamMerLabs]

Release 0.2.7 (2022-01-03):

• Entropy calculation with configurable block overlap for entropy graph
• Ability to save several PE resources or LIB members to a file at once
• A page describing WoW thunks in hybrid PE (ARM64EC, ARM64X)
• Fixed error in processing the exception table for emulated architecture code in hybrid PE (ARM64EC)
• Improved compatibility with certain older versions of MS Visual Studio

Homepage # Changelog # PEAnatomist 0.2.7

[RamMerLabs]

Release 0.2.8 Final (2022-03-05):

• Added display of information about IMAGE_DEBUG_TYPE_BBT (Basic Block Transformation)
• Fixed CORCOMPILE_HEADER header parsing error for .NetFramework 4.6 - 4.6.2
• Added support for IMAGE_FILE_MACHINE_POWERPCBE (Xbox 360, uncompressed PE only)
• Added support for IMAGE_REL_BASED_HIGHADJ
• Fixed a number of bugs

Homepage # Changelog # PEAnatomist 0.2.8

[Abaddon]

RamMerLabs, if you are in one of the countries involved in the current conflict, I wish that you and your family are safe and well. Same goes for any other members of this forum.
Sorry to contact you like this in a public forum, but i have no pm privileges, and no other means of reaching you.
Be safe.

[DavidXanatos]

I think the loading of exports for arm 32 bit is not quite right:
for my win 11 test machine \SysArm32\ntdll.dll's LdrLoadDll has according tho the PEAnatomist the RVA or 0x2F9F1 and the image base is 0x4B280000, however when stepping through a arm32 project LdrLoadDll is in my instance at 0x7723F9F0 with base at 0x77210000 so the RVA seams to be 0x2F9F0, 1 less than what PEAnatomist shows, also checking with IDA it says the address of that function is 0x4B2AF9F0, that minus the base address gives also 0x2F9F0 as the correct RVA.
Now that Said the peview of process hacker makes the same mistake :/
its strange that the values in the file are all off by exactly 1, its teh same for all functions I checked.
Cheep fix add -1 to the RVA if its an arm image, but I woudl preffer to understand why its so ans have a proper fix.

[RamMerLabs]

The reason is that Windows runs ARM7 in a Thumb instructions set mode. And "1" in every RVA of executive code is an indicator of this: 1 - Thumb, no 1 - no Thumb. There is no mistake, it's native.
ARM7 has 2 or 4 bytes instructions length, so this 1 in RVA doesn't affect real addresses.
BTW, it's right to apply (AND (NOT 0x1)) instead of substraction.

[RamMerLabs]

Release 0.2.9 Final Fix1 (2022-03-15):

• Fixed entropy graph drawing error on Windows 7 and newer

Homepage # Changelog # PEAnatomist 0.2.9

[RamMerLabs]

Release 0.2.10 Final Fix2 (2022-04-16):

• Fixed error displaying data from UnwindInfo CxxFH3 tables for ARM7
• Fixed CodeView symbols S_DEFRANGE_CONSTVAL_ON_ENTRY and S_DEFRANGE_GLOBALSYM_ON_ENTRY from VS2022 17.2Pre3
• Fixed leak of GDI objects when using more than one ListView column setup dialog at the same time

Homepage # Changelog # PEAnatomist 0.2.10

[RamMerLabs]

Release 0.2.11 Final Fix3 (2022-05-18):

• Fixed bug with enumeration of IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE symbol in DVRT table
• Added separate page for IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE symbol content in DVRT table (backport from 0.3.10516.1931)

Homepage # Changelog # PEAnatomist 0.2.11

[RamMerLabs]

Update 0.2.10712.2124 (2022-07-12):

• A rare error of out-of-border reading was eliminated during recognition of the exception handler kind in some PE files
• The error of out-of-border access in some distorted PE has been eliminated for the IMAGE_DIRECTORY_ENTRY_DEBUG parsing and the dotnet metadata header handling

Homepage # Changelog # PEAnatomist 0.2

[RamMerLabs]

Update 0.2.10913.2121 (2022-09-13):

• Updated list of sections and values of Ready2Run header flags from dotnet 7
• Fixed signature enumeration error in ImportSections table for Ready2Run and NGEN

Homepage # Changelog # PEAnatomist 0.2

[RamMerLabs]

Update 0.2.11108.2330 (2022-11-08):

• Fixed an error in determining RVA of the PE COFF-symbol table entries made by VS4-6 and some versions of GNU toolsets

Homepage # Changelog # PEAnatomist 0.2

[RamMerLabs]

Update 0.2.11302.1901 (2023-01-02):

• Added recognition of a number of Cpp exception handlers in the IMAGE_LOAD_CONFIG_DIRECTORY.SEHandlerTable table for x86 and parsing of FuncInfo3 structures
• Added file offset column to specified structure field for lists displaying some PE headers
• Added VolatileMetadata tab for OBJ files
• Added a number of improvements to the ExceptionsTable tab for various architectures
• Fixed several bugs

Homepage # Changelog # PEAnatomist 0.2

[RamMerLabs]

Update 0.2.11320.1732 (2023-01-20):

• Expanded support for Dynamic Value Relocations Table
• Added CORCOMPILE_HEADER header parsing for all published .NET Framework versions
• Added CORCOMPILE_VERSION_INFO header parsing for all published .NET Framework versions
• Added parsing of dotNet metadata tables from CORCOMPILE_HEADER and READYTORUN_HEADER headers
• Fixed several bugs

Homepage # Changelog # PEAnatomist 0.2