PE-Bear v0.6.7
BUGFIX- Fixed parsing a PE header in file with oversized DOS stub
- Fixed incorrectly decoded Timestamp for Borland IMAGE_RESOURCE_DIRECTORY
- Fixed crashes on edit via hex editor. Stability improvements.
- Validate relocation block before parsing (skip invalid)
FEATURE- Added Strings tab (displaying ANSI and Unicode strings)
- Search for defined binary patterns within a selected file
- Added detection if the loaded PE is a memory dump in a virtual format (and needs remapping)
- Added remapping of a file with one click (new button on the Sections' Tab toolbar)
WARNING:
The Windows build with vs10 suffix is built with Qt4 (legacy) - in contrast to the other builds that are with Qt5 (recommended). It is prepared for the purpose of backward compatibility with old versions of Windows (i.e. XP).
REPO:
Code:
https://github.com/hasherezade/pe-bear
RELEASE/DOWNLOAD:
Code:
https://github.com/hasherezade/pe-bear/releases