Links:
- https://github.com/RainwayApp/MetaPod : can append data to signed pe executable
- https://docs.microsoft.com/en-us/windows/desktop/Debug/pe-format
- https://github.com/jnastarot/native_peloader : native PE loader, can load DLL from memory, apparently
- https://github.com/monocasa/exefmt : pe reader, pdb reader, in rust, early stages
- https://github.com/jnastarot/enma_pe : PE reader / writer in C++
- https://github.com/lief-project/LIEF/tree/master/src : C++ code to read pe, coff and other file formats, can also re-assemble them, ~80k loc
- https://speedtesting.herokuapp.com/peviewer/
- https://blog.malwarebytes.com/threat-analysis/2014/05/five-pe-analysis-tools-worth-looking-at/
- http://cerbero.io/peinsider/
- http://www.pe-explorer.com/
- https://github.com/Washi1337/AsmResolver : pe reader and editor library in c#
- http://www.malware-analyzer.com/pe-tools
- http://formats.kaitai.io/microsoft_pe/javascript.html
- https://codisec.com/veles/
- https://github.com/yegord/snowman/tree/master/src/nc/input/pe
- http://blog.dkbza.org/2012/08/pe-file-format-graphs.html
- http://www.pe-explorer.com/order.htm
- https://www.opswat.com/blog/closer-look-portable-executable-information
- https://bartkozpoznania.wordpress.com/2013/08/22/extracting-digital-signature-pkcs7-from-signed-pe-files/
- https://stackoverflow.com/questions/6513752/how-can-i-validate-digital-signatures-for-microsofts-portable-executable-format
- https://github.com/joxeankoret/pyew
- https://blog.didierstevens.com/programs/disitool/
- https://keyj.emphy.de/files/intro.pdf
- http://www.codeproject.com/Articles/19326/An-Analysis-of-the-Windows-PE-Checksum-Algorithm
- https://web.archive.org/web/20170301055357/http://www.csn.ul.ie/~caolan/publink/winresdump/winresdump/doc/pefile.html
- look at http://resourcelib.codeplex.com/ source code (resource section handling in pe executables)
Code:
- https://github.com/avast-tl/fileformat/tree/master/src/fileformat/file_format/pe : pe parser in C++
- https://github.com/mihailik/PE.js - PE parser in javascript (typescript) and web ui for it.
- https://github.com/Microsoft/cci/tree/master/PEReaderAndWriter/PEReader
- https://github.com/mihailik/pe.js, http://mihailik.blogspot.com/2012/12/pejs-reading-windows-binaries-in.html
- https://github.com/ng-pe/RemoveSignCode/blob/master/sources/RemoveCertificate/RemoveCertificate/Program.cs
- https://github.com/zed-0xff/pedump
- https://github.com/soluwalana/pefile-go : another Go port of pefile
- https://github.com/omarghader/pefile-go : Go port of pefile
- https://github.com/pidydx/SMRT : peid.db has signatures for detecting PE file type (packers etc.)
- https://github.com/trailofbits/pe-parse : C++ library for parsing PE files
- https://github.com/erocarrera/pefile : python library for parsing pe files
- https://github.com/coderforlife/pe-file
- https://github.com/sebdraven/verify-sigs
- https://github.com/viper-framework/pefile-tests
- https://github.com/0xd4d/dnlib/tree/master/src/PE
- https://github.com/pierricgimmig/orbitprofiler/tree/master/external/peparse
- https://github.com/hasherezade/libpeconv : C++ library and more at https://github.com/hasherezade?tab=repositories
Go to
index of articles.