petoolse / petools Goto Github PK
View Code? Open in Web Editor NEWPE Tools - Portable executable (PE) manipulation toolkit
Home Page: https://petoolse.github.io/petools
License: MIT License
PE Tools - Portable executable (PE) manipulation toolkit
Home Page: https://petoolse.github.io/petools
License: MIT License
I am trying to dump a program that is 64-bit, for some reason it doesn't let me.
I recorded a video of me trying to dump the program which can be viewed here:
Is there anything that I am doing wrong? I am using the latest version from GitHub + the program opens as administrator, so I have no idea what I am doing wrong. Thank you!
What is this new version doing that would cause half the world's AVs to flag it, and make Chrome refuse to download it with no option to continue at own risk?
v1.5 only triggers 3 AVs, and isn't flagged by Chrome.
Понятно, что пользовать программы достаточно умный человек. Reversing Engineering привлекает далеко не простых глупых людей, но тем неменее нужно бы решить проблему с этим warning-ом. Возможно дописать мини-инструкцию куда-либо с описанием почему оно появляется и чем грозит, если грозит, пользователю? Если ничего нельзя сделать, то пояснить как пользователю это поправить у себя в системе
Why is this project being hosted on GitHub without its sources being available? Have you ever considered making it open? What is the point of hosting proprietary software on Git?
Once you add a new dll into Import Section the existing "Digital Signatures" tab stops to show in File Properties
Open up your exe with Digital Signature present
go to Directories -> Import Directory
Right click on dll list, click "Add Imports..."
Fill in
click OK
Save your file
open up File properties in explorer - "DIgital SIgnatures" section is gone.
Here is a visual comparison of added section data (left) and old certificate data that was corrupted (right)
Tool used - http://prntscr.com/jbcee0
The "File Alignment" Setting under "PE Rebuilder" in the preferences does not change the file alignment on the executable while rebuilding. It seems that the file alignment is defaulted to 1024 (400 in hex), regardless of the setting.
I downloaded PE Tools v1.9.762.2018, which was the latest release in this github repository, and extracted the 7z archive with WinRAR. When I tried to run it, avast warned me that it was a PUP. I put the exe file into virustotal, and got back bad results:
Virustotal Scan
When IMAGE_BASE_RELOCATION.VirtualAddress
is equal to zero, PE Tools interrupts listing of relocations. But Windows PE loader checks only address range (OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress.Size
).
Reported by ntldr
Sorry to bother, but do you have any Idea on how to calculate the entry point of a PE Executable. Since the source code is unavailable I have no idea on how petools does it and was wondering you could tell me.
Section Add - Virtual Address Alignment
Incorrect calculation of Virtual Address
while adding new section.
Example with PETools.exe
. Adding section, getting wrong values.
PETools.exe
in PE Tools (not running copy, sure).Previous section:
Name | Value | Remaks |
---|---|---|
Raw Size | 00006400 |
|
Raw Offset | 00112A00 |
|
Virtual Size | 00006360 |
|
Virtual Address | 0011B000 |
New section:
Name | Value | Remaks |
---|---|---|
Raw Size | 00000200 |
|
Raw Offset | 00118E00 |
|
Virtual Size | 00001000 |
|
Virtual Address | 0011C000 |
Invalid. Should be 00122000 |
It is not clear why the disassembler shows just 2 bytes decoded
Expectation is to have all the section (or say 1K) to be disassembled
Drop a file onto the tool, go to the Section Editor
Locate .text section (this is a file compiled by MS VS)
Right click - Disassemble Section
just 2 bytes (CC) being disassembled:
http://prntscr.com/jg8go0
is it a known limitation or... ?
At the same time other sections when asked are showing way much more asm lines
By some reason change the DLL Names on Import Directory is not possible with this PE Tools build.
This don't occurs with olders PE Tools versions (tested with v1.5 RC7)
Files used: megatools-1.10.2-win32.zip (3833 kB) , https://megatools.megous.com/
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.