{"id":3152,"date":"2015-08-15T12:30:29","date_gmt":"2015-08-15T12:30:29","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=3152"},"modified":"2015-08-15T12:33:19","modified_gmt":"2015-08-15T12:33:19","slug":"two-pe-tools-you-might-have-never-heard-of-now-you-do","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2015\/08\/15\/two-pe-tools-you-might-have-never-heard-of-now-you-do\/","title":{"rendered":"Two PE tools you might have never heard of. Now you do."},"content":{"rendered":"<p>There are tones of PE tools out there and lots of them are rehashing the very same ideas over and over again. It is easy to find numerous PE viewers, PE editors, PE dumpers, PE identification tools and so on and so forth. It is sad to see that many of them rarely reach quality and usability levels as the good-ol&#8217; LordPE, PE Tools, or PEiD.<\/p>\n<p>Still, there are gems out there that are not very popular, yet it is really worth having them at hand during reverse engineering sessions.<\/p>\n<p>Here are two of them:<\/p>\n<h4>Extensive File Dumper<\/h4>\n<p>Pretty much everyone heard of IDA Pro and Hex-Rays Decompiler.<\/p>\n<p>But how many heard of <a href=\"https:\/\/www.hex-rays.com\/products\/decompiler\/support.shtml\">Extensive File Dumper<\/a>?<\/p>\n<p>The tool is freely available online on the Hex-Rays web page.<\/p>\n<p>Go and grab it.<\/p>\n<p>It is one of not so many dumping tools that supports crazy number of file formats &#8211; as per the Hex-Rays page:<\/p>\n<p style=\"padding-left: 30px;\">EXE, NE, LE, LX, PE, NLM, XCOFF, COFF, OMF, DBG, PRC, PEF, OS9, N64, PSX, EPOC, AR, AMIGA, ELF, ECOFF, HP SOM, GEOS, OLE2, AIF, AOF, AOUT, PE+, OMF166, MachO, XE\/XBE, JPG, CIFF, TMOBJ, MRW, TIFF, MPG, CWLIB XCP.DAT, WMF, DSO, PDB<\/p>\n<p>Notably, this is one of not so many tools available on Windows platform that parses Mac executable files &#8211; anyone wanting to view the internal info of Mac executables typically uses &#8216;otool&#8217; on Mac. Being able to view similar info on Windows is really handy.<\/p>\n<p>To spice things up, it is a multiplatform tool and Hex-Rays distributes it in 3 versions (refer to folders <em>win<\/em>, <em>mac<\/em>, <em>linux<\/em> inside efd.zip)<\/p>\n<p>Example:<\/p>\n<p>efd.exe showing info on the efd (MAC version)<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/efd_1.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3161\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/efd_1-300x162.png\" alt=\"efd_1\" width=\"300\" height=\"162\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/efd_1-300x162.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/efd_1.png 997w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/efd_2.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3163\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/efd_2-300x191.png\" alt=\"efd_2\" width=\"300\" height=\"191\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/efd_2-300x191.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/efd_2-80x50.png 80w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/efd_2.png 845w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/efd_3.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3164\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/efd_3-300x191.png\" alt=\"efd_3\" width=\"300\" height=\"191\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/efd_3-300x191.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/efd_3-80x50.png 80w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/efd_3.png 845w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<h4>Detect It Easy a.k.a. DIE<\/h4>\n<p>This is an awesome compiler\/packer detector available on <a href=\"http:\/\/ntinfo.biz\/\">http:\/\/ntinfo.biz\/<\/a>.<\/p>\n<p>The reason why it stands out?<\/p>\n<p>Here are a couple:<\/p>\n<ul>\n<li>The author uses a dedicated signature engine to detect various types of files (not only PE)<\/li>\n<li>It recognizes nearly 1000 file types<\/li>\n<li>PE detection is based not only on patterns, but also on more complex algorithms &#8211; it can not only determine that a file is compiled f.ex. with Microsoft Visual Studio &#8211; it also give you the most probable version of the compiler + some extra info, if available<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_1.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3156\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_1-300x178.png\" alt=\"die_1\" width=\"300\" height=\"178\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_1-300x178.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_1.png 588w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<ul>\n<li>Bonus: scripts are readable and you can view\/modify algos (see <em>db<\/em> folder), or click <em>Signatures<\/em> button (after loading a file)<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_4.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3159\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_4-300x211.png\" alt=\"die_4\" width=\"300\" height=\"211\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_4-300x211.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_4.png 760w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<ul>\n<li>Bonus#2: The scripts can be debugged !<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_5.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3160\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_5-300x198.png\" alt=\"die_5\" width=\"300\" height=\"198\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_5-300x198.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_5.png 1023w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<ul>\n<li>It shows entropy of the file in a graphical way<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_2.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3157\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_2-300x204.png\" alt=\"die_2\" width=\"300\" height=\"204\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_2-300x204.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_2.png 734w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<ul>\n<li>Allows to copy snippets of data to clipboard in many ways + extract them as a binary<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_3.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-3158\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_3-300x170.png\" alt=\"die_3\" width=\"300\" height=\"170\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_3-300x170.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/08\/die_3.png 813w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<ul>\n<li>PEiD is outdated and DIE is a nice alternative to have (you may also consider others f.ex. <a href=\"http:\/\/sourceforge.net\/projects\/exeinfope\/\">Exeinfo PE<\/a>, <a href=\"http:\/\/www.rdgsoft.net\/\">RDG Packer Detector<\/a> and <a href=\"http:\/\/pid.gamecopyworld.com\/\">ProtectionID<\/a>)<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>There are tones of PE tools out there and lots of them are rehashing the very same ideas over and over again. It is easy to find numerous PE viewers, PE editors, PE dumpers, PE identification tools and so on &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2015\/08\/15\/two-pe-tools-you-might-have-never-heard-of-now-you-do\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[19,9,44],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3152"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=3152"}],"version-history":[{"count":4,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3152\/revisions"}],"predecessor-version":[{"id":3166,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3152\/revisions\/3166"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=3152"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=3152"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=3152"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}