Page 1 of 2
PPEE - Professional PE file Explorer
Posted: Fri Apr 22, 2016 11:45 am
by billon
https://mzrst.com/
PPEE (puppy) is a Professional PE file Explorer for reversers, malware researchers and those who want to statically inspect PE files in more details.
Puppy is free and tries to be small, fast, nimble and friendly as your puppy!
Features
Puppy is robust against malformed and crafted PE files which makes it handy for reversers, malware researchers and those who want to inspect PE files in more details. All directories in a PE file including Export, Import, Resource, Exception, Certificate(Relies on Windows API), Base Relocation, Debug, TLS, Load Config, Bound Import, IAT, Delay Import and CLR are supported.
- Both PE32 and PE64 support
- Parsing exe, dll, sys, scr, drv, cpl, ocx and more
- Entropy and MD5 calculation of the sections and resource items
- View strings embedded in files
- Built in hex editor
- Edit most of the data directory structures
- Descriptive information for data members
- Refresh, Save and Save as menu commands
- List view columns can sort data in an appropriate way
- Plugin enabled
There are lots of tools out there for statically analyzing malicious binaries, but they are ordinary tools for ordinary files. Puppy is a lightweight yet strong tool for static investigation of suspicious files. A companion plugin is also provided to take one-click technical information about the file such as its size, entropy, attributes, hashes, version info and so on.
DL -
https://mzrst.com/puppy/PPEE(puppy)%201.05.zip (91.44 KB)
Portable/Stealth
Alternative to corrupted pestudio
Re: PPEE - Professional PE file Explorer
Posted: Fri Apr 22, 2016 5:54 pm
by I am Baas
That is a nice find; thanks for posting about PPEE, billon.
Tested v1.05:
Portable
billon wrote:Alternative to corrupted pestudio
That is an unfair comment
Re: PPEE - Professional PE file Explorer
Posted: Thu Jul 07, 2016 11:04 pm
by billon
Current version:
1.06 (2016-07-08)
- GUI is improved
- Anomaly detection added
- Check update menu item added
- Toolbar and Statusbar Added
- Added RightClick context menu to copy or search
- Dump Sections, Resources and .Net assembly directories
- Separated items for URL, Registry, File strings
- Minor bugs in .Net directory fixed
- Fuzzy hash(ssdeep) support by plugin
Re: PPEE - Professional PE file Explorer
Posted: Fri Jul 08, 2016 5:16 am
by Midas
I completely missed this topic.
PPEE (
Puppy? Looks like
peepee from here...
) is a great find. Will test ASAP.
Re: PPEE - Professional PE file Explorer
Posted: Fri Jul 08, 2016 7:30 am
by __philippe
Good find indeed.
Only annoyance so far: lacking tooltips for a few non-intuitive toolbar icons.
Just dropped PPEE's developer a suggestion to remedy this minor lapse.
Re: PPEE - Professional PE file Explorer
Posted: Fri Jul 08, 2016 1:11 pm
by TP109
79kB download, 93kB installed. Very fast and snappy. Works on XP too.
Re: PPEE - Professional PE file Explorer
Posted: Sun Jul 10, 2016 4:31 am
by __philippe
A little bird told me
PPEE tooltips are forthcoming...
Ask and thou shalt be given, and there will be joy forever after... 
Re: PPEE - Professional PE file Explorer
Posted: Sat Sep 10, 2016 11:12 am
by billon
Current version:
1.07 (2016-09-10)
- Virustotal and OPSWAT's Metadefender query report is added to the plugin (Without submitting the file)
- Suspicious strings treeview item added (Customizable via Suspicious.txt file)
- Timedate stamp now shown in UTC standard, with days passed
- Statusbar shows basic PE info
- Minor bug fixes
From
ReadMe.txt:
Greetings
--------------
... __philippe ...
Re: PPEE - Professional PE file Explorer
Posted: Sun Sep 11, 2016 7:25 am
by __philippe
@billon
Cor Blimey, the little bird did come home to roost indeed...
Re: PPEE - Professional PE file Explorer
Posted: Sun Oct 09, 2016 12:38 pm
by smaragdus
When I try to open
PPEE web-site I got a warning that
This Connection is Untrusted.
Re: PPEE - Professional PE file Explorer
Posted: Sun Oct 09, 2016 1:20 pm
by deathcubek
smaragdus wrote:When I try to open
PPEE web-site I got a warning that
This Connection is Untrusted.
Looks like their TLS certificate
expired this Sunday:
mzrst.com verwendet ein ungültiges Sicherheitszertifikat.
Das Zertifikat ist am Sonntag, 9. Oktober 2016 01:59 abgelaufen. Die aktuelle Zeit ist Sonntag, 9. Oktober 2016 22:56.
They will need to buy a new certificate for their domain. Or switch to a free service like "Let's Encrypt", which will constantly renew your certificate...
Re: PPEE - Professional PE file Explorer
Posted: Wed Oct 12, 2016 6:37 pm
by smaragdus
@deathcubek
Thanks for the detailed explanation. Now
PPEE web-site is back to normal.
Re: PPEE - Professional PE file Explorer
Posted: Wed Dec 21, 2016 7:07 pm
by billon
Re: PPEE - Professional PE file Explorer
Posted: Thu Dec 22, 2016 2:56 am
by __philippe
Voted.
Tiny
PPEE (108kb) has supplanted
PEstudio (3Mb) as my preferred PE explorer utility.
Looking forward to future updates.
Re: PPEE - Professional PE file Explorer
Posted: Thu Dec 22, 2016 5:49 pm
by smaragdus
@billon
Thank you for taking your time to add
Professional PE Explorer to the
database, its place there is well-deserved.