pestudio v8.81 Updated

billon on 13 Aug 2018
  • 4MB (uncompressed)
  • Released on 12 Aug 2018
  • Suggested by joby_toss

pestudio shows details about applications and other system files (.exe, .dll, .cpl, ocx, .ax, .sys etc.) without starting them including:

  • Libraries that are used by an application
  • Functions that are imported by an application
  • Functions (also anonymous) that are exported by an application
  • All functions that are forwarded to other libraries
  • Obsolete Functions that are exported and imported by an application
  • If Data Execution Prevention (DEP) Windows security mechanism is used
  • If Address Space Layout Randomization (ASLR) Windows security mechanism is used
  • If Windows security mechanism Structured Exception Handling (SEH) is used
  • Whether some sections are compressed

pestudio standard lacks some features of pro version, see comparison here (PDF file!).

System Requirements: Win2K / WinXP / Vista / Win7 / Win8 / Win10
Writes settings to: None
Stealth: ? Yes
Unicode support: Yes
License: Freeware
How to extract: Download the ZIP package and extract to a folder of your choice. Delete AddToShell.reg and RemoveFromShell.reg. Launch pestudio.exe.
Similar/alternative apps: PPEE
What's new?
  • Add search google for strings view.
  • Show details of virustotal report.

84 comments on pestudio  The Portable Freeware Collection Latest Entries Feed

Lyx 2010-08-28 15:59

Doesn't launch here. Error-Dialog "The ordinal 7138 could not be located in the dynamic link library mfc90u.dll". This is a plain WinXP SP3 install that was kept very clean. I also tried downloading an mfc90u.dll version from the web and putting it in the app dir - no change.

Too bad, because this app looked VERY interesting.

Lyx 2010-08-28 16:08

P.S.: Apparently, the app will only launch if the MSVC9 update from 2008 is installed. Available here:

joby_toss 2010-08-28 18:33

Thank you, Lyx! Sorry about that! Noted!

Lyx 2010-08-28 23:34

Cool. Its kinda funny when an app that is about dynamic linking, is affected by DLL-hell :)

marc ochsenmeier 2010-08-29 02:21

Hi guys, sorry about that. I forgot to deliver these MSVC9 redistribuables! Next version will correct this. BTW, this has nothing to do with DLL-hell :-)

Hope you will enjoy the next version.

Lyx 2010-08-30 05:15

It was DLL-hell in my case, because i did already have that library installed - just not in the required version. Such situations were the main reason why MS began to store such libraries no longer centrally in system32, but instead in seperate directories, "to reduce DLL-hell."

Anyways, thank you for this great application. Looking forward to the next version.

mox 2010-08-30 16:42

PeStudio has been Updated to Version 3.15 and now can start without the Visual Studio libraries. I just tried it on a clean Windows XP SP3 box and it runs.

Lyx 2010-08-31 12:08

Feature proposal: Define binary that is to be opened via commandline parameter. That way, one could integrate calling this nice app into filemanagers (i just tried calling it from total commander via pestudio.exe %1, and noticed that this doesn't work).

Emil 2010-09-04 10:28

Opening BitComet.exe it crashes. When it can open BitComet.exe than it crashes at clicking on the Imported Libraries or Imported Functions.
Please help. Thanks

marc ochsenmeier 2010-09-21 08:46

PeStudio is still under development. It will soon provide command line parameters. It will also support more compressed files. Yes PeStudio (still) crashes when inspecting BitComet (which is compressed using PECompat). Thanks for your comments!

Baas 2010-09-21 11:03

@marc ochsenmeier
Thanks for PeStudio. Can you add a changelog with each new version? Cheers.

marc ochsenmeier 2010-09-21 12:11

@Bass Changelog. Of course I can. Cheers.

TT 2010-09-21 13:11

GUI is too large to work with Netbooks (1024x600). Any way to resize it?

marc ochsenmeier 2010-09-21 17:25

This feature it planned, thanks to be patient. At this point, I have set the focus on the programmatic interface (the parser - peparser.dll). The UI, which is 'only' a client application consuming the parser, will be changed in the next...days. Please tell me why you use PeStudio, what kind of features you like...and what you are missing. Thanks.

marc ochsenmeier 2010-09-27 15:53

Version 3.22 has been made available (with a changelog). Logfile is now XML based. Debug info and certificate are detected.

navinbhai 2010-10-03 22:24

What a program! Daily update? Even what is updated is not known.

Andrew Lee 2010-10-18 00:19

@navinbhai: The changelog is located within the app ZIP file. It would be better if the changelog is published on the website instead.

stormal 2010-10-27 13:16

PeStudio ver. 3.34 / Windows 7 x64: PeStudio GUI opens successfully but selected components fail to open.


mox 2010-11-05 09:04

PeStudio 3.37 now supports a command line parameter:
e.g. pestudio.exe c:\windows\notepad.exe

mox 2010-11-06 09:58

PeStudio 3.38 now supports command line parameter like: pestudio.exe %1 and pestudio.exe "%1"

Checker 2010-11-07 08:01

@ mox: See "what's new" ;-)

Danny 2010-11-12 15:32

Darn, it still crashes when I try to open MS-DOS files. :P

mox 2010-11-14 17:20

@ Danny: thanks for using PeStudio! Please provide more info - e.g: platform, file analyzed. Thanks. I have just tried PeStudio 3.40 on W7 32-bit, with

mox 2010-11-15 08:18

for any question, problem, you can directly mail to me, the developer, at Thanks.

Quijote 2011-01-12 22:32

I tried the application with some .exe on Windows Xp and everytime the program has a runtime error...
instead it works perfectly on Windows Vista...

pe00 2011-11-20 10:04

PeStudio 3.47 has been released. It is now faster than ever..


pe00 2011-11-20 10:05

Download URL of PeStudio is now


Magibon 2011-11-20 11:46

very cool app.
this looks to be very useful :)

Thanks for the suggestion !


pe00 2011-11-22 12:00

PeStudio 3.47 has a bug when filtering the Libraries. This will be corrected very soon. Thanks.


pe00 2011-11-30 23:28

PeStudio 3.51 has just been released on


pe00 2011-12-01 08:42

I just noticed that the package is damaged on! This will be corrected today. The previous version is still available at

Sorry about this inconvenience!


pe00 2011-12-01 08:48

The package is now working!


prizm1 2011-12-02 01:37

The download button downloads v3.50 instead of v3.51


I am Baas 2011-12-02 04:06

Thank you. Fixed.


Ruby 2011-12-07 04:58

Modified Download link to remove version dependency; now points to - Index of /tools - where you can choose the most recent and some previous versions


Magibon 2013-04-05 10:15

The developer actually listens to users! You can now dump the reports into XML file :)

Would be nice if we could just highlight, and copy into clipboard... but the XML dump is better than nothing.

Thank you developer.


marc ochsenmeier 2013-04-06 15:35

@Magibon: thanks for your input. Highlight and copy to the clipboard are on my todo list. I'll implement these features.


marc ochsenmeier 2013-04-06 15:45

Want to be in the loop when an update of PeStudio takes place? Follow me on Twitter!


Ascend4nt 2013-04-08 08:45

Win7 x64, this program has never worked for me. I just posted about this prob at


JayXon 2013-06-14 11:18

There is the permalink to download the latest version.


Checker 2013-06-14 16:09

@JayXon: Thanks ... download link changed.


Ruby 2013-06-15 19:55

Is that 'Current' permalink to a stable or beta?
The homepage currently has PeStudio 7.00 listed. 06-Jun-2013 01:48 385K 06-Jun-2013 12:42 385K 07-Jun-2013 10:01 386K 09-Jun-2013 21:07 382K 11-Jun-2013 09:51 381K 13-Jun-2013 01:09 382K 14-Jun-2013 15:28 383K 15-Jun-2013 11:10 382K


marc ochsenmeier 2013-06-17 08:49

@Ruby: the 'Current' directory will always point to the lastest version of PeStudio.


bzl333 2013-07-23 19:02

resizable GUI would be feature i'd like.

(trying to run this on a netbook)


Ascend4nt 2013-08-01 23:46

Regarding my previous post - it seems there is a registry entry for a Borland Database Engine file, specifically 'idr20009.dll', which wasn't pointing to the right location. I'm not sure if PEStudio loads it or some other driver on my system, but its now working.


__philippe 2013-09-03 08:29

PEstudio V741:
The typeface used in the Manifest section looks a tad overblown ...;-)



__philippe 2013-09-26 13:46

PEstudio V7.52:

The command prompt usage "Pestudio file:-typical.exe" is broken again as of version V7.52.
(It was working fine from V7.31 up to V7.49)



__philippe 2013-09-30 18:07

PEstudio V7.54:

Two (undocumented but welcome) bug fixes have been applied:

1. Command-prompt usage is functioning correctly again.
2. Silly oversized typeface in Manifest section has been cut back to reasonable size.

@Marc: Pourvu que cela dure, ..;-)...let's keep our fingers crossed !




Midas 2013-10-09 09:36

Screenshot was outdated; corrected.


Magibon 2013-10-28 12:41

@ philippe
really like what you have done to the interface :)

thanks for your efforts.


__philippe 2013-10-28 14:35

@ Magibon

Thanks, but...let's render unto Caesar what belongs to Marc Ochsenmeier...;-)
I am only a mere commentator...;-)




marc ochsenmeier 2013-12-08 18:10


Thanks for the compliments!

Marc Ochsenmeier


Emka 2013-12-14 16:25

v7.93 is out, can't find a changelog


guinness 2013-12-14 16:45

Why not just edit the entry?


Emka 2013-12-14 16:47

I thought it would have been nicer with a changelog, that's why I first posted a comment.


__philippe 2013-12-14 17:08

A ChangeLog.txt file is included within each release of PeStudio, 1st file in the zip package.


Special 2014-02-17 13:52

It's at v8.09 as of this writing.

This program is really quite amazing for what it does, I just wish it was easier to make sense of what a lot of what it says, if the dev is reading this, maybe you could add a context menu for google searching things, like right click> google search > kernal32.dll, or wsock32.dll for people wanting to look these things up easier. And would it be possible to have it expand on some of the features it lists, like many programs will say "The Image modifies the Windows registry" but it would be nice what its doing, if possible.

One additional thing I'd like to see is a way for it to remember the window size and location with some sort of setting.ini


Checker 2014-02-17 16:19

@ Special: Thanks ... and updated.


__philippe 2014-03-24 10:58

PEstudio v8.13:

The command prompt usage "Pestudio file:-typical.exe" is broken again as of version v8.13...:-(
(It was working fine in previous v8.11)



__philippe 2014-03-28 09:39

Straight from the horse's mouth (Marc's, actually...;-)

PEStudio Version 8.16 (28-MAR-2014)
. Fixed a bug when invoking PeStudio.exe from the prompt with a file

"Tested and Found True" by yours truly...;-)




Checker 2014-07-06 09:42

@ billon: Thanks ... and updated ;)


__philippe 2015-05-04 10:10

PEstudio v8.49 released as of 03-MAY-2015


Checker 2015-05-04 19:27

@ __philippe: Thanks ... and updated ;)


I am Baas 2015-05-06 04:49

PEstudio v8.50 is available.


Checker 2015-05-06 19:38

@ I am Baas: Thanks ... and updated ;)


__philippe 2015-08-18 09:42

PEstudio v8.51 released as of 17-AUG-2015


Checker 2015-08-18 18:34

@__philippe: Thanks ... and updated ;)


__philippe 2016-04-05 09:58

PEstudio v8.52 released as of 04-APR-2016

. Differentiate between standard and professional (pro) versions of pestudio
. Added deletion of overlay
. Added computation of entropy
. Added detection of TLS Callback functions
. Show more details about sections
. Fixed bugs and crash

Unfortunately, the command prompt usage "Pestudio file:-typical.exe" is broken again in this latest version...:-( (It was working fine in previous v8.51)

Marc has been notified.


__philippe 2016-05-06 19:22

PEstudio v8.53 released as of 06-MAY-2016


. Added indicators
. Show overlay strings numbers
. Detect duplicated exported symbols
. Enhanced unicode strings detection
. Show strings location map with colors
. Differentiate URLs referenced in the certificate
. Fixed bugs

Thankfully, the command prompt usage "Pestudio file:-typical.exe" is working
again correctly in this latest version...:-)

BTW, the file directory structure has been slightly modified;
used to be a flat structure, now includes a \pestudio\xml\ hierarchy.


__philippe 2016-05-08 08:21

PEstudio v8.54 released as of 07-MAY-2016

. fixed bug with libraries


__philippe 2017-02-27 00:07

PEstudio 8.56 released as of 26-FEB-2017

Besides the "New in this Version" changelog entries,
here are some observed cosmetic diffs for selected v8.56 screens compared to v8.55

v8.56 Fields labels Added (A) Renamed(R)

Initial summary screen:
(R) file-version:
(R) file-description:
(A) compiler-stamp:
(A) debugger-stamp:

Dos-Stub screen:
(A) file-ratio

File-Header screen:
(R) compiler-stamp
(R) number-of-symbols

Optional-header screen:
(R) linker version


__philippe 2017-04-11 11:20

Pestudio v8.57 (PE link date 09-APR-2017) - Released 10-APR-2017

Changelog :

. Extend translations
. Extend Exports handling
. Extend Imports handling
. Extend signatures
. Clean and Extend indicators
. Show first bytes of entrypoint
. Show first bytes of overlay
. Show dos-stub message


__philippe 2017-04-21 18:19

PEstudio v8.58 released 21-APR-2017

Changelog :
• Fixed a crash with some 64bit executables
• Added detection of missing libraries
• Populated status-bar information : (following specifics from my own observations)
  - SHA1 hash value
  - cpu-type
  - file-type
  - subsystem (GUI/Console)
  - entry-point address
  - run-time library signature


__philippe 2017-05-01 18:18

PEstudio v8.59 released 01-MAY-2017

Changelog :
• Show first bytes (hex) of resources
• Show first bytes (hex and text) of file
• Handle empty entry-point
• Extended Indicators


__philippe 2017-05-21 20:21

PEstudio v8.60 released 20-MAY-2017

Changelog :
. Add detection of Control Flow Guard (CFG)
. Add details for Vir*stotal view


__philippe 2017-07-23 14:09

PEstudio v8.61 released 22-JUL-2017

Version 8.61 changelog:
. Increase performance when loading executable with large collection of exports
. Consolidate switches in settings.xml
. Consolidate API classification
. Fix a bug when handling the Thread-Local Storage (TLS)
. Fix a bug of the Manifest View
. Fix a bug when detecting 64-bit managed files
. Add online check of update in the "About" dialog
. Add support for ARM detection
. Indicate missing library
. Extend features of standard version

Unfortunately, the command line prompt usage "pestudio -file: typical.exe" broken again in v8.61,
an annoyingly recurring problem also marring former versions v7.52 / v8.13 / v8.52

Developer has been notified.


__philippe 2017-08-12 19:28

PEstudio v8.62 released 12-AUG-2017

v8.62 Changelog :
• Extend resources type detection
• Extend handling of malformed manifests
• Extend handling of file signatures
• Detect "unusual" dos-stub messages

Gratefully, the CLI prompt has consented to behave decently once again,
(and forever after? - fingers crossed...)

Thanks Marc ...;-)


__philippe 2017-08-21 14:13

PEstudio v8.63 released 21-AUG-2017

v8.63 Changelog:
• Add detection of whitlelist (well-known) strings
• Add detection of deprecated functions
• Add detection of undocumented functions
• Consolidate indicators

CLI prompt working fine, thanks for asking...;-)


__philippe 2017-10-01 20:09

PEstudio v8.66 released 01-OCT-2017

v8.66 Changelog:
• Fixed a bug when computing the position of an entry-point located at the very beginning of a section
• Added detection of strings "hint" (e.g. GUID, RTTI, ..)


__philippe 2017-10-08 15:36

PEstudio v8.67 released 08-OCT-2017

v8.67 Changelog:
• Map strings "hint" to their Human-friendly name


__philippe 2017-10-30 16:20

PEstudio v8.69 released 30-OCT-2017

v8.69 Changelog:
. Add grouping of imports by types and colors
. Extend strings "hint" detection and mapping

Note the colorful "import grouping by types" is NOT available in the free version.
See comparative features availability in free and commercial versions hereafter:

For a worthy alternative to PEstudio, one might consider the recently updated PPee v1.10


__philippe 2017-11-26 12:10

PEstudio v8.70 - Link date 22-NOV-2017

v8.70 changelog:
. Expose the indicators id number in the output XML file
. Extend grouping of utilities
. Extend grouping of imports by types and colors


Midas 2017-11-26 19:37

Like noted elsewhere, unless significant for the comment exchange, program changelogs are best posted to the forum topic (or entered at the appropriate field), my dear _phillipe. B-)


__philippe 2017-11-26 21:39

All righty,... next time round,

the undersigned hereby pledge to abide by the recommendations, protocols,
procedures and regulations set forth by my Right Honourable Friend Midas,
the Member for TPFC's constituency,... cross my heart and hope to die... ;-)



Post your comment