PE Anatomist

[billon]

https://rammerlabs.alidml.ru/index-eng.html

PE Anatomist shows almost all known data structures inside a PE file and makes some analytics

Overview

Spoiler!   

[Mod note: dead image links.]

Code: Select all

[img]https://rammerlabs.alidml.ru/images/peanatomist/headers-opt.PNG[/img]

[img]https://rammerlabs.alidml.ru/images/peanatomist/importtable.PNG[/img]

[img]https://rammerlabs.alidml.ru/images/peanatomist/relocs-ix86.PNG[/img]

Settings in application folder

[billon]

Added to the database, please vote

[DropD]

The images on your OP is not loading up.

[__philippe]

PEanatomist changelog history, since VERSION 0.1.2.57 (2019-10-18)
https://rammerlabs.alidml.ru/changelog-eng.html

Note about locating the configuration file PEanatomist.cfg

This binary file (which maintains, among other snippets, a list of the recently scanned PE's)
might have been created by early versions of PEanatomist and installed in the Win XP/Win7 %appdata% directory.

The file may be moved manually to the current PEanatomist directory, for the sake of
keeping related components together (Did I hear portability ?... )

Quickly locating %appdata%

Code: Select all

C:\>echo %appdata%
C:\Documents and Settings\ThinkPad R61i\Application Data

[Midas]

Topic update: PE Anatomist v02.12224.1953 released 2023-10-24 (changelog at https://rammerlabs.alidml.ru/changelog-eng.html).

So, here's the missing screencap in PE Anatomist's forum topic: