PEstudio v8.61 released 22-JUL-2017

Version 8.61 changelog:
. Increase performance when loading executable with large collection of exports
. Consolidate switches in settings.xml
. Consolidate API classification
. Fix a bug when handling the Thread-Local Storage (TLS)
. Fix a bug of the Manifest View
. Fix a bug when detecting 64-bit managed files
. Add online check of update in the "About" dialog
. Add support for ARM detection
. Indicate missing library
. Extend features of standard version


Unfortunately, the command line prompt usage "pestudio -file: typical.exe"....is broken again in v8.61,
an annoyingly recurring problem also marring former versions v7.52 / v8.13 / v8.52

Developer has been notified.

PEstudio v8.60 released 20-MAY-2017

Changelog :
. Add detection of Control Flow Guard (CFG)
. Add details for Vir*stotal view

PEstudio v8.59 released 01-MAY-2017

Changelog :
• Show first bytes (hex) of resources
• Show first bytes (hex and text) of file
• Handle empty entry-point
• Extended Indicators

PEstudio v8.58 released 21-APR-2017

Changelog :
• Fixed a crash with some 64bit executables
• Added detection of missing libraries
• Populated status-bar information : (following specifics from my own observations)
  - SHA1 hash value
  - cpu-type
  - file-type
  - subsystem (GUI/Console)
  - entry-point address
  - run-time library signature

Pestudio v8.57 (PE link date 09-APR-2017) - Released 10-APR-2017

Changelog :

. Extend translations
. Extend Exports handling
. Extend Imports handling
. Extend signatures
. Clean and Extend indicators
. Show first bytes of entrypoint
. Show first bytes of overlay
. Show dos-stub message

PEstudio 8.56 released as of 26-FEB-2017

Besides the "New in this Version" changelog entries,
here are some observed cosmetic diffs for selected v8.56 screens compared to v8.55

v8.56 Fields labels Added (A) Renamed(R)

Initial summary screen:
(R) file-version:
(R) file-description:
(A) compiler-stamp:
(A) debugger-stamp:

Dos-Stub screen:
(A) file-ratio

File-Header screen:
(R) compiler-stamp
(R) number-of-symbols

Optional-header screen:
(R) linker version

PEstudio v8.54 released as of 07-MAY-2016

Changelog
. fixed bug with libraries

PEstudio v8.53 released as of 06-MAY-2016

Changelog:

. Added indicators
. Show overlay strings numbers
. Detect duplicated exported symbols
. Enhanced unicode strings detection
. Show strings location map with colors
. Differentiate URLs referenced in the certificate
. Fixed bugs

Thankfully, the command prompt usage "Pestudio file:-typical.exe" is working
again correctly in this latest version...:-)

BTW, the PEstudio.zip file directory structure has been slightly modified;
used to be a flat structure, now includes a \pestudio\xml\ hierarchy.

PEstudio v8.52 released as of 04-APR-2016

Changelog:
. Differentiate between standard and professional (pro) versions of pestudio
. Added deletion of overlay
. Added computation of entropy
. Added detection of TLS Callback functions
. Show more details about sections
. Fixed bugs and crash

Unfortunately, the command prompt usage "Pestudio file:-typical.exe" is broken again in this latest version...:-( (It was working fine in previous v8.51)

Marc has been notified.

@__philippe: Thanks ... and updated ;)

PEstudio v8.51 released as of 17-AUG-2015

@ I am Baas: Thanks ... and updated ;)

PEstudio v8.50 is available.

@ __philippe: Thanks ... and updated ;)

PEstudio v8.49 released as of 03-MAY-2015

@ billon: Thanks ... and updated ;)

Straight from the horse's mouth (Marc's, actually...;-)

PEStudio Version 8.16 (28-MAR-2014)
. Fixed a bug when invoking PeStudio.exe from the prompt with a file

"Tested and Found True" by yours truly...;-)

Cheers,

__philippe

PEstudio v8.13:

The command prompt usage "Pestudio file:-typical.exe" is broken again as of version v8.13...:-(
(It was working fine in previous v8.11)

__philippe

@ Special: Thanks ... and updated.

It's at v8.09 as of this writing.

This program is really quite amazing for what it does, I just wish it was easier to make sense of what a lot of what it says, if the dev is reading this, maybe you could add a context menu for google searching things, like right click> google search > kernal32.dll, or wsock32.dll for people wanting to look these things up easier. And would it be possible to have it expand on some of the features it lists, like many programs will say "The Image modifies the Windows registry" but it would be nice what its doing, if possible.

One additional thing I'd like to see is a way for it to remember the window size and location with some sort of setting.ini

A ChangeLog.txt file is included within each release of PeStudio, 1st file in the zip package.

I thought it would have been nicer with a changelog, that's why I first posted a comment.

Why not just edit the entry?

v7.93 is out, can't find a changelog

@__philippe:

Thanks for the compliments!

Cheers,
Marc Ochsenmeier

@ Magibon

Thanks, but...let's render unto Caesar what belongs to Marc Ochsenmeier...;-)
I am only a mere commentator...;-)

Cheers,

__philippe

@ philippe
really like what you have done to the interface :)

thanks for your efforts.

Screenshot was outdated; corrected.

PEstudio V7.54:

Two (undocumented but welcome) bug fixes have been applied:

1. Command-prompt usage is functioning correctly again.
2. Silly oversized typeface in Manifest section has been cut back to reasonable size.

@Marc: Pourvu que cela dure, ..;-)...let's keep our fingers crossed !

Cheers,

__philippe

PEstudio V7.52:

The command prompt usage "Pestudio file:-typical.exe" is broken again as of version V7.52.
(It was working fine from V7.31 up to V7.49)

__philippe

PEstudio V741:
The typeface used in the Manifest section looks a tad overblown ...;-)

__philippe

Regarding my previous post - it seems there is a registry entry for a Borland Database Engine file, specifically 'idr20009.dll', which wasn't pointing to the right location. I'm not sure if PEStudio loads it or some other driver on my system, but its now working.

resizable GUI would be feature i'd like.

(trying to run this on a netbook)

@Ruby: the 'Current' directory will always point to the lastest version of PeStudio.

Is that 'Current' permalink to a stable or beta?
The homepage currently has PeStudio 7.00 listed.

PeStudio693.zip 06-Jun-2013 01:48 385K
PeStudio694.zip 06-Jun-2013 12:42 385K
PeStudio695.zip 07-Jun-2013 10:01 386K
PeStudio696.zip 09-Jun-2013 21:07 382K
PeStudio697.zip 11-Jun-2013 09:51 381K
PeStudio698.zip 13-Jun-2013 01:09 382K
PeStudio699.zip 14-Jun-2013 15:28 383K
PeStudio700.zip 15-Jun-2013 11:10 382K

@JayXon: Thanks ... download link changed.

There is the permalink to download the latest version. http://www.winitor.com/tools/PeStudio/Current/PeStudio.zip

Win7 x64, this program has never worked for me. I just posted about this prob at http://www.portablefreeware.com/forums/viewtopic.php?p=63325#p63325

Want to be in the loop when an update of PeStudio takes place? Follow me on Twitter! https://twitter.com/ochsenmeier

@Magibon: thanks for your input. Highlight and copy to the clipboard are on my todo list. I'll implement these features.

The developer actually listens to users! You can now dump the reports into XML file :)

Would be nice if we could just highlight, and copy into clipboard... but the XML dump is better than nothing.

Thank you developer.

Modified Download link to remove version dependency; now points to - Index of /tools - where you can choose the most recent and some previous versions

@prizm1
Thank you. Fixed.

The download button downloads v3.50 instead of v3.51

The PeStudio351.zip package is now working!

I just noticed that the PeStudio351.zip package is damaged on www.winitor.com! This will be corrected today. The previous version is still available at http://www.winitor.com/tools/PeStudio350.zip

Sorry about this inconvenience!

PeStudio 3.51 has just been released on www.winitor.com

PeStudio 3.47 has a bug when filtering the Libraries. This will be corrected very soon. Thanks.

very cool app.
this looks to be very useful :)

Thanks for the suggestion !

Download URL of PeStudio is now www.winitor.com

PeStudio 3.47 has been released. It is now faster than ever..

I tried the application with some .exe on Windows Xp and everytime the program has a runtime error...
instead it works perfectly on Windows Vista...

for any question, problem, you can directly mail to me, the developer, at info@winitor.net. Thanks.

@ Danny: thanks for using PeStudio! Please provide more info - e.g: platform, file analyzed. Thanks. I have just tried PeStudio 3.40 on W7 32-bit, with tree.com.

Darn, it still crashes when I try to open MS-DOS files. :P

@ mox: See "what's new" ;-)

PeStudio 3.38 now supports command line parameter like: pestudio.exe %1 and pestudio.exe "%1"

PeStudio 3.37 now supports a command line parameter:
e.g. pestudio.exe c:\windows\notepad.exe

PeStudio ver. 3.34 / Windows 7 x64: PeStudio GUI opens successfully but selected components fail to open.

0_o
~~~

@navinbhai: The changelog is located within the app ZIP file. It would be better if the changelog is published on the website instead.

What a program! Daily update? Even what is updated is not known.

Version 3.22 has been made available (with a changelog). Logfile is now XML based. Debug info and certificate are detected.

This feature it planned, thanks to be patient. At this point, I have set the focus on the programmatic interface (the parser - peparser.dll). The UI, which is 'only' a client application consuming the parser, will be changed in the next...days. Please tell me why you use PeStudio, what kind of features you like...and what you are missing. Thanks.

GUI is too large to work with Netbooks (1024x600). Any way to resize it?

@Bass Changelog. Of course I can. Cheers.

@marc ochsenmeier
Thanks for PeStudio. Can you add a changelog with each new version? Cheers.

PeStudio is still under development. It will soon provide command line parameters. It will also support more compressed files. Yes PeStudio (still) crashes when inspecting BitComet (which is compressed using PECompat). Thanks for your comments!

Opening BitComet.exe it crashes. When it can open BitComet.exe than it crashes at clicking on the Imported Libraries or Imported Functions.
Please help. Thanks

Feature proposal: Define binary that is to be opened via commandline parameter. That way, one could integrate calling this nice app into filemanagers (i just tried calling it from total commander via pestudio.exe %1, and noticed that this doesn't work).

PeStudio has been Updated to Version 3.15 and now can start without the Visual Studio libraries. I just tried it on a clean Windows XP SP3 box and it runs.

It was DLL-hell in my case, because i did already have that library installed - just not in the required version. Such situations were the main reason why MS began to store such libraries no longer centrally in system32, but instead in seperate directories, "to reduce DLL-hell."

Anyways, thank you for this great application. Looking forward to the next version.

Hi guys, sorry about that. I forgot to deliver these MSVC9 redistribuables! Next version will correct this. BTW, this has nothing to do with DLL-hell :-)

Hope you will enjoy the next version.

Cool. Its kinda funny when an app that is about dynamic linking, is affected by DLL-hell :)

Thank you, Lyx! Sorry about that! Noted!

P.S.: Apparently, the app will only launch if the MSVC9 update from 2008 is installed. Available here: http://www.microsoft.com/downloads/details.aspx?FamilyID=d5692ce4-adad-4000-abfe-64628a267ef0&displaylang=en

Doesn't launch here. Error-Dialog "The ordinal 7138 could not be located in the dynamic link library mfc90u.dll". This is a plain WinXP SP3 install that was kept very clean. I also tried downloading an mfc90u.dll version from the web and putting it in the app dir - no change.

Too bad, because this app looked VERY interesting.