Accidentally discovered that if you double click on a DLL within 7zip, you get a cheap version of a PE Explorer.
You can get at the resources, certificate, and whatever else you can get to
It doesn’t have to be inside a zip file. 7Zip just treats executables like folders.
6 Likes
It also works on OCXs and 64 bit stuff
Cool, but limited … unless double clicking on the parts shows more?
There are multiple PE Format file Viewer / Explorer / Tools / Editors that show much more information. Some are free. I sometimes want to see the NT Header records, Imports and Exports.
Here are a few I found searching:
$70 license - http://www.pe-explorer.com/
In the world of malware analysis, having the right tools can make all the difference. Fortunately, there are many to choose from.
Est. reading time: 7 minutes
PEView is one I have and use. EXE is only 66 KB.
Below is capture of AllFiles.DLL from DLL Tutor
The Exports of Updates.DLL:
1 Like
Yeah, it’s limited. But I’ll use it for getting resources/images because in some ways it’s easier than firing up PE Explorer PE Explorer: PE Editor, EXE File Editor Tool, DLL Reader, Disassembler, Delphi Resource EXE DLL Editing Software.
In addition to your suggestions, a dev I follow on Mastodon has this app, as well. GitHub - hasherezade/pe-bear: Portable Executable reversing tool with a friendly GUI
1 Like