# 7zip is a cheap DLL deconstructor

**URL:** <https://clarionhub.com/t/7zip-is-a-cheap-dll-deconstructor/7062>\
**Category:** tips\
**Tags:** dll\
**Created:** [March 27, 2024, 5:38pm UTC](https://clarionhub.com/t/7zip-is-a-cheap-dll-deconstructor/7062 "2024-03-27T17:38:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jslarve](https://clarionhub.com/letter_avatar_proxy/v4/letter/j/e480ec/32.png) [@jslarve](https://clarionhub.com/u/jslarve)\
**Post date:** [March 27, 2024, 5:38pm UTC](https://clarionhub.com/t/7zip-is-a-cheap-dll-deconstructor/7062/1 "2024-03-27T17:38:47Z")

</div>

Accidentally discovered that if you double click on a DLL within 7zip, you get a cheap version of a PE Explorer.

You can get at the resources, certificate, and whatever else you can get to 🙂

![image](https://clarionhub.com/images/transparent.png)

It doesn't have to be inside a zip file. 7Zip just treats executables like folders.

---

<div class="post-metadata">

**Author:** ![jslarve](https://clarionhub.com/letter_avatar_proxy/v4/letter/j/e480ec/32.png) [@jslarve](https://clarionhub.com/u/jslarve)\
**Post date:** [March 27, 2024, 8:27pm UTC](https://clarionhub.com/t/7zip-is-a-cheap-dll-deconstructor/7062/2 "2024-03-27T20:27:52Z")

</div>

It also works on OCXs and 64 bit stuff

---

<div class="post-metadata">

**Author:** ![CarlBarnes](https://clarionhub.com/user_avatar/clarionhub.com/carlbarnes/32/1859_2.png) [@CarlBarnes](https://clarionhub.com/u/CarlBarnes)\
**Post date:** [March 27, 2024, 9:44pm UTC](https://clarionhub.com/t/7zip-is-a-cheap-dll-deconstructor/7062/3 "2024-03-27T21:44:47Z")

</div>

Cool, but limited … unless double clicking on the parts shows more?

There are multiple [PE Format](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format) file Viewer / Explorer / Tools / Editors that show much more information. Some are free. I sometimes want to see the NT Header records, Imports and Exports.

Here are a few I found searching:

> **[PE Viewer for Windows - Free download and software reviews - CNET Download](https://download.cnet.com/pe-viewer/3000-2352_4-10966763.html)**
>
> Download PE Viewer latest version for Windows free. PE Viewer latest update: November 20, 2012

> **[PE Tools](https://petoolse.github.io/petools/)**
>
> Portable executable (PE) manipulation toolkit

> **[GitHub - horsicq/XPEViewer: PE file viewer/editor for Windows, Linux and...](https://github.com/horsicq/XPEViewer)**
>
> PE file viewer/editor for Windows, Linux and MacOS.

$70 license - [http://www.pe-explorer.com/](http://www.pe-explorer.com/)

> **[Five PE Analysis Tools Worth Looking At - ThreatDown by Malwarebytes](https://www.threatdown.com/blog/five-pe-analysis-tools-worth-looking-at/)**
>
> In the world of malware analysis, having the right tools can make all the difference. Fortunately, there are many to choose from.

* * *

PEView is one I have and use. EXE is only 66 KB.

Below is capture of AllFiles.DLL from DLL Tutor

 ![image](https://clarionhub-uploads.s3.eu-north-1.amazonaws.com/original/2X/2/2d4050cc80913c0f9638ed96cc6a6fff17426871.png)

The Exports of Updates.DLL:

 ![image](https://clarionhub-uploads.s3.eu-north-1.amazonaws.com/original/2X/8/8065f50ed730ff0423f274a3d980dd9a0aeeda83.png)

---

<div class="post-metadata">

**Author:** ![jslarve](https://clarionhub.com/letter_avatar_proxy/v4/letter/j/e480ec/32.png) [@jslarve](https://clarionhub.com/u/jslarve)\
**Post date:** [March 27, 2024, 9:52pm UTC](https://clarionhub.com/t/7zip-is-a-cheap-dll-deconstructor/7062/4 "2024-03-27T21:52:45Z")

</div>

Yeah, it’s limited. But I’ll use it for getting resources/images because in some ways it’s easier than firing up PE Explorer [http://www.heaventools.com/overview.htm](http://www.heaventools.com/overview.htm)

In addition to your suggestions, a dev I follow on Mastodon has this app, as well. [GitHub - hasherezade/pe-bear: Portable Executable reversing tool with a friendly GUI](https://github.com/hasherezade/pe-bear)