PE-bear v0.3.7 (x86 & x64 & Linux)

[blue_devil]

PE-Bear v0.6.7

BUGFIX

• Fixed parsing a PE header in file with oversized DOS stub
• Fixed incorrectly decoded Timestamp for Borland IMAGE_RESOURCE_DIRECTORY
• Fixed crashes on edit via hex editor. Stability improvements.
• Validate relocation block before parsing (skip invalid)

FEATURE

• Added Strings tab (displaying ANSI and Unicode strings)
• Search for defined binary patterns within a selected file
• Added detection if the loaded PE is a memory dump in a virtual format (and needs remapping)
• Added remapping of a file with one click (new button on the Sections' Tab toolbar)

WARNING: The Windows build with vs10 suffix is built with Qt4 (legacy) - in contrast to the other builds that are with Qt5 (recommended). It is prepared for the purpose of backward compatibility with old versions of Windows (i.e. XP).

REPO:

https://github.com/hasherezade/pe-bear

RELEASE/DOWNLOAD:

https://github.com/hasherezade/pe-bear/releases