Install PE-bear

About PE-bear

PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files.

What's new in 0.7.2

BUGFIX - Removed hard-coded limit of the displayed resources (only 50 were visible) - Fixed GUI behavior on Windows 11 (i.e. invisible selection in hex editor and disasm view), fixed editing content in hex editor - Fixed crashing on fast editing content in hex edit - Fixed crashing when closing the signature search window before the search finished - Other small fixes FEATURE - Added Japanese language - In hex editor: any selected number can be now interpreted as an address within the PE and followed on demand via context menu (read more here) - Added string search (ANSI and Unicode) - as another option along to signature search (read more here) - In signature search: if it is defined by the string with odd length, assume that the last nibble is a wildcard rather than dropping the byte (i.e. 123 will be interpreted as 12 3?) - In hex editor: in addition to NOP/clear of the selected ranges, you can fill them with a custom character (read more here) - In Diff Window: unified a toolbar for both views WARNING: The Windows build with vs10 suffix is built with Qt4 (legacy) - in contrast to the other builds that are with Qt5, Qt6 (recommended). It is prepared for the purpose of backward compatibility with old versions of Windows (i.e. XP). ─────────────────────────────────────────────┬───────┬─────────────────────────┬─────────────────────────────────────┬───────────────────────────────────────────── File │Qt │OS │Depends │Info ─────────────────────────────────────────────┼───────┼─────────────────────────┼─────────────────────────────────────┼─────────────────────────────────────...

Read release notes

Version history