pe-format

Lightweight native Windows memory scanner for AV/EDR platforms, detecting suspicious mapped images and manual DLL injection techniques by IAT thunk

滴水逆向 PE32 学习静态库：头与节、RVA/FOA、导入导出、重定位与资源表；供多个练习项目共享。

A Steam installation of The Murder of Sonic the Hedgehog (SEGA, 2023), measured file by file: 178 files, 468,913,725 bytes; four UnityFS bundles opened with residue 0; 996,569,296 headerless side-file bytes attributed, 433 left over; and 124 of 137 binaries carrying a hash where a date should be. No game assets here, only measurements.

PE unpacker built on the Win32 Debug API — OEP detection, memory dump and IAT reconstruction (C++)

A bytecode-based cross platform linker

EXE Checksum manipulator

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

An independently-obtainable tool that objectively reports the observable capabilities of a desktop pet binary. No verdicts, no badges, no safety claims.

Implementation of the packing detection heuristic from the paper "Packed PE File Detection for Malware Forensics" of Han et al.

Deadly Premonition: The Director's Cut (Access Games, Windows 2013) measured as a live GOG installation. 930 files, 6.86 GB, program 0.157677 %. A 2.2 GB archive indexed by 14,328 absolute paths off the developer's own disk, and the same 643 minutes of sound shipped twice in two codecs.

A Python script for analyzing Portable Executable (PE) files.

Extrator rápido em C++ nativo para metadados de executáveis Windows, incluindo hash, cabeçalhos PE, tamanho da imagem, data de compilação e assinatura digital.

Windows PE analyser built from scratch — raw struct parsing, entropy analysis, import table walking, 11 scored detection rules. 44 tests, zero dependencies.

Hands-on PE format internals lab — headers, sections, data directories, TLS, AoEP, packer detection & UPX unpacking, payload injection (.text/.rsrc/.data/XOR/Base64), and packed malware analysis using pestudio, pe-bear, malcat, x64dbg & more.

Structural diff tool for Portable Executable files — compares headers, sections, imports, exports between two .exe or .dll binaries. Pairs with pe-walker.

astra制作的机器码俄罗斯方块 — 13.5 KiB Windows x64 GUI game built from hand-encoded machine bytes. No packaged runtime.

Electron 在 Windows 上「原生 confirm/alert 关闭后键盘输入失效」的修复：二进制补丁自动定位 TaskDialogIndirect 调用点，新增 .fix 段，并由 helper 进程完成「切走再切回」重新激活渲染进程。附原理、12 条踩坑与错误码速查。

C89, single header, nostdlib executable file/format builder (EFB).

Usermode hook detection tool for Windows — detects inline hooks and IAT hooks via remote PE parsing with ImGui interface

A library for parsing and modifying PE files