PETools
A Windows toolkit for analyzing, editing, and manipulating Portable Executable (PE) files and processes.
What is PETools?
PE Tools is a Windows-based toolkit for manipulating Portable Executable (PE) files and processes. It provides utilities to edit PE headers, dump and rebuild executables, compare files, and analyze running processes, primarily used in reverse engineering and security research.
Security researchers, malware analysts, and low-level Windows developers who need to inspect or modify PE file structures and processes.
It offers a comprehensive, integrated suite of PE manipulation tools with a long-standing reputation in the reverse engineering community, inspired by tools like LordPE.
Overview
PE Tools - Portable executable (PE) manipulation toolkit
Use Cases
Best For
- Analyzing and editing PE file headers and sections
- Dumping and rebuilding executable files from memory
- Comparing two PE files to identify differences
- Inspecting and managing running Windows processes
- Detecting packers and analyzing PE file signatures
- Converting between virtual addresses and file offsets
Not Ideal For
- Reverse engineering ARM-based Windows PE files (e.g., for Windows IoT, Mobile, or RT)
- Handling PE files larger than 4 GB, such as modern game binaries or large applications
- Teams requiring open-source tools for security auditing, customization, or transparency
- Projects exclusively focused on 64-bit Windows environments, as the native Win64 version is still in development
Pros & Cons
Pros
Allows direct editing of PE and DOS headers, sections, and key directories like imports, exports, and TLS, providing granular low-level control for reverse engineering.
Combines editor, dumper, rebuilder, comparator, and sniffer in one application, streamlining workflows without switching between multiple tools.
Recent version 1.9 added features like entropy analysis, 64-bit disassembler, and high-DPI support, showing ongoing maintenance and relevance.
Supports Windows from XP to 10, and runs on macOS via Wine or ReactOS natively, extending usability beyond traditional Windows setups.
Cons
Cannot handle PE files over 4 GB due to lack of large file support, limiting analysis of contemporary large binaries like games or complex software.
Source code is not publicly available, preventing community contributions, security audits, and customization, which is a drawback for transparency-focused users.
Lacks ARM disassembler support and has a pending Win64 version, making it less suitable for modern platforms like Windows on ARM or 64-bit-exclusive environments.
Open Source Alternative To
PETools is an open-source alternative to the following products:
Frequently Asked Questions
Related Projects
angrA powerful and user-friendly binary analysis platform!
RetDecRetDec is a retargetable machine-code decompiler based on LLVM.
de4dot.NET deobfuscator and unpacker.
CapaThe FLARE team's open-source tool to identify capabilities in executable files.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.