AwesomeREA.org

Tool

PE-bear

Qt GUI to view and edit Windows Portable Executable files, meant as a fast first look for malware analysts and robust against malformed PE32 and PE64 files. It shows headers and section layout, follows raw, RVA and VA addresses, disassembles from any offset with Capstone, matches packer signatures, compares two files and unmaps dumped images.

Requirements & limits

  • Latest release: v0.7.2 (2026-06-05), with Windows Qt6 and Qt5 builds, a legacy Qt4 x86 build for old Windows such as XP, Linux tar.xz and AppImage builds and a macOS Qt6 app; Chocolatey, Scoop and WinGet also package it. The reviewed main commit of 2026-10-14 is 16 commits ahead, with a Capstone update and an unreleased update check that, per its README, queries GitHub's releases API at most once a day and sends only a PE-bear User-Agent.
  • Linux builds need a matching Qt installation, and Windows builds made with Visual Studio 2017 or later need the Visual C++ 2015–2022 redistributable. Source builds need Git, CMake 3.12+, Qt6 (or Qt5/Qt4) and the bearparser, Capstone and sig_finder submodules, with build scripts for Linux and macOS. AppVeyor builds test packages from each main commit, which README warns may be unstable.
  • Input is a PE file chosen by the analyst, including images dumped from a process, which PE-bear offers to unmap. Wiki pages cover adding imports, removing overlays, filling content and searching strings or masked byte signatures. Packer detection uses SIG.txt, converted from PEiD's UserDB by a third-party script and last updated on 2022-10-17.
  • GPL-2.0; the author's page says PE-bear has been open source since 2022-09-18, after development was discontinued in 2014 and later reopened. The bearparser and sig_finder submodules are BSD-2-Clause, and Capstone keeps its own license.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · hasherezade/pe-bear · Revision b90f1d7
  2. CMakeLists.txt GitHub · hasherezade/pe-bear · Revision b90f1d7
  3. .gitmodules GitHub · hasherezade/pe-bear · Revision b90f1d7
  4. pe-bear/updater/README.md GitHub · hasherezade/pe-bear · Revision b90f1d7
  5. .appveyor.yml GitHub · hasherezade/pe-bear · Revision b90f1d7
  6. LICENSE GitHub · hasherezade/pe-bear · Revision b90f1d7
  7. https://github.com/hasherezade/pe-bear/wiki/Home/54c92bf64d101f3f51a8388f0d83455ce12055bf
  8. https://github.com/hasherezade/pe-bear/wiki/PE-Unmapping/88701f9546cb03b2e5666958e0e889feaea99ba9
  9. https://github.com/hasherezade/pe-bear/wiki/Searching-patterns/fd89b1add6e3af972d64b455a6316b74491d9284
  10. https://hshrzd.wordpress.com/pe-bear/
  11. https://github.com/hasherezade/pe-bear/releases/tag/v0.7.2

More in Native binaries

All 78 entries in Native binaries