AwesomeREA.org

Tool

readpe (formerly pev)

Command-line toolkit, formerly named pev, for analyzing 32- and 64-bit Windows PE files. readpe prints the DOS, COFF and optional headers, sections, data directories, imports and exports, while companion tools disassemble code (pedis), hash the file, headers or sections with ssdeep and imphash among others (pehash), list and extract resources (peres), match packer signatures (pepack), flag traits such as TLS callbacks, high entropy or an unusual entry point (pescan), report ASLR, DEP/NX, SEH and stack-cookie flags and dump certificates (pesec), find strings and convert between file offsets and RVAs. Output plugins write text, CSV, XML, HTML or JSON, and the bundled libpe C library provides the parser.

Requirements & limits

  • Latest release at review: v0.85.1, published 2025-08-29 to correct the version string reported by v0.85 (2025-08-08); only the older v0.81 and v0.82 releases attach Windows ZIP builds. The reviewed master commit, from 2026-07-08, is five commits ahead, fixing peres version output and ordinal-only imports and moving the macOS CI build to a newer OpenSSL. The README explains the rename from pev and that libpe was merged into this repository.
  • Built from source with make and a C compiler and needs OpenSSL development headers. On Linux, make install puts files under /usr/local, and /usr/local/lib must be registered with ldconfig so libpe.so is found; macOS builds pass Homebrew OpenSSL paths in CFLAGS and LDFLAGS, and Windows builds use Cygwin with gcc-core, binutils, make, zip and libssl-devel, where make zip also builds cpload and bundles the needed Cygwin DLLs. CI only compiles on Linux, macOS and Cygwin.
  • Input is a PE file the user supplies. The other tools parse it, but the Windows-only cpload loads a Control Panel (.cpl) item and sends it CPL messages for debugging, so it runs that item's code. pepack depends on the bundled userdb.txt list of PEiD-style signatures, whose header counts 3,520 entries without naming their source, and pescan and pesec report heuristic indicators and header flags rather than verdicts.
  • tests/run.sh runs each tool in every output format and diffs the results against an expected_outputs directory that is not in the repository; valgrind scripts and a helloworld.exe sample built from tests/samples_src with MinGW are also included. CI does not run these tests.
  • The tools are GPL-2.0-or-later with an OpenSSL linking exception, lib/libpe is LGPL-3.0, and the bundled udis86 disassembler keeps its BSD notice. The reviewed sources state no REA use, and this collection did not build the tools or analyze any file.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · mentebinaria/readpe · Revision 967ab57
  2. doc/manual/en_us/tools.docbook GitHub · mentebinaria/readpe · Revision 967ab57
  3. lib/libpe/README.md GitHub · mentebinaria/readpe · Revision 967ab57
  4. Makefile GitHub · mentebinaria/readpe · Revision 967ab57
  5. .github/workflows/multi-os-build.yml GitHub · mentebinaria/readpe · Revision 967ab57
  6. src/windows/cpload.c GitHub · mentebinaria/readpe · Revision 967ab57
  7. src/userdb.txt#L1-L2 GitHub · mentebinaria/readpe · Revision 967ab57
  8. tests/run.sh GitHub · mentebinaria/readpe · Revision 967ab57
  9. src/readpe.c#L1-L34 GitHub · mentebinaria/readpe · Revision 967ab57
  10. LICENSE GitHub · mentebinaria/readpe · Revision 967ab57
  11. lib/libpe/LICENSE GitHub · mentebinaria/readpe · Revision 967ab57
  12. https://github.com/mentebinaria/readpe/releases/tag/v0.85.1
  13. https://github.com/mentebinaria/readpe/releases/tag/v0.85

More in Native binaries

All 105 entries in Native binaries