{
  "added_at": "2026-10-31",
  "additional_evidence_urls": [
    "https://github.com/hasherezade/pe-bear/blob/b90f1d7d96635e7a029f424a0d1d11a104821685/CMakeLists.txt",
    "https://github.com/hasherezade/pe-bear/blob/b90f1d7d96635e7a029f424a0d1d11a104821685/.gitmodules",
    "https://github.com/hasherezade/pe-bear/blob/b90f1d7d96635e7a029f424a0d1d11a104821685/pe-bear/updater/README.md",
    "https://github.com/hasherezade/pe-bear/blob/b90f1d7d96635e7a029f424a0d1d11a104821685/.appveyor.yml",
    "https://github.com/hasherezade/pe-bear/blob/b90f1d7d96635e7a029f424a0d1d11a104821685/LICENSE",
    "https://github.com/hasherezade/pe-bear/wiki/Home/54c92bf64d101f3f51a8388f0d83455ce12055bf",
    "https://github.com/hasherezade/pe-bear/wiki/PE-Unmapping/88701f9546cb03b2e5666958e0e889feaea99ba9",
    "https://github.com/hasherezade/pe-bear/wiki/Searching-patterns/fd89b1add6e3af972d64b455a6316b74491d9284",
    "https://hshrzd.wordpress.com/pe-bear/",
    "https://github.com/hasherezade/pe-bear/releases/tag/v0.7.2"
  ],
  "category": "native-analysis",
  "description_en": "Qt GUI to view and edit Windows Portable Executable files, meant as a fast first look for malware analysts and robust against malformed PE32 and PE64 files. It shows headers and section layout, follows raw, RVA and VA addresses, disassembles from any offset with Capstone, matches packer signatures, compares two files and unmaps dumped images.",
  "description_zh": "用于查看和编辑 Windows 可移植可执行（PE）文件的 Qt 图形工具，旨在为恶意软件分析人员提供快速的初步查看，并能稳定处理畸形的 PE32 与 PE64 文件。它可显示文件头和节区布局，跟随原始偏移、RVA 和 VA 地址，借助 Capstone 从任意偏移开始反汇编，按签名识别加壳工具，对比两个文件，并能还原从内存转储的映像。",
  "entry_url": "https://awesomerea.org/resources/pe-bear/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/pe-bear/",
  "evidence_url": "https://github.com/hasherezade/pe-bear/blob/b90f1d7d96635e7a029f424a0d1d11a104821685/README.md",
  "group": "tools",
  "id": "pe-bear",
  "json_url": "https://awesomerea.org/resources/pe-bear/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/pe-bear/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/pe-bear/index.md",
  "name": "PE-bear",
  "name_zh": "PE-bear PE 文件分析工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release: v0.7.2 (2026-06-05), with Windows Qt6 and Qt5 builds, a legacy Qt4 x86 build for old Windows such as XP, Linux tar.xz and AppImage builds and a macOS Qt6 app; Chocolatey, Scoop and WinGet also package it. The reviewed main commit of 2026-10-14 is 16 commits ahead, with a Capstone update and an unreleased update check that, per its README, queries GitHub's releases API at most once a day and sends only a PE-bear User-Agent.",
    "Linux builds need a matching Qt installation, and Windows builds made with Visual Studio 2017 or later need the Visual C++ 2015–2022 redistributable. Source builds need Git, CMake 3.12+, Qt6 (or Qt5/Qt4) and the bearparser, Capstone and sig_finder submodules, with build scripts for Linux and macOS. AppVeyor builds test packages from each main commit, which README warns may be unstable.",
    "Input is a PE file chosen by the analyst, including images dumped from a process, which PE-bear offers to unmap. Wiki pages cover adding imports, removing overlays, filling content and searching strings or masked byte signatures. Packer detection uses SIG.txt, converted from PEiD's UserDB by a third-party script and last updated on 2022-10-17.",
    "GPL-2.0; the author's page says PE-bear has been open source since 2022-09-18, after development was discontinued in 2014 and later reopened. The bearparser and sig_finder submodules are BSD-2-Clause, and Capstone keeps its own license."
  ],
  "requirements_zh": [
    "最新发行版为 v0.7.2（2026-06-05），提供 Windows 的 Qt6 与 Qt5 版本、面向 XP 等旧版 Windows 的 Qt4 x86 旧版构建、Linux 的 tar.xz 与 AppImage 版本以及 macOS 的 Qt6 应用；Chocolatey、Scoop 和 WinGet 也提供安装包。所审阅的 main 提交（2026-10-14）比它多 16 个提交，包括 Capstone 更新和尚未发布的更新检查功能；据其 README，该功能每天最多查询一次 GitHub 发行版 API，且只发送 PE-bear 的 User-Agent。",
    "Linux 版本需要安装对应版本的 Qt；用 Visual Studio 2017 或更高版本构建的 Windows 版本需要 Visual C++ 2015–2022 运行库。源码构建需要 Git、CMake 3.12+、Qt6（或 Qt5/Qt4）以及 bearparser、Capstone 和 sig_finder 子模块，并提供 Linux 与 macOS 的构建脚本。AppVeyor 会为 main 分支的每个提交构建测试包，README 提醒这些构建可能不稳定。",
    "输入为分析者选定的 PE 文件，也包括从进程中转储的映像，PE-bear 会提示将其还原为原始格式。Wiki 页面介绍了添加导入项、移除附加数据、填充内容以及搜索字符串或带掩码的字节签名。加壳识别使用 SIG.txt，它由第三方脚本从 PEiD 的 UserDB 转换而来，最后更新于 2022-10-17。",
    "采用 GPL-2.0 许可；作者页面称 PE-bear 自 2022-09-18 起开源，此前其开发曾于 2014 年停止，后又重新启动。bearparser 和 sig_finder 子模块采用 BSD-2-Clause 许可，Capstone 保留其自身许可。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/hasherezade/pe-bear",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}