{ "added_at": "2026-11-02", "additional_evidence_urls": [ "https://github.com/mentebinaria/readpe/blob/967ab57f7cfbebf340a8f85744a1d095029cfbfe/doc/manual/en_us/tools.docbook", "https://github.com/mentebinaria/readpe/blob/967ab57f7cfbebf340a8f85744a1d095029cfbfe/lib/libpe/README.md", "https://github.com/mentebinaria/readpe/blob/967ab57f7cfbebf340a8f85744a1d095029cfbfe/Makefile", "https://github.com/mentebinaria/readpe/blob/967ab57f7cfbebf340a8f85744a1d095029cfbfe/.github/workflows/multi-os-build.yml", "https://github.com/mentebinaria/readpe/blob/967ab57f7cfbebf340a8f85744a1d095029cfbfe/src/windows/cpload.c", "https://github.com/mentebinaria/readpe/blob/967ab57f7cfbebf340a8f85744a1d095029cfbfe/src/userdb.txt#L1-L2", "https://github.com/mentebinaria/readpe/blob/967ab57f7cfbebf340a8f85744a1d095029cfbfe/tests/run.sh", "https://github.com/mentebinaria/readpe/blob/967ab57f7cfbebf340a8f85744a1d095029cfbfe/src/readpe.c#L1-L34", "https://github.com/mentebinaria/readpe/blob/967ab57f7cfbebf340a8f85744a1d095029cfbfe/LICENSE", "https://github.com/mentebinaria/readpe/blob/967ab57f7cfbebf340a8f85744a1d095029cfbfe/lib/libpe/LICENSE", "https://github.com/mentebinaria/readpe/releases/tag/v0.85.1", "https://github.com/mentebinaria/readpe/releases/tag/v0.85" ], "category": "native-analysis", "description_en": "Command-line toolkit, formerly named pev, for analyzing 32- and 64-bit Windows PE files. readpe prints the DOS, COFF and optional headers, sections, data directories, imports and exports, while companion tools disassemble code (pedis), hash the file, headers or sections with ssdeep and imphash among others (pehash), list and extract resources (peres), match packer signatures (pepack), flag traits such as TLS callbacks, high entropy or an unusual entry point (pescan), report ASLR, DEP/NX, SEH and stack-cookie flags and dump certificates (pesec), find strings and convert between file offsets and RVAs. Output plugins write text, CSV, XML, HTML or JSON, and the bundled libpe C library provides the parser.", "description_zh": "命令行工具集（原名 pev），用于分析 32 位和 64 位 Windows PE 文件。readpe 输出 DOS、COFF 与可选头、节区、数据目录以及导入和导出表；配套工具可反汇编代码（pedis），以 ssdeep、imphash 等算法对整个文件、文件头或节区计算哈希（pehash），列出并提取资源（peres），匹配加壳签名（pepack），标出 TLS 回调、高熵值或异常入口点等特征（pescan），报告 ASLR、DEP/NX、SEH 与栈 cookie 标志并导出证书（pesec），还能查找字符串以及在文件偏移和 RVA 之间换算。输出插件支持文本、CSV、XML、HTML 和 JSON，附带的 libpe C 库提供解析功能。", "entry_url": "https://awesomerea.org/resources/readpe/", "entry_url_zh": "https://awesomerea.org/zh/resources/readpe/", "evidence_url": "https://github.com/mentebinaria/readpe/blob/967ab57f7cfbebf340a8f85744a1d095029cfbfe/README.md", "group": "tools", "id": "readpe", "json_url": "https://awesomerea.org/resources/readpe/record.json", "kind": "tool", "markdown_url": "https://awesomerea.org/resources/readpe/index.md", "markdown_url_zh": "https://awesomerea.org/zh/resources/readpe/index.md", "name": "readpe (formerly pev)", "name_zh": "readpe（原名 pev）PE 文件分析工具集", "record_type": "resource", "relationship": "foundation", "requirements": [ "Latest release at review: v0.85.1, published 2025-08-29 to correct the version string reported by v0.85 (2025-08-08); only the older v0.81 and v0.82 releases attach Windows ZIP builds. The reviewed master commit, from 2026-07-08, is five commits ahead, fixing peres version output and ordinal-only imports and moving the macOS CI build to a newer OpenSSL. The README explains the rename from pev and that libpe was merged into this repository.", "Built from source with make and a C compiler and needs OpenSSL development headers. On Linux, make install puts files under /usr/local, and /usr/local/lib must be registered with ldconfig so libpe.so is found; macOS builds pass Homebrew OpenSSL paths in CFLAGS and LDFLAGS, and Windows builds use Cygwin with gcc-core, binutils, make, zip and libssl-devel, where make zip also builds cpload and bundles the needed Cygwin DLLs. CI only compiles on Linux, macOS and Cygwin.", "Input is a PE file the user supplies. The other tools parse it, but the Windows-only cpload loads a Control Panel (.cpl) item and sends it CPL messages for debugging, so it runs that item's code. pepack depends on the bundled userdb.txt list of PEiD-style signatures, whose header counts 3,520 entries without naming their source, and pescan and pesec report heuristic indicators and header flags rather than verdicts.", "tests/run.sh runs each tool in every output format and diffs the results against an expected_outputs directory that is not in the repository; valgrind scripts and a helloworld.exe sample built from tests/samples_src with MinGW are also included. CI does not run these tests.", "The tools are GPL-2.0-or-later with an OpenSSL linking exception, lib/libpe is LGPL-3.0, and the bundled udis86 disassembler keeps its BSD notice." ], "requirements_zh": [ "审阅时最新版本为 v0.85.1，发布于 2025-08-29，用于更正 v0.85（2025-08-08）报告的版本号；只有较早的 v0.81 和 v0.82 版本附带 Windows ZIP 构建。所审阅的 master 提交日期为 2026-07-08，比该版本多五个提交，修复了 peres 的版本信息输出和仅按序号导入的函数识别，并让 macOS CI 构建改用较新的 OpenSSL。README 说明了从 pev 改名的经过，以及 libpe 已并入本仓库。", "需用 make 和 C 编译器从源码构建，并需要 OpenSSL 开发头文件。在 Linux 上，make install 将文件安装到 /usr/local，还需用 ldconfig 登记 /usr/local/lib 才能找到 libpe.so；macOS 构建需在 CFLAGS 和 LDFLAGS 中传入 Homebrew 的 OpenSSL 路径；Windows 构建使用安装了 gcc-core、binutils、make、zip 和 libssl-devel 的 Cygwin，其中 make zip 还会构建 cpload 并打包所需的 Cygwin DLL。CI 仅在 Linux、macOS 和 Cygwin 上编译。", "输入为使用者提供的 PE 文件。其他工具只解析文件，而仅限 Windows 的 cpload 会载入控制面板（.cpl）项并向其发送 CPL 消息以便调试，因此会运行该项的代码。pepack 依赖附带的 userdb.txt，这是一份 PEiD 格式的签名列表，文件头称共 3,520 条，但未注明来源；pescan 和 pesec 报告的是启发式迹象和文件头标志，而非判定结论。", "tests/run.sh 以每种输出格式运行各个工具，并将结果与 expected_outputs 目录比较，但该目录不在仓库中；另附有 valgrind 脚本，以及由 tests/samples_src 用 MinGW 构建的 helloworld.exe 样本。CI 不运行这些测试。", "各工具采用 GPL-2.0-or-later 许可并附 OpenSSL 链接例外，lib/libpe 采用 LGPL-3.0，附带的 udis86 反汇编器保留其 BSD 声明。" ], "targets": [ "binary" ], "url": "https://github.com/mentebinaria/readpe", "verification": "source-reviewed", "verified_at": "2026-10-20" }