Basic introduction
PPEE (Puppy) is a professional PE file explorer for those who reverse engineer, malware research and statically inspect PE file details. PPEE is a free, small, fast, agile and friendly puppy! There are many tools available for static analysis of malicious binaries, but they are just ordinary file tools. Puppy is a lightweight and powerful static suspicious file checking tool. It comes with a file information plug-in, which can query the size, entropy, attributes, hash value, version information, etc. in well-known malware repositories with one click. Technical information.
Software features
Puppy is powerful against malformed and specially crafted PE files, which is very convenient for those who reverse engineer, malware research and statically inspect the details of PE files. Support includes imports, resources, exceptions, certificates (relies on Windows API), base relocation, debugging, TLS, load configuration, bind imports, IAT, delayed imports, and cleanup of all directories in PE files.
Function introduction
– Supports PE32 and PE64
– Metadefender query reports for Virustotal and OPSWAT
– Static analysis of windows native and .Net executable files
– Powerful parsing of exe, dll, sys, scr, drv, cpl, ocx, etc.
– Edit almost every data structure
– Easily dump sections, resources and .Net assembly directories
– Section entropy and MD5 calculations and resource projects
– View strings embedded in files, including URLs, registry entries, and suspicious areas, etc.
– Extracted content remains in PE file
– Anomaly detection
– Right click to copy, search the web, Whois and dump
– Built-in hex editor
– Windows Explorer context menu integration
– Descriptive information about data components
– Refresh, save and save as menu commands
– Drag and drop support
– List view columns can sort the data in an appropriate manner
– Open file from command line
– Checksum verification
– Plugin enabled
Change log
v1.09 version update: January 21, 2018
– Yara rules support (new plugin)
– Added application manifest items to tree view
– Added resource type detection
– Added tree view tooltips
– Rearranged debug directory items
– Display file size in binary units (FileInfo plugin)
– Major bug fixes
it works
it works
it works