Your download link is at the very bottom of the page... always.



Processed through Paypal
No account required.


Donate Bitcoin to this wallet:
1KkUMXvQ2ko3xcJkzitB7WYgoW6m79WFfm
Donate Ethereum to this wallet:
0x40E56922F43637224935CDC35e2c96E0392A8505
Donate Litecoin to this wallet:
LLYAFEyqjH69gkyCEpRjXNyedRCWrVChfL

Buying our over-priced stuff helps us keep things running. Peruse here.



Join our Facebook groupFollow us on TwitterFollow us on InstagramOur RSS Feed




 Home » OlderGeeks.com Freeware Downloads » Anti-Virus, Anti-Malware, Security Utilities » Malware Diagnostic Tools » PE Anatomist v0.2.0   
File - Download PE Anatomist v0.2.0
Description

Always scroll to the bottom of the page for the download link.
We don't believe in fake/misleading download buttons and tricks. The link is always in the same place.



PE Anatomist v0.2.0

PE Anatomist shows almost all known data structures inside a PE file and makes some analytics.

Headers and data structures parsing

IMAGE_DOS_HEADER, IMAGE_FILE_HEADER, IMAGE_OPTIONAL_HEADER, IMAGE_OPTIONAL_HEADER64 and the DataDirectories List with additional information about some fields
Table of COFF symbols
Sections table, supporting long section names (via symbols table) and entropy calculating
Import table (supports MS-styled names demangling)
Bound Import Table
Delayed Import Table
Export Table with additional info
Resource Table with additional info about different resource types and detailed view for all types
Base Relocation Table. Target address determining and interpretation available for all supporting architectures. It detects imports, delayed imports, exports, tables from loadconfig directory, ANSI and UNICODE strings.
Brief info about PE Authenticode Signature
LoadConfig Directory with SEH, GFID, decoded CFG bitmap, GIAT, Guard LongJumps, CHPE Metadata, Dynamic Value Reloc Table, Enclave Configuration, Volatile Metadata tables parsing and additional information about some fields
Debug Directory. It parses contents of CODEVIEW, POGO, VC FEATURE, REPRO, FPO, EXDLL CHARACTERISTICS, SPGO debug types
TLS config and callbacks table with additional information about some fields
Exceptions Data Table. x64 (including version 2 with EPILOG unwind codes), arm, arm64, ia64 architectures are support, as well as chain of unwind data for x64, language-specific handler data (C Scope, C++ FuncInfo, C++ EH4, C++ DWARF LSDA) and hexadecimal view of unwind data
Partial .NET directory pasring: IMAGE_COR20_HEADER, CORCOMPILE_HEADER, READYTORUN_HEADER with additional information about some fields
Decode Rich signature indicating the tool used, the action being taken, the full version of the tool, and the version of VisualStudio to which the tool belongs
IAT table contents
VB5 and VB6 typical structures: project info, DLLCall-imports, referenced modules, object table


In addition

FLC - file location calculator
Display settings and sorting by any column of the list
Localization of the program interface (while Russian and English options are available) via external DLL file
Explorer's context menu integration
Decoding strings of national Unicode symbols (cyrillic form CP1251 is available now)


More information here.


MD5: 282C91B2819804C4C247F0EFD060005D
SHA1: 82CDB10617A9742B09F7F3E60D65E84BE2FAF7F4
SHA256: 379F28F9AF0D5064C7A02341F99CD8D107F15C985A9409C2878BC567F3AD25ED


This tool was designed to be used with:

Windows XP SP3 (x86)
Windows 7, Windows 8, Windows 8.1, Windows 10 (both x86 and x64)
ReactOS 0.4



File Formats

PE32
PE32+

PE Image Architectures

Intel x86
AMD64
ARM7
ARM7 Thumb
ARM8-64
Intel IA64
CHPE (x86 on ARM8-64)


0.2.0.370 (2021-01-04)

Minor optimization and cleaning of list sorting code
Background color of resource properties dialog and hexview changed to standard for the used control
Cleaning headers, unifying declared data types, dividing code into independent modules
Fix display error for the symbols CV_COMPILESYM and CV_COMPILESYM3
Update register names and CodeView symbols from VS 16.8 and 16.9Preview
Add display of the COFF symbol referenced by the CLR token in the COFF symbol table
Add display of CLR token in CodeView symbols
Fix error displaying RT_STRING resource as text in rare cases
Fix error in defining COFF-symbol of exception handler in x64 OBJ-files
The used data types from CoreCLR 5 have been updated
Fix a crash when displaying the contents of the metadata tables of some obfuscated or compressed .NET files
Change .NET metadata streams description - stream RVA is displayed now
Fix matching RVA to offset for some alignment and section parameter combinations in PE files compiled by MinGW
Fix displaying a DelayImport table with incorrect content (regression starting 0.1.8)
Fix matching RVA to offset in case of forced loading of PE without sections
Add .NET Vtable Fixups display
Fix a rare error with displaying the name of some Codeview types in the pivot table (an incorrect name could be displayed if in fact it was of zero length)
Add decoding of MSVC ILStore symbol table (.cil$gl) in OBJ files (x86, x64, ARMThumb, ARM64) для VS16.8
Change the appearance of the main window in the absence of a loaded file
Add description for selected symbol MSVC ILStore
Add correction of indexes in the MSVC ILStore table of types in case of using PCH
Add description of types by their index in all supported MSVC ILStore tables
Add description of MSVC ILStore symbols referenced by selected symbol from table .cil$gl
Add parsing of CHPE configuration header and DynamicDataRelocations table for hybrid x64-over-ARM64 images (arm64x) from InsiderPreview 21277
Add x64 ExceptionsData table for hybrid x64-over-ARM64 images (arm64x)
Add parsing of ARM64 unwind codes for SIMD registers
Fix detection of the ARM64 unwind chain
New view of the settings dialog, division of settings into new categories
Add formatting settings for text copied to the clipboard from program tables
Fix error reading CodeView C13 subsections in some cases (most often it appeared on CodeView created by early versions of tools from VS2002 and VS2003)
Add search settings: remembering the last query and saving the selected starting position of the search
Add search options for text: match only from the beginning of a string, inversion of search results (i.e. search for strings where the desired text is absent)
Fix error displaying the "Parent Offset" parameter in the CodeView symbols S_DEFRANGE_REGISTER_REL and S_DEFRANGE_REGISTER_REL_INDIR
Fix error of reading MSVC ILStore type table when there are nested tables
Add support for decoding MSVC ILStore symbol table for all public versions of VisualStudio (7-16.9Preview2)
Add the ability to select all found lines for text search
Prevent unclosed search dialog from being used after destroying its associated ListView
Configuration file format has been changed to text view




































Click here to visit the author's website.
Continue below to download this file.


Downloads Views Developer Last Update Version Size Type Rank
934 2,878 RamMerLabs <img src="https://www.oldergeeks.com/downloads/gallery/thumbs/PEAnatomist7_th.png"border="0"> Jan 05, 2021 - 13:08 0.2.0 174KB ZIP 5/5, out of 13 Votes.
File Tags
Anatomist  PE  v0.2.0  
      
Whoa! Slow down there, Speedy.
Read this and then continue to the download.

Like seeing no ads? No misleading/fake download buttons?
We like it too! This site has been kept alive for 10 years
because of people just like you who download and donate.
No one is stopping you from downloading without donating
but the site runs on the "Honor System". If your momma
raised you to be honorable, make a donation and download
'til ya turn blue. Make your momma proud!

Thank you! -Randy & Deanna (The Older Geeks)

Monthly operating costs = $610
Donations for March = $81
Donations over our monthly goal
are set aside for future upgrades.

Processed securely through Paypal.
When you donate, it will say "Home Computer Repair LLC".
This is our computer store account.
Or...

Or...
Donate Bitcoin: 1KkUMXvQ2ko3xcJkzitB7WYgoW6m79WFfm
Donate Ethereum: 0x40E56922F43637224935CDC35e2c96E0392A8505
Donate Litecoin:LLYAFEyqjH69gkyCEpRjXNyedRCWrVChfL
Or...
Just send a check to our computer store payable to Home Computer Repair LLC.
Our address: Home Computer Repair LLC, 208 E. Water St. Mount Vernon, MO 65712

Recent Super Donors ($50+)
Thanks, Alf
Thanks, Thomas
Thanks, Ricardo
Thanks, Sheila

Recent Donors
Thanks, Albert
Thanks, Lee
Thanks, Charles
Thanks, Doug
Thanks, Thomas
Thanks, Eric
Thanks, Owen
Thanks, Robert
Thanks, Monte
Thanks, Michael

   →→ Download Now ←← - Click to Rate File -
Like this download? Share it on Twitter →


Copyright (c) 2021