Stories
Slash Boxes
Comments

SoylentNews is people

posted by Fnord666 on Saturday August 08 2020, @10:16PM   Printer-friendly
from the another-tool-in-the-toolbox dept.

PE Tree: Free open source tool for reverse-engineering PE files - Help Net Security:

PE Tree, a malware reverse-engineering, open source tool developed by the BlackBerry Research and Intelligence team, has been made available for free to the cybersecurity community.

PE Tree allows malware analysts to view Portable Executable (PE) files in a tree-view using pefile – a multi-platform Python module that parses and works with PE files – and PyQt5, a module that can be used to create graphical user interfaces.

[...] The Python-based tool parses PE files and maps them into a tree view, them provides a summery of various headers. Suspicious findings are highlighted, and analysts can deepen their research by doing a VirusTotal search, export portions of the PE file to CyberChef for further processing, finding and dumping PE files from an IDA database and reconstruct imports, etc.

[...] "The BlackBerry Research and Intelligence team initially developed this open source tool for internal use and is now making it available to the malware reverse engineering community."

[...] [Tom] Bonner noted that this free tool for reverse-engineering is under active development and new features will be added frequently.


Original Submission

This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
  • (Score: 0) by Anonymous Coward on Sunday August 09 2020, @06:31AM

    by Anonymous Coward on Sunday August 09 2020, @06:31AM (#1033680)

    I spent the last two weeks debugging memory leaks in a PEfile using application. Querying the instance for data will continuously log those queries into an internal structure, which can quickly lead to memory exhaustion.

    Also remember to close the instances when no longer needed, otherwise the data will linger.

(1)