Alternatives to PE-bear
A multiplatform viewer and editor for reversing Windows Portable Executable (PE) files. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
PE-bear
A multiplatform viewer and editor for reversing Windows Portable Executable (PE) files.
Replacements
Listings that take over the same core job as PE-bear.
pestudio
A Windows tool for quick static assessment of executable files that highlights suspicious indicators.
pestudio is a freemium, closed-source Windows-only tool for static triage that flags suspicious indicators in executables rather than editing PE structures.
Detect It Easy
A program that identifies file types, packers, compilers and protectors used in executables.
Detect It Easy identifies file types, packers, compilers and protectors with signature databases and YARA rules, but does not disassemble or edit the file.
Also worth comparing
These listings name PE-bear as their own alternative, so the relationship runs both ways.
binsider
Inspect executable files through a terminal interface.
PE-bear offers a graphical viewer and editor with Capstone disassembly on Windows, macOS and Linux, but it handles only Windows PE files instead of a terminal interface.
Similar software
Related functionality, not a direct replacement.
Ghidra
The NSA's reverse engineering framework, with a decompiler that turns machine code back into readable C.
x64dbg
An open-source Windows debugger for reverse engineering, with an IDA-like interface, a built-in assembler and a decompiler.
IDA Free
The free, non-commercial edition of the IDA disassembler and decompiler for reverse engineering.
capa
Identify likely capabilities inside executable files.
PE-sieve
A Windows tool that scans a running process and dumps injected or hollowed code and hooks.
FLARE-VM
Installation scripts that turn a Windows virtual machine into a malware analysis and reverse-engineering workstation.
