PE-bear
A multiplatform viewer and editor for reversing Windows Portable Executable (PE) files.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
About PE-bear
PE-bear is a reversing tool for PE files, the executable format used by Windows, with a friendly graphical interface. It lets analysts inspect and edit headers and sections and view disassembly, using the Capstone engine.
It is built with Qt and the repository includes scripts for AppImage and macOS builds, so it runs beyond Windows. Malware analysts use it for a quick first look at suspicious or malformed executables.
Strengths
- Friendly GUI for inspecting PE structures
- Built-in disassembly through Capstone
- Runs on Windows, Linux and macOS
Limitations
- Limited to the PE format
- Not a full decompiler or debugger
Details
- Pricing
- FreeFree and open source.
- License
- Open source, license not stated
- Developer
- hasherezade
- Platforms
- Windows, macOS, Linux
- How it runs
- Downloadable app
- Account
- Not required
- Works offline
- Yes
- Best suited for
- Malware analysts taking a first look at Windows executables
- Categories
- Security tools, Developer tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to PE-bear
Compare allSoftware that can replace PE-bear for an important use case, and what changes if you switch.
pestudio
A Windows tool for quick static assessment of executable files that highlights suspicious indicators.
pestudio is a freemium, closed-source Windows-only tool for static triage that flags suspicious indicators in executables rather than editing PE structures.
Detect It Easy
A program that identifies file types, packers, compilers and protectors used in executables.
Detect It Easy identifies file types, packers, compilers and protectors with signature databases and YARA rules, but does not disassemble or edit the file.
PE-bear as an alternative
Listings that name PE-bear as an alternative.
binsider
Inspect executable files through a terminal interface.
PE-bear offers a graphical viewer and editor with Capstone disassembly on Windows, macOS and Linux, but it handles only Windows PE files instead of a terminal interface.
Similar software
Related functionality, not necessarily a direct replacement.
Ghidra
The NSA's reverse engineering framework, with a decompiler that turns machine code back into readable C.
x64dbg
An open-source Windows debugger for reverse engineering, with an IDA-like interface, a built-in assembler and a decompiler.
IDA Free
The free, non-commercial edition of the IDA disassembler and decompiler for reverse engineering.
capa
Identify likely capabilities inside executable files.
PE-sieve
A Windows tool that scans a running process and dumps injected or hollowed code and hooks.
FLARE-VM
Installation scripts that turn a Windows virtual machine into a malware analysis and reverse-engineering workstation.
