Stud_PE

Stud_PE is a small, but handy utility designed for viewing, analyzing and editing Portable Executable formats without affecting the internal structure and functionality or the file.

The application provides users with a simple tab-based interface, although actually using the program might pose some problems to beginners. It features an extensive list of settings and editing options that allow you to modify the PE metadata fields, which is particularly useful for programmers.

There are various fields that you can view and edit, including header values, entry point parameters and the relocation number. The Section manager allows you to dump or delete memory sections, as well as create new ones. For each section, the application displays the virtual and raw size.

Stud_PE also comes with other PE utilities, such as a function importer / exporter, a signature database manager and verification tool, as well as a virtual to raw convertor.

The Resources tab is capable of handling .NET image formats such as bitmaps and icons, allowing you to edit dialogs, cursors, icons and the version info of your portable EXE.

You can use the built-in process manager to monitor all the running processes and modules, while also being able to stop or dump them or their corresponding memory region. If you don't know what a process does, you can search it online directly from the context menu.

This software comes packed with several plugins that add it extra functionality. For example, you have the generic OEP finder, the 'Krypto ANALyzer' (detects crypto signatures), the HTML converter, the string viewer or the UPX unpacker.

One other feature that makes this program worthwhile is the comparison tool. You can use it to spot the differences in the internal structures of two PE files or perform a binary comparison.

The bottom line is Stud_PE provides you with a complete set of useful tools for analyzing portable executable files and modifying their structure, all in a single lightweight application.