PESuite

PESuite represents a collection of eight command-line utilities that were previously bundled with PECompact. They have functions for helping you manipulate PE (Portable Executable) files, such as EXE, DLL and FON running under 32-bit or 64-bit Windows. Most of them also support for PE+ (PE64).

The tools aren't wrapped in a setup kit, so you can extract the files from the downloaded archive and fire them up right away. To use them, it's necessary to call their process from a Command Prompt window.

PESetVersion can be instructed to obtain or set the OS version of a module. The syntax is "PESetVersion filename.extension" and it returns the PE, Win32, subsystem, linker and image version, along with the number of total modules analyzed and versions changed.

PEChksum is capable of correct the checksums of PE files. The syntax is PEChksum filespec [/r], where you can specify wildcards (filespec) as well as enable recursive directory mode (/r). Results show the original and new checksum, together with the total modules analyzes and corrected hashes.

PEInsert is a tool that can embed data (.dat file) into the header cave of a PE file. The syntax is PEInsert filespec datafile [/r]. Meanwhile, PEWatermark can be used to apply a watermark to a PE file using a unique ID. The syntax is PEWaterMark filespec [/mark=] [/r] [/x] [/pause], where /mark represents the numerical ID to embed in the module, /x is the exit code, and /pause tells the tool how long to wait for a key stroke before exiting.

PEClassify verified the PE type and linker version of the files, whose syntax is PEClassify filespec [/r] [/k:#|0x#]. PETrim decreases the size of PE files by physically realigning or adding extra data. Its syntax is PETrim filespec [/Align:xx] [/StripFixups:Y|N|A] [/StripDebug:Y|N] [/r]. The default alignment is minimum 512, /StripFixups tells the app whether or not to strip fixups (default is "no"), and /StripDebug indicates whether or not to strip debug info (default is "yes").

PESubsys.exe specifies the subsystem of a PE and gives you the possibility to change it after linkage. The syntax is PESubsys filespec [/r] [/{subsystem}] and the subsystem can be defined using various parameters, such as /UNDEFINED, /OS2CONSOLE, /WINDOWS_CE_GUI, /XBOX, /EFIROM or /EFIAPP. Lastly, PEHideText can be used to obfuscate plain text in a PE file's physical and virtual image. The syntax is PEHideText filespec [/r] [/k:#|0x#].

PESuite features practical tools for helping you work with PE files. All can be accessed from the command-line interface. They had minimal impact on the computer's performance in our tests.