PE Anatomist

PE Anatomist is a lightweight and incredibly well-designed software that allows users and developers to glimpse into all the known structures inside PE files (Portable Executable format used for executables, object code, DLLs, in both 32- and 64-bit Windows OSes).

These structures include headers, sections, coff symbols, imports, exports, resources, bound imports, delayed imports, base relocations, PE authenticode signatures, load config directory, debug, TLS, exceptions data, .NET, and rich signatures.

The application is remarkably easy to use, as it does not have any third-party dependencies and doesn’t even require installation. Any user can download the archive, unzip it, run the app via its designated executable file, load any PE file, and view all the relevant data structures within it with the least amount of effort.

The app is designed and focused more on the pragmatic side of things packing all its unique features within tabs, neatly stacked in the upper part of the main window. Once a PE file is loaded, the first section users will come in contact with is the Headers tab. Within it, PE Anatomist displays various structure fields such as IMAGE_DOS_HEADER, IMAGE_NT_HEADERS, IMAGE_OPTIONAL_HEADER32, as well as their adjacent field values and descriptions.

The Sections tab is where the long section names are and their entropy calculations, the Resources tab is packed with additional info about the different types of resources and a detailed view of their structure, and so forth. In short, everything with this app is based on a simple yet effective WYSIWYG philosophy.

Taking everything into account, it’s safe to say that PE Anatomist is a very useful and practical tool that should come in hand to any user or developer who desires to quickly analyze the potentially complex structure of PE files.