Drag and drop a file here, or choose one from your device.
.exe, .dll, .sys and other PE files
{{ error }}
Your file stays on your device.
{{ error || 'Preparing the PE inspector.' }}
{{ viewError }}
{{ state.error }}
Place the cursor in an instruction and press Enter to start decoding there.
IMAGE_DOS_HEADER
| {{ column.title }} |
|---|
| {{ column.format(value, index) }} |
{{ data.rows.length ? 'No matching entries.' : 'No exports.' }}
{{ state.error }}
Place the cursor on a byte to interpret it. ?? marks zero-fill without file bytes.
{{ group.rows === null ? 'The import lookup table could not be parsed.' : 'No imported symbols.' }}
{{ data.descriptors.length ? 'No matching entries.' : 'No imports.' }}
{{ data.manifest }}IMAGE_NT_HEADERS
No data directories.
| Resource | RVA | Size (bytes) | Code page |
|---|---|---|---|
| {{ name(row.entry) }} Unavailable | {{ row.entry.data ? hex(row.entry.data.image.OffsetToData) : '' }} | {{ row.entry.data?.size }} | {{ row.entry.data?.code_page }} |
No resource entries.
Decoded product identifiers, build numbers, and object counts recorded by the toolchain.
No Rich records.
Find byte patterns and capture values in PE sections.
Headers are excluded; a match limit of 0 means unlimited.
{{ state.error }}
| # | {{ field }} | Permissions | Entropy | Distribution | Characteristics interpretation |
|---|---|---|---|---|---|
| {{ index + 1 }} | {{ formatValue(header[field]) }} | {{ permissions(header.Characteristics) }} | {{ sectionData.entropy[index].entropy?.toFixed(2) ?? '—' }} | {{ sectionData.characteristics[index].join('\n') }} |
No section headers.
{{ identity }}
| Name | RVA | Virtual size | Raw size | Permissions | Entropy | Distribution | Entry |
|---|---|---|---|---|---|---|---|
| {{ section.header.Name }} | {{ formatSummaryHex(section.header.VirtualAddress) }} | {{ formatSummaryHex(section.header.VirtualSize) }} | {{ formatSummaryHex(section.header.SizeOfRawData) }} | {{ permissions(section.header.Characteristics) }} | {{ section.analysis.entropy?.toFixed(2) ?? '—' }} | {{ section.entry ? '← Entry point' : '' }} |
No sections.
No parsed imports.
These imports suggest capabilities to review in context; they do not prove behavior.
No findings from these lightweight checks.