I know someone on this forum has written a tool similar to PE-Bear (in FPC+Lazarus of course), but I don’t remember who.
You might be referring to me. I wrote PeBytesF which is a PE dump/viewer type of program similar to PEBear, CFF Explorer, Dumpbin, Matt Pietrek's PEDump and many others. It was my _first_ FPC program, a port from the C version I wrote many years before I started using FPC. It was an exercise in FPC proficiency.
(and a chance to leave behind some C code I was never pleased with.)
For those who might be interested, the link to the latest version of my PE viewer is:
https://forum.lazarus.freepascal.org/index.php/topic,46617.msg459635.html#msg459635There are some things my PE viewer does better than any other: 1. when it comes to displaying PE information, it is the most complete one (there is enough information to edit the PE data using a hex editor.) 2. it is by far the one that presents the information in the most intelligible, readable and understandable way, hands down! 3. it's the only PE viewer that presents the information in both, raw and cooked format. 4. it tells you if the PE uses some areas for multiple purposes. 4. it is often the _only_ one which outputs the LOAD CONFIG directory completely and accurately (even MS' Dumpbin fails to do that for some PE files.)
One thing it doesn't do that others do (but poorly) is disassemble the code section(s). PEBear, CFF Explorer and dumpbin (likely among others) do but, they do a linear dis-assembly which means a significant percentage of the dis-assembly will be incorrect because they do _not_ recognize data stored in code segments, effectively making the dis-assembly less than useless because it is misleading.
Dumpbin has one feature I like that PeBytesF does not have (and will _not_ have) which is: it can use PDB symbols to produce a reasonably good dis-assembly but, if dis-assembly is desired then the free version of IDA does a much better job.
Recent
