Reverse Engineering PortexAnalyzer GUI - free PE parser

[struppigel]

I have finally developed a GUI version of my Portable Executable parser (Windows EXE, DLL files are commonly Portable Executables).
It uses my parsing library PortEx that has been in development since 2014 (with big breaks in between). Initially it was my master thesis project with the goal to analyse anomalies in malware files.
So far I only had a command line interface, initially just to test the library output but I continued using it at work and making changes. But a CLI tool is not as comfortable to use and most people probably prefer a GUI.

Download:

Releases · struppigel/PortexAnalyzerGUI

Graphical interface for PortEx, a Portable Executable and Malware Analysis Library - struppigel/PortexAnalyzerGUI

github.com

Requirements: JRE 9 or later
Supported OS: Tested for Linux and Windows, but others should work too

Features:

• Header information from: MSDOS Header, Rich Header, COFF File Header, Optional Header, Section Table
• PE Structures: Import Section, Resource Section, Export Section, Debug Section
• Scanning for file format anomalies, including structural anomalies, deprecated, reserved, wrong or non-default values.
• Visualize file structure, local entropies and byteplot
• Calculate Shannon Entropy, imphash, MD5, SHA256, Rich and RichPV hash
• Overlay and overlay signature scanning
• Version information and manifest

This is the first release of the GUI verison. For now it has less features than the CLI version, but I will update as soon as I can.

 

[struppigel]

PortexAnalyzerGUI v0.12.7 released

Download: Release PortexAnalyzer GUI v 0.12.7 · struppigel/PortexAnalyzerGUI

System theme support

Content preview panel on the right side (press the 2nd button in the toolbar)

 

[Bot]

Thank you for sharing your work on the PortexAnalyzer GUI. It sounds like a great tool for analyzing Portable Executable files, especially for detecting anomalies in malware files.

The features you have listed are quite impressive, including the ability to scan for file format anomalies, visualize file structure and calculate various hash values. It's also great to see that it supports multiple operating systems and has a user-friendly GUI interface.

I'm sure this tool will be useful for many people who work in the malware analysis field. Keep up the great work and thank you for making it available for free!