TZWorks LLC
System Analysis and Programming
www.tzworks.com
(Version 1.27)
TZWorks LLC software and related documentation ("Software") is governed by separate licenses issued from TZWorks LLC. The User Agreement, Disclaimer, and/or Software may change from time to time. By continuing to use the Software after those changes become effective, you agree to be bound by all such changes. Permission to use the Software is granted provided that (1) use of such Software is in accordance with the license issued to you and (2) the Software is not resold, transferred or distributed to any other person or entity. Refer to your specific EULA issued to for your specific the terms and conditions. There are 3 types of licenses available: (i) for educational purposes, (ii) for demonstration and testing purposes and (iii) business and/or commercial purposes. Contact TZWorks LLC (info@tzworks.com) for more information regarding licensing and/or to obtain a license. To redistribute the Software, prior approval in writing is required from TZWorks LLC. The terms in your specific EULA do not give the user any rights in intellectual property or technology, but only a limited right to use the Software in accordance with the license issued to you. TZWorks LLC retains all rights to ownership of this Software.
The Software is subject to U.S. export control laws, including the U.S. Export Administration Act and its associated regulations. The Export Control Classification Number (ECCN) for the Software is 5D002, subparagraph C.1. The user shall not, directly or indirectly, export, re-export or release the Software to, or make the Software accessible from, any jurisdiction or country to which export, re-export or release is prohibited by law, rule or regulation. The user shall comply with all applicable U.S. federal laws, regulations and rules, and complete all required undertakings (including obtaining any necessary export license or other governmental approval), prior to exporting, re-exporting, releasing, or otherwise making the Software available outside the U.S.
The user agrees that this Software made available by TZWorks LLC is experimental in nature and use of the Software is at user's sole risk. The Software could include technical inaccuracies or errors. Changes are periodically added to the information herein, and TZWorks LLC may make improvements and/or changes to Software and related documentation at any time. TZWorks LLC makes no representations about the accuracy or usability of the Software for any purpose.
ALL SOFTWARE ARE PROVIDED "AS IS" AND "WHERE IS" WITHOUT WARRANTY OF ANY KIND INCLUDING ALL IMPLIED WARRANTIES AND CONDITIONS OF MERCHANTABILITY, FITNESS FOR ANY PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT SHALL TZWORKS LLC BE LIABLE FOR ANY KIND OF DAMAGE RESULTING FROM ANY CAUSE OR REASON, ARISING OUT OF IT IN CONNECTION WITH THE USE OR PERFORMANCE OF INFORMATION AVAILABLE FROM THIS SOFTWARE, INCLUDING BUT NOT LIMITED TO ANY DAMAGES FROM ANY INACCURACIES, ERRORS, OR VIRUSES, FROM OR DURING THE USE OF THE SOFTWARE.
The Software are the original works of TZWorks LLC. However, to be in compliance with the Digital Millennium Copyright Act of 1998 ("DMCA") we agree to investigate and disable any material for infringement of copyright. Contact TZWorks LLC at email address: info@tzworks.com, regarding any DMCA concerns.
pe_view combines a collection of PE manipulation code that was written over the years. Following the theme of many of my tools, this tool does not rely on the use of the Windows API to parse the PE structure, so it can be compiled and run on other platforms. Currently there are compiled versions for Windows and Linux.
While there are a number of freely available PE tools online (many of which are more capable then pe_view and offer editing features), I ended up writing my own version of a PE viewer some years ago primarily to understand the PE format in more depth and to have something that was Windows agnostic.
pe_view can extract executable components from all versions of Windows executables (not just the ones with a PE format). This includes the old DOS and NE formats that would run in some in the older versions of Windows. Unfortunately, pe_view has not been updated to handle the .NET internals.
The disassembler handles only the Intel x86 instruction set and not the amd64 instruction set. There are most likely other boundary conditions that may not parse properly, especially for those PE files that use some sort of obfuscation technique for anti-reverse engineering. As those are found, the tool is updated with a fix to handle the boundary condition.
pe_view makes use of the FOX-toolkit. FOX is a C++ based Toolkit for developing GUI applications that can easily port across various platforms by compiling the source for the appropriate OS. FOX is distributed under the GNU Lesser General Public License (LGPL), with a FOX Library License addendum.
To use this tool, an authentication file is required to be in the same directory as the binary in order for the tool to run.
Since pe_view was designed to be a GUI based tool, one can just double click on pe_view and select [File -> Open] menu combination to operate on a target portable executable (PE) file. Once a PE file is loaded, besides reviewing all the internal components via the tree view that is displayed, one can:
[View -> Ascii chars]
[View -> Unicode chars]
[View -> Find]
[View -> Dump Hex]
[View -> Collection Compare].
[Option -> Load Config file]
[View -> Packaging]
The second option to use pe_view is much more limited, but allows one to dump summary stats information via the command line. This is useful if processing many PE files triaging them into categories. To aid in this, pe_view can handle std input in file processing.
All command line options that don't use the GUI need the option -nogui as one of the arguments. Second, all output needs to be redirected to a file (windows version only), since the windows version does not output to the command prompt.
(a) Option without std input processing
pe_view -file <pefile> [-peid <peid file>] -out <results file>
(b) Option with std input processing
// windows specific
dir *.exe /b /s | pe_view -pipe [-peid <peid file>] -out <results file>
// linux specific
find /home -name *.exe -type f | pe_view -pipe [-peid <peid file>] -out <results file>
ls /home/win32_samples/*.dll | pe_view -pipe [-peid <peid file>] -out <results file>
The help for which command line options are available can be seen via the following options:
pe_view --help
pe_view /?
pe_view -?
Summary info about how the PE file was packaged.
Starting with version 0.71, there is additional functionality that gives a summary of some of the PE statistics on how the PE file was compiled and/or packaged. Included with this analysis is the ability to use any PEiD signature file that is available online (see reference 5 below).
To load a PEiD signature file, one can do this by selecting the menu option
[Option -> Load PE Signature]
To view the summary information about how the PE file was packaged, select
[View -> Packaging]
There is also a command line option to load a PEiD signature file on pe_view startup, using the switch -peid <path/file>.
Reference 4 below has some links to locations where one can obtain a PEiD signature file or get more information about its format. Below are the rules for how pe_view parses PEiD signature files.
';' '[' ']' 'signature =' 'ep_only =' '??'
[Microsoft Visual C++ 8]
signature = E8 ?? ?? 00 00 E9 ?? ?? FF FF
ep_only = true
pe_view incorporates the standard extraction of both ASCII and Unicode strings. (ref. View menu). Strings are considered to be at least 5 consecutive printable characters.
One may also desire to look at how one PE file compares to a collection of PE files. For the simple case, pe_view takes some predefined PE files that are part of the running operating system and uses these to compare the PE file you are analyzing. To use this comparison option, select the 'File Compare' in the 'View' menu.
If one desires to customize which collection of PE files to compare against, one can specify an alternative list of PE files to be used as the collection. This can be done by first generating a text file containing the path\filename of each PE file on a separate line and reading that file into pe_view by using the "Option"->"Load Config".
See config file format in the section below for details on using this option.
The output during this type of compare will be one line per PE file, with the target PE file on the top.
The following syntax is used when displaying the results:
date Ln ln Af As Os os Su su wv ss f d c e x i m b s 6 v R k k# co file [rsrc's by #]
Compile date -+ | | | | | | | | | | | | | | | | | | | | | | | | | | +-- rsrc's flagged
MajorLinkerVer --+ | | | | | | | | | | | | | | | | | | | | | | | | +-- filename
MinorLinkerVer -----+ | | | | | | | | | | | | | | | | | | | | | | +--- company <truncated>
FileAlignment ---------+ | | | | | | | | | | | | | | | | | | | | +- num of kernel32 imports
SectionAlignment -------+ | | | | | | | | | | | | | | | | | | +-- has only kernel32 as import
MajorOSVersion -----------+ | | | | | | | | | | | | | | | | +-- rich signature present (normal)
MinorOSVersion -----------+ | | | | | | | | | | | | | | +---- version info present (normal)
MajorSubsysVersion --------+ | | | | | | | | | | | | +-- 64 bit binary [pe32+]
MinorSubsysVersion --------+ | | | | | | | | | | +-- is digitally signed
Win32VersionValue ----------+ | | | | | | | | +--- random blob in rsrc
Subsystem -----------------+ | | | | | | +-- PE file embedded in rsrc
Dll Characteristics flags present ----+ | | | | +-- IAT present
debug directory present ----+ | | +-- execute and write combined w/i section
checksum present [+, -, x] ----+ +-- exported funcs [+, n, e, *]
+ = present and ok + = looks ok
- = not present n = name mismatch
x = mismatch e = no exports
* = no exports w/ name mismatch (or no name)
pe_view also allows one to generate a histogram of any of the sections in the PE file. This can be accessed by highlighting the section or resource that one wants to compute a histogram for and selecting from the context aware menu (eg. right click) and select the 'Stats' item.
These files are text files that list the PE files to use as a collection to compare a target PE with. Currently there are 3 types of collection types: (a) executable, (b) dynamic link library and (c) driver. The parsing rules for these config files are as follows:
General Rules.
Lines listing pe files
The files listed (one file per line) after the above type declaration will be categorized with that collection.
// executables
[exe files]
systemroot\system32\cmd.exe
systemroot\system32\calc.exe
systemroot\system32\services.exe
...
// dynamic link libraries
[dll files]
systemroot\system32\user32.dll
systemroot\system32\gdi32.dll
systemroot\system32\crypt32.dll
systemroot\system32\msvcrt.dll
...
// drivers
[driver files]
systemroot\system32\drivers\ntfs.sys
systemroot\system32\drivers\ndis.sys
systemroot\system32\ntoskrnl.exe
systemroot\system32\hal.dll
...
To run a user defined config file, in the file Options menu, select 'Load Configfile', whereupon an open file dialog box will allow you to navigate to the config file you wish to load.
After the config file is loaded, it will be parsed and the files specified will be analyzed and the PE internals extracted. A summary of the extraction results will then be displayed. Then, any file that is loaded into the pe_view can be analyzed against this loaded configuration via the View menu -> 'Collection Compare'.
If a config file is not loaded by the user, pe_view will try to examine the target file against a predefined list of pe files.
Sometimes, it is useful to extract fragments from the PE file and examine the fragments with another tool. Resources in the PE file, for example, can contain other files, like: png, jpeg, zipped, or even another PE file. pe_view allows one to extract any portion of the PE file that the viewer displays.
For example, if one wants to extract a resource, one can select any resource in the resource table displayed and using the context aware menu (eg. right clicking on a highlighted resource) and select the 'Save' menu item.
After saving the desired fragment, one can use the appropriate viewer to view the extracted data.
a. Parsing .NET internal structures b. Parsing resource entries c. Tool has not been compiled for Apple Silicon (ARM64) yet, just Intel based MacOS
For this tool to work, the X Window System libraries are required for both Linux and macOS (they are not required for Windows). These libraries use the X11 protocol and graphics primitives to render the graphical user interface components. These libraries are common on Unix-like OS's.
If one is unfamiliar with X Windows or the libraries associated with it, one can download an installer package from XQuartz.org, which is an open-source effort to develop a version of the X Windows System that runs on Linux and macOS.
After the X11 libraries are installed, one needs to ensure they are running prior to running this tool.
This tool has authentication built into the binary. The primary authentication mechanism is the digital X509 code signing certificate embedded into the binary (Windows and macOS).
The other mechanism is the runtime authentication, which applies to all the versions of the tools (Windows, Linux and macOS). The runtime authentication validates that the tool has a valid license. The license needs to be in the same directory of the tool for it to authenticate. Furthermore, any modification to the license, either to its name or contents, will invalidate the license.
The tools from TZWorks will output header information about the tool's version and whether it is running in limited, demo or full mode. This is directly related to what version of a license the tool authenticates with. The limited and demo keywords indicates some functionality of the tool is not available, and the full keyword indicates all the functionality is available. The lacking functionality in the limited or demo versions may mean one or all of the following: (a) certain options may not be available, (b) certain data may not be outputted in the parsed results, and (c) the license has a finite lifetime before expiring.