hasherezade/libpeconv

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1385 stars · 208 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

libPeConv is a C++ library for loading, manipulating, and dumping Windows PE (Portable Executable) files. It provides a 'swiss army knife' of helper functions for building custom PE loaders, including section remapping, relocations, import loading, IAT hooking, and memory PE dumping.

Use cases

• manually map and execute a PE file in my own loader
• dump a PE from memory and rebuild its import table
• hook the import address table of a loaded PE
• build a PE binder that embeds and runs an executable from a resource
• parse and modify PE file sections and relocations
• write a custom PE loader for malware analysis

When to choose

• you need fine-grained control over PE loading steps like relocations, imports, or IAT resolution
• you are doing malware analysis or reverse engineering on Windows binaries
• you want to dump and rebuild PEs from process memory
• you need to load PEs from memory buffers rather than disk

When to avoid

• you need inline function hooking - use MS Detours or MinHook instead
• your application relies on MUI resources, which are unsupported
• you need a cross-platform PE parser that runs on non-Windows systems

Facets

library · maturity active

parser security reverse-engineering developer-tools security reverse-engineering windows developer-tools windows cpp pe-files pe-loader manual-mapping iat-hooking malware-analysis pe-dumping

Member repositories

For agents

markdown · JSON · MCP: product_card(name="hasherezade/libpeconv")