hasherezade/pe-bear

Health v2 · maintenance only

Adoption not part of the score

3781 stars · 243 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

PE-bear is a multiplatform GUI reversing tool for Windows PE (Portable Executable) files, built on bearparser and capstone. It gives malware analysts a fast, stable 'first view' of PE files, including malformed ones.

Use cases

• inspect pe file headers and sections
• analyze suspicious windows executables
• view imports and exports of a dll
• disassemble code at a chosen rva
• compare two pe files
• detect known packers in a binary
• edit pe file sections and imports

When to choose

• you need a friendly GUI to triage PE files during malware analysis
• you must handle malformed or corner-case PE files
• you want a free multiplatform PE viewer with disassembly and diffing

When to avoid

• you need automated static/dynamic analysis or sandboxing rather than manual inspection
• you analyze non-PE formats like ELF or Mach-O
• you need a scriptable headless parser for pipelines

Facets

application · maturity active

reverse-engineering gui parser security reverse-engineering security developer-tools windows cross-platform pe-files malware-analysis disassembler binary-analysis qt linux macos desktop

Member repositories

For agents

markdown · JSON · MCP: product_card(name="hasherezade/pe-bear")