# hasherezade/pe-bear

Portable Executable reversing tool with a friendly GUI

Repository: https://github.com/hasherezade/pe-bear
Canonical: https://ross.abutalabs.com/products/pe-bear
Homepage: https://hshrzd.wordpress.com/pe-bear/
Language: C++
License: GPL-2.0
License Family: copyleft
Topics: pe-file, pe-format, pe-analyzer, pe-analyzer-gui, pe-editor, multiplatform, malware-analysis, bearparser
Last push: 2026-06-10T11:08:16+00:00

## Health v2 (maintenance only)
Score: 78/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 86, release rhythm 55, longevity 100
- inputs: {"age_days": 1445, "days_push": 84, "days_rel": 89, "gap_med": 210, "n_releases_24m": 4}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3781, forks 243 (observed 2026-08-28T04:08:18.455460+00:00)

## What it is
PE-bear is a multiplatform GUI reversing tool for Windows PE (Portable Executable) files, built on bearparser and capstone. It gives malware analysts a fast, stable 'first view' of PE files, including malformed ones.

## Use cases
- inspect pe file headers and sections
- analyze suspicious windows executables
- view imports and exports of a dll
- disassemble code at a chosen rva
- compare two pe files
- detect known packers in a binary
- edit pe file sections and imports

## When to choose
- you need a friendly GUI to triage PE files during malware analysis
- you must handle malformed or corner-case PE files
- you want a free multiplatform PE viewer with disassembly and diffing

## When to avoid
- you need automated static/dynamic analysis or sandboxing rather than manual inspection
- you analyze non-PE formats like ELF or Mach-O
- you need a scriptable headless parser for pipelines

## Facets
- artifact type: application
- maturity: active
- function: reverse-engineering, gui, parser, security
- domain: reverse-engineering, security, developer-tools
- platform: windows, cross-platform
- tags: pe-files, malware-analysis, disassembler, binary-analysis, qt, linux, macos, desktop

## Member repositories
- hasherezade/pe-bear (main) score 78

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:18.455460+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:27:45.274373+00:00, confidence not recorded.
  - readme: https://github.com/hasherezade/pe-bear (fetched 2026-08-28T04:08:18.455460+00:00, sha 9016063d59d3)
  - homepage: https://hshrzd.wordpress.com/pe-bear/ (fetched 2026-08-29T09:22:19.404701+00:00, sha c85b8870495f)
- Data as of 2026-08-30T08:39:29.467469+00:00.