blackberry/pe_tree

Health v2 · maintenance only

Flags: archived

Adoption not part of the score

1343 stars · 173 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

PE Tree is a Python module and standalone GUI application for viewing Portable Executable (PE) files in a tree-view, built on pefile and PyQt5. It integrates with IDA Pro, Ghidra, Volatility, Rekall, and minidump to dump in-memory PE files and reconstruct import tables.

Use cases

• inspect PE headers of an exe or dll in a tree view
• dump in-memory PE files from a Windows memory dump
• reconstruct import tables of an unpacked malware sample
• carve PE files from a binary blob
• analyze a Windows minidump for embedded executables
• view PE files inside IDA Pro or Ghidra
• compare PE samples visually with a rainbow PE map

When to choose

• you need a visual tree-view of PE file structures
• you are doing malware analysis or memory forensics on Windows binaries
• you want to dump and reconstruct PE files from memory dumps or minidumps
• you want a plugin for IDA Pro, Ghidra, Volatility, or Rekall

When to avoid

• you only need programmatic PE parsing without a GUI (use pefile directly)
• you analyze non-PE formats like ELF or Mach-O
• you need automated bulk analysis rather than interactive inspection

Facets

application · maturity maintenance

reverse-engineering gui parser security security reverse-engineering windows developer-tools python windows cross-platform pe-files malware-analysis ida-pro-plugin ghidra-plugin volatility memory-forensics import-reconstruction binary-carving pyqt5 pefile linux macos desktop

Member repositories

For agents

markdown · JSON · MCP: product_card(name="blackberry/pe_tree")