Didier Stevens

Tuesday 12 June 2018

Update: pecheck.py Version 0.7.3

Filed under: My Software,Update — Didier Stevens @ 0:00

This new version handles errors in PEiD’s userdb files better.

pefile does not support the full syntax used by PEiD, hence errors might occur, like this:

pecheck-v0_7_3.zip (https)
MD5: 480C9AC4BEE09CAAFB1593E214A39832
SHA256: 359A44751BAA34450B2DA92539AB425507EBB90F8F57CF50E561CCE111809637

5 Comments »

  1. […] Update: pecheck.py Version 0.7.3 […]

    Pingback by Week 24 – 2018 – This Week In 4n6 — Sunday 17 June 2018 @ 8:24

  2. […] Or use pecheck.py: […]

    Pingback by Quickpost: Decoding Certutil Encoded Files | Didier Stevens — Wednesday 27 June 2018 @ 0:00

  3. […] Update: pecheck.py Version 0.7.3 […]

    Pingback by Overview of Content Published in June | Didier Stevens — Monday 2 July 2018 @ 0:01

  4. […] second instance of MZ, like this: This looks like a PE-file. Let’s dump it (-d) and pass it to pecheck.py, a tool to analyze PE-files: It’s indeed a PE-file, more precisely, a 32-bit […]

    Pingback by Extracting a Windows Zero-Day from an Adobe Reader Zero-Day PDF | NVISO LABS – blog — Tuesday 3 July 2018 @ 20:49

  5. […] best to pipe the cut-out data into pecheck, to validate that it is indeed a PE […]

    Pingback by Extracting DotNetToJScript’s PE Files | Didier Stevens — Wednesday 25 July 2018 @ 0:00


RSS feed for comments on this post. TrackBack URI

Leave a Reply (comments are moderated)

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Blog at WordPress.com.

%d bloggers like this: