pev-0.81/ 0000755 0001750 0001750 00000000000 14001407542 010747 5 ustar user user pev-0.81/LICENSE.OpenSSL 0000644 0001750 0001750 00000013753 13777157521 013271 0 ustar user user LICENSE ISSUES
==============
The OpenSSL toolkit stays under a dual license, i.e. both the conditions of
the OpenSSL License and the original SSLeay license apply to the toolkit.
See below for the actual license texts.
OpenSSL License
---------------
/* ====================================================================
* Copyright (c) 1998-2016 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* openssl-core@openssl.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
*
*/
Original SSLeay License
-----------------------
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/ pev-0.81/README.md 0000644 0001750 0001750 00000004076 13777157521 012257 0 ustar user user # pev
Open source, full-featured, multiplatform command line toolkit to work with PE (Portable Executables) binaries.
[](https://travis-ci.org/merces/pev)
## How to get the source code
git clone --recursive https://github.com/merces/pev.git
## How to build on Linux
cd pev
make
**NOTE**: You may need to install OpenSSL using your package manager. Examples:
apt install libssl-dev
yum install openssl-devel
## How to build on macOS
cd pev
CFLAGS="-I/usr/local/opt/openssl/include/" LDFLAGS="-L/usr/local/opt/openssl/lib/" make
**NOTE**: You may need to install OpenSSL and PCRE via [Homebrew](http://brew.sh/):
brew update
brew install openssl
## How to build on Windows (via [Cygwin](http://cygwin.com/))
cd pev
make
make zip
**NOTE**: The following packages must be installed along with your Cygwin:
- gcc-core
- binutils
- make
- zip
- openssl-devel
- git (just to clone the repository and make things easier)
## FAQ
### I get a `fatal error: 'openssl/evp.h' file not found`. How can I fix that?
Please install OpenSSL for your system. Use a package manager to make things easier. If you're compiling pev in macOS,
make sure you've set both CFLAGS and LDFLAGS environment variables according.
### I get the one of the following errors when trying to compile with `make` command:
$ make
make[1]: *** No rule to make target 'all'. Stop.
make[1]: Leaving directory '/home/user/pev/lib/libpe'
make: *** [Makefile:9: all] Error 2
$ make
cd lib/libpe && /Library/Developer/CommandLineTools/usr/bin/make all
make[1]: *** No rule to make target `all'. Stop.
make: *** [all] Error 2
It seems libpe is missing. Have you forgot the `--recursive` switch of git clone command?
Anyway, download libpe source code, put it in the right directoy and try again:
cd pev/lib
rmdir libpe
git clone https://github.com/merces/libpe.git
cd ..
make
Please check the [online documentation](http://pev.sourceforge.net/doc/manual/en_us) for more details.
pev-0.81/doc/ 0000755 0001750 0001750 00000000000 14001407542 011514 5 ustar user user pev-0.81/doc/manual/ 0000755 0001750 0001750 00000000000 14001407542 012771 5 ustar user user pev-0.81/doc/manual/en_us/ 0000755 0001750 0001750 00000000000 14001407542 014102 5 ustar user user pev-0.81/doc/manual/en_us/manual.docbook 0000644 0001750 0001750 00000001161 13777157521 016742 0 ustar user user
]>
&info;
&pev;
&install;
&configuration;
&basic-usage;
&advanced-features;
&tools;
&faq;
&license;
pev-0.81/doc/manual/en_us/tools.docbook 0000644 0001750 0001750 00000015037 13777157521 016634 0 ustar user user
Included tools
cpload
Usage: cpload [-m MESSAGE] FILE
Load .cpl (Control Panel Item) files for debugging
Example: cpload -m init notafiscal.cpl
Options:
If -m is present, MESSAGE should be:
Option Message
------------------------------
init CPL_INIT
getcount CPL_GETCOUNT
inquire CPL_INQUIRE
select CPL_SELECT
dblclk CPL_DBLCLK
stop CPL_STOP
exit CPL_EXIT
newinquire CPL_NEWINQUIRE
startwparms CPL_STARTWPARMS
setup CPL_SETUP
Otherwise, cpload will send all messages to CPlApplet()
ofs2rva
Usage: ofs2rva <offset> FILE
Convert raw file offset to RVA
Example: ofs2rva 0x1b9b8 calc.exe
Options:
-v, --version show version and exit
--help show this help and exit
pedis
Usage: pedis OPTIONS FILE
Disassemble PE sections and functions (by default, until found a RET or LEAVE instruction)
Example: pedis -r 0x4c4df putty.exe
Options:
--att set AT&T syntax
-e, --entrypoint disassemble entrypoint
-f, --format <text|csv|xml|html> change output format (default: text)
-m, --mode <16|32|64> disassembly mode (default: auto)
-i, <number> number of instructions to be disassembled
-n, <number> number of bytes to be disassembled
-o, --offset <offset> disassemble at specified file offset
-r, --rva <rva> disassemble at specified RVA
-s, --section <section_name> disassemble entire section given
-V, --version show version and exit
--help show this help and exit
pehash
Usage: pehash OPTIONS FILE
Calculate hashes of PE pieces
Example: pehash -s '.text' winzip.exe
Options:
-f, --format <text|csv|xml|html> change output format (default: text)
-a, --all hash file, sections and headers with md5, sha1, sha256, ssdeep and imphash
-c, --content hash only the file content (default)
-h, --header <dos|coff|optional> hash only the header with the specified name
-s, --section <section_name> hash only the section with the specified name
--section-index <section_index> hash only the section at the specified index (1..n)
-V, --version show version and exit
--help show this help and exit
pepack
Usage: pepack FILE
Search for packers in PE files
Example: pepack putty.exe
Options:
-d, --database <file> use database file (default: ./userdb.txt)
-f, --format <text|csv|xml|html> change output format (default: text)
-V, --version show version and exit
--help show this help and exit
peres
Usage: peres OPTIONS FILE
Show information about resource section and extract it
Example: peres -a putty.exe
Options:
-a, --all Show all information, statistics and extract resources
-i, --info Show resources information
-s, --statistics Show resources statistics
-x, --extract Extract resources
-v, --file-version Show File Version from PE resource directory
-V, --version show version and exit
--help Show this help and exit
pescan
Usage: pescan OPTIONS FILE
Search for suspicious things in PE files
Example: pescan putty.exe
Options:
-f, --format <text|csv|xml|html> change output format (default: text)
-v, --verbose show more info about items found
-V, --version show version and exit
--help show this help and exit
pesec
age: pesec [OPTIONS] FILE
Check for security features in PE files
Example: pesec wordpad.exe
Options:
-f, --format <text|csv|xml|html> change output format (default: text)
-c, --certoutform <text|pem> specifies the certificate output format (default: text)
-o, --certout <filename> specifies the output filename to write certificates to (default: stdout)
-v, --version show version and exit
--help show this help and exit
pestr
Usage: pestr OPTIONS FILE
Search for strings in PE files
Example: pestr acrobat.exe
Options:
-n, --min-length set minimum string length (default: 4)
-o, --offset show string offset in file
-s, --section show string section, if exists
-V, --version show version and exit
--help show this help and exit
readpe
Usage: readpe OPTIONS FILE
Show PE file headers
Example: readpe --header optional winzip.exe
Options:
-A, --all full output (default)
-H, --all-headers print all PE headers
-S, --all-sections print all PE sections headers
-f, --format <text|csv|xml|html> change output format (default: text)
-d, --dirs show data directories
-h, --header <dos|coff|optional> show specific header
-i, --imports show imported functions
-e, --exports show exported functions
-V, --version show version and exit
--help show this help and exit
rva2ofs
Usage: rva2ofs <rva> FILE
Convert RVA to raw file offset
Example: rva2ofs 0x12db cards.dll
Options:
-V, --version show version and exit
--help show this help and exit
pev-0.81/doc/manual/en_us/configuration.docbook 0000644 0001750 0001750 00000001144 13777157521 020335 0 ustar user user
Configuration
Plugins
So far we support only a single plugins path option in pev.conf file
with the following structure:
plugins_dir=/usr/lib/pev/plugins
All pev binaries will look for a pev.conf file in their current directory first (Windows
reasons) and a $HOME/.config/pev.conf file after to get the plugins path. If it cannot find
both files, /usr/lib/pev/plugins is used.