PEditor 1.7

PEditor is a tool for PE (Portable Executable) files PEditor is a tool for PE (Portable Executable) files.

Do a right mouse click and you can terminate a process/module, dump each in 3 ways, view infos about processes/modules and you can load a process/module into the PEditor.

If you select a module that isn't a real module (it has the same filename as its owing process) then PEditor will automatically take the owing process for dumping and freeing/killing.

How to dump/unpack a file:

First load the target file into PEditor and click on break'n'enter. Do a "bpint3" in Softice and click in break'n'enter on RUN. It'll break at the entrypoint. If you're lucky you'll see what you've to enter to restore the first byte of the entrypoint ;).

Now only trace to the depackers exitpoint and enter a "a" and a "jmp eip" at the exitpoint. Then press F5 to exit Softice. Back in PEditor close break'n'enter and click on tasks, dump your target process full.

Kill the process, load the dumped file into PEditor and fix the entrypoint. Optional you can use the realigner of PEditor to minimize the filesize of the dumped file or use the Import Table rebuilder.

Note: PEditor is free for personal use only.