Run PE Tree and attempt to carve portable executable files from a binary file: $ pe-tree-carve -hĭark-mode can be enabled by installing QDarkStyle: $ pip install qdarkstyle h, -help show this help message and exit Run PE Tree and scan for portable executables in files, folders and ZIP archives: $ pe-tree -h Git clone the repository and setup for development: Windows > git clone Install directly from GitHub using a fresh virtual environment and pip: Windows > virtualenv env Double-click VA/RVA to disassemble with capstone.Extract PE files from ZIP archives (including password protected with infected).The PE Tree standalone application finds portable executables in files, folders and ZIP archives. Rebuild IAT and IDT from disassembly (using IDA Pro, Ghidra or capstone).Reconstruct import address and directory tables (IAT/IDT) using several methods:.Remove unnecessary data directory pointers.Export to CyberChef for further manipulation.Displays the following PE headers in a tree-view:.

Allows for fast visual overview and comparison of PE samples.Provides a high-level overview of PE structures, size and file location.Windows memory dumps (raw, EWF, vmem etc.).ZIP archives (including password protected).Parsing PE files and memory images from:.Standalone application with plugins for:.It can also be used with IDA Pro, Ghidra, Volatility, Rekall and minidump to view and dump in-memory PE files, as well as perform import table reconstruction. PE Tree is a Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5.

Install ida pro kali linux