PE Viewer 3.0

[KozakMak]

2iteg
pls add if exe file is Inno Setup = show tab "Setup Script"
and like UPXPath= you can use something like innounpPath=

[iteg]

2KozakMak
1)

Pls add wdx functional

Added to ToDo list.
2)

It is not clear what and why all these percentages are!

Entropy reflects the uniformity of the byte frequency distribution. The entropy value ranges from 0 (0%) to 8 (100%).
3)

In C:\Windows\System32\shell32.dll plugin does not show icons on the Resources tab. Bug?

The plugin shows all resources from IMAGE_DIRECTORY_ENTRY_RESOURCE, but resources can be stored in other sections. I planned to implement the resource search algorithm.
4)

pls add if exe file is Inno Setup = show tab "Setup Script"

Added to ToDo list.

[KozakMak]

v3.0.17

---------------------------
Totalcmd64
---------------------------
System Error. Code: 1400.

Недопустимый дескриптор окна.
---------------------------
ОК
---------------------------

[KozakMak]

Entropy reflects the uniformity of the byte frequency distribution. The entropy value ranges from 0 (0%) to 8 (100%).

okey, TOTALCMD64.EXE is 75% - and what does it mean?

The plugin shows all resources from IMAGE_DIRECTORY_ENTRY_RESOURCE, but resources can be stored in other sections. I planned to implement the

...and one fine day we will be able to replace ICLView completely!

[AntonyD]

Entropy shows the degree of "randomness" of the data inside the file. But there are nuances:

A regular executable file:
The standard one .exe file entropy is usually average (in the range of 50-70%). This is because,
that it contains structured data:
)Headers, metadata.
)The program code that the compiler organizes in a certain order.
)Link tables, rows, and sometimes "empty" areas.
Such a file usually has noticeable repeating patterns, which reduces entropy.

Compressed or packaged executable file:
If the .exe has been compressed (for example, by utilities like UPX), its entropy increases (closer to 75-85%),
because the content becomes more "dense" and chaotic.

Encrypted executable file:
The fully encrypted one .exe entropy will be very high (90-100%). This is because,
that the encrypted data looks like random "noise". Deliberate noise.

[KozakMak]

sounds very complicated
this line must be hidden by default

[iteg]

2KozakMak

I planned to implement the resource search algorithm.

...and one fine day we will be able to replace ICLView completely!

Already done. In the next version.

[KozakMak]

2iteg
Can you add .msi info? Like in viewtopic.php?t=76566

[iteg]

2KozakMak

System Error. Code: 1400.

A known mistake.

Can you add .msi info?

Unfortunately, MSI files are not a PE format.

[Hurdet]

Hang on 400MB file, do it have a disable option?

[AntonyD]

I should notice that to find exe which will be more than 400MB and only compressed with UPX - is not a simple case.
As I know very often EXE with such big size is a simple SETUP exe. So it's like an compressed archive.
BUT you are talking about the single, solid 'exe'? With size>400MB? Am I right?
Which one do you have on your hands?

SETUP exe's which I have and even with size ~1GB - are very easy "opening" with this plugin. No hanging.

[Hurdet]

Hang on 400MB file, do it have a disable option?

I tryed again Today and it not hang.
But I have 10s "Please wait" for MD5, SHA256 and VirusTotal.

[AntonyD]

I had ~6/7 seconds. And that's not a big problem imho...
Especially for VT

[iteg]

Test version 3.0.17.3:
- Fixed a bug in checking the validity of certificates.
- For the "Valid To" certificate field added color indication of relative current time validity.
- A revocation check has been added for a chain of signature certificates and an individual certificate. The check is performed on the OS cache without any requests to the network.
- Internal code optimization.
https://www.upload.ee/files/17984417/wlx_peviewer_3.0.17.3.rar.html

[iteg]

Test version 3.0.17.4:
- Support for "Reparse Point" Tags "Appexeclink" for UWP applications (%Localappdata%\Microsoft\WindowsApps). On the "Info" tab, the "Reparse Point" label and the parameters of "Appexeclink" are displayed.
- Implementation of the absolute path to the file when opening a symbolic link is implemented (for example, created using mklink.exe).
https://www.upload.ee/files/18042024/wlx_peviewer_3.0.17.4.rar.html