This one of most advanced freeware tools for Reverse Code Engineer. Created by Daniel Pistelli, a freeware suite of tools including a PE editor called CFF Explorer and a process viewer. The PE editor has full support for PE32/64. Special fields description and modification (.NET supported), utilities, rebuilder, hex editor, import adder, signature scanner, signature manager, extension support, scripting, disassembler, dependency walker etc. First PE editor with support for .NET internal structures. Resource Editor (Windows Vista icons supported) capable of handling .NET manifest resources. The suite is available for x86, x64 and Itanium.
- Explorer Suite (Multi-Platform Version, Recommended)
- Explorer Suite (x86 Version)
- CFF Explorer (x86 Version, stand-alone, Zip Archive)
- CFF Explorer Extensions Repository
The CFF Explorer was designed to make PE editing as easy as possible, but without losing sight on the portable executable's internal structure. This application includes a series of tools which might help not only reverse engineers but also programmers. It offers a multi-file environment and a switchable interface.
Features:
- Process Viewer
- Windows Viewer
- PE and Memory Dumper
- Full support for PE32/64
- Special fields description and modification (.NET supported)
- PE Utilities
- PE Rebuilder (with Realigner, IT Binder, Reloc Remover, Strong Name Signature Remover, Image Base Changer)
- View and modification of .NET internal structures
- Resource Editor (full support for Windows Vista icons)
- Support in the Resource Editor for .NET resources (dumpable as well)
- Hex Editor
- Import Adder
- PE integrity checks
- Extension support
- Visual Studio Extensions Wizard
- Powerful scripting language
- Dependency Walker
- Quick Disassembler (x86, x64, MSIL)
- Name Unmangler
- Extension support
- File Scanner
- Directory Scanner
- Deep Scan method
- Recursive Scan method
- Multiple results
- Report generation
- Signatures Manager
- Signatures Updater
- Signatures Collisions Checker
- Signatures Retriever
