NO

Author Topic: TLPEView partially imitate wjr's PEView  (Read 20966 times)

Offline TimoVJL

  • Global Moderator
  • Member
  • *****
  • Posts: 2091
TLPEView partially imitate wjr's PEView
« on: July 12, 2017, 09:21:37 PM »
Project freezed.
TLPEView only partially imitate wjr's PEView program that support only x86.
A lot of bugs and quite slow, but was made for x86/x64 exe/dll.

EDIT 2017-08-16: first version with primitive plugin support. a28. Binaries only.
                           Plugin name mask "TLPEPl*.dll". Save sample attached.

EDIT 2017-08-26: one useless exe check for possible a DOS exe removed. a29.
EDIT 2017-08-27: fix symbol table crash. a30.
EDIT 2017-10-13: fix DllCharacteristic. a31.
EDIT 2018-02-12: fix symbol table section name a32.
EDIT 2018-05-31: show file or view offset. a33.
EDIT 2018-07-08: list debug types. a34
EDIT 2018-08-06: fix for import hints/names and empty section. a35

EDIT 2019-03-30: UNICODE a43 objs, IMAGE_FILE_MACHINE_UNKNOWN
EDIT 2019-04-13: UNICODE a44 fix export table forwards.
EDIT 2019-04-15: UNICODE a45 changes in menu handling and listview header for clipboard
EDIT 2019-06-26: UNICODE a46 export name buffer overflow

EDIT: Plugins:
Plugins must be in same folder as TLPEView.
With a good luck plugins are listed in TreeView node context menu with mouse right click.

Another site masm32 for downloads.
« Last Edit: November 08, 2020, 11:38:43 AM by TimoVJL »
May the source be with you

Grincheux

  • Guest
Re: TLPEView partially imitate wrj's PEView
« Reply #1 on: July 13, 2017, 06:01:17 PM »
Works fine on W7 Pro ;D

Not slow

Offline frankie

  • Global Moderator
  • Member
  • *****
  • Posts: 2096
Re: TLPEView partially imitate wrj's PEView
« Reply #2 on: July 14, 2017, 09:10:33 AM »
Nice job Timo  :)
It is better to be hated for what you are than to be loved for what you are not. - Andre Gide

Offline jj2007

  • Member
  • *
  • Posts: 536
Re: TLPEView partially imitate wrj's PEView
« Reply #3 on: July 14, 2017, 02:20:31 PM »
Great work indeed!

Grincheux

  • Guest
Re: TLPEView partially imitate wjr's PEView
« Reply #4 on: July 14, 2017, 07:05:33 PM »
Quote
some fixes and without crt as Avast don't like it.

Uninstall Avast it does not detect anything! :P

Grincheux

  • Guest
Re: TLPEView partially imitate wjr's PEView
« Reply #5 on: July 14, 2017, 07:11:37 PM »
For me it is perfect, the program is very very fast. :D
Suggestions :
Display ressources as text,
Create RC file
Export code section

This program could be a good tool for preparing disassembly.

Very good work.

Offline jj2007

  • Member
  • *
  • Posts: 536
Re: TLPEView partially imitate wjr's PEView
« Reply #6 on: July 19, 2017, 01:38:18 AM »
New version tested on my library, works great. Compliments, Timo!

Online Vortex

  • Member
  • *
  • Posts: 797
    • http://www.vortex.masmcode.com
Re: TLPEView partially imitate wjr's PEView
« Reply #7 on: July 21, 2017, 11:35:23 AM »
Hi Timo,

Nice job. I am testing your tool. Thanks for your work.
Code it... That's all...

Offline frankie

  • Global Moderator
  • Member
  • *****
  • Posts: 2096
Re: TLPEView partially imitate wjr's PEView
« Reply #8 on: July 22, 2017, 11:42:20 PM »
Good job   :D
Maybe a 64bits version of tools is redundant.
Development tools are generally just 32bits because can run on both systems while producing both outputs...  ;)
It is better to be hated for what you are than to be loved for what you are not. - Andre Gide

Online Vortex

  • Member
  • *
  • Posts: 797
    • http://www.vortex.masmcode.com
Re: TLPEView partially imitate wjr's PEView
« Reply #9 on: July 31, 2017, 07:24:33 PM »
Hi Timo,

Thanks again for the great work. I will let you know if I find issues.
Code it... That's all...

Offline TimoVJL

  • Global Moderator
  • Member
  • *****
  • Posts: 2091
Re: TLPEView partially imitate wjr's PEView
« Reply #10 on: August 11, 2017, 09:25:09 PM »
I am thankful for Vortex, as he have pointed me a lot about of errors.
I hope this program is helpful users who want to check x64 PE files.
When basic program is stable, then it is time to think features and possible an/a add-in/plugin feature .
For x86 users PEView is a good/better option.
The public development depends on interest of users. (shall i just develop this for myself ;))
May the source be with you

Offline jack

  • Member
  • *
  • Posts: 62
Re: TLPEView partially imitate wjr's PEView
« Reply #11 on: August 11, 2017, 11:19:14 PM »
I too use PEviewers mainly to view the exported and imported functions in dll's but also some times I just want to know whether an exe is 32 or 64-bit

Online Vortex

  • Member
  • *
  • Posts: 797
    • http://www.vortex.masmcode.com
Re: TLPEView partially imitate wjr's PEView
« Reply #12 on: August 12, 2017, 10:07:22 PM »
Hi Timo,

Many thanks for your nice work. You should maintain the tool for all the forum audience. I see a big potential in your application.  With TLPEView, it's easy to study the internals of MS COFF object modules : For example, one can code a MS COFF object file processor to extract the data or code section for special purposes. I will let you know about the details.
Code it... That's all...

Offline jack

  • Member
  • *
  • Posts: 62
Re: TLPEView partially imitate wjr's PEView
« Reply #13 on: August 13, 2017, 08:13:13 PM »
hello TimoVJL
I use Exescope an old 32-bit utility, here's screenshot
I like your programs ability to work with both 32 and 64 files, but for a naive user as myself it would be nice to have something like the above, to easily see the dependencies and the exported names.

Online Vortex

  • Member
  • *
  • Posts: 797
    • http://www.vortex.masmcode.com
Re: TLPEView partially imitate wjr's PEView (FREEZED)
« Reply #14 on: August 17, 2017, 02:16:43 PM »
Hi Jack,

Attached is a screenshot viewing the functions exported by kernel32.lib

Code it... That's all...