Unofficial database of all Total Commander plugins and addons

PE Viewer 3.0.16

PE Viewer 3.0.16

The plugin is designed to view information about PE format modules (EXE, DLL, DRV, SYS, OCX, COM, etc.).
Shows:
- summary information about the file: size, timestamps and hashes.
- statistics from virustotal.com.
- signature analysis of "PE Sniffer" and "PEiD".
- detailed information about sections and module headings.
- functions exported by the module.
- imported external modules and their functions used. With the ability to open the selected external module in a separate instance of the plugin.
- resources contained in the module. With the ability to view, copy to the clipboard and save all resources.
- digital signatures and certificates. With the ability to check the validity of the signature of the module itself and the validity of the certificates used.
- debugging structures with detailed analysis.
- load configuration structure with detailed analysis.
- CLR header of the .Net assembly. With the ability to display the versions installed in the OS ".Net Framework" and ".Net Core".

Make sure that there is no detect line for the plugin in the wincmd.ini configuration file. Allows you to open files without filtering by extension.

Category: TC Lister Plugins
Status: Freeware
Author: Anatol Paulovich
Added: 5.06.2023
Updated: 2.11.2024
Downloaded: 15706 times
Discuss on TC forum

Download (x32, x64) (2150 Kb)

What's new

3.0.16
[+] Implemented UPX unpacking. The "UPXPath" parameter has been added to the configuration file to specify the path to upx.exe. The "UPX" marker has been added to the "Info" form. If you hover the cursor over the marker and the "UPXPath" parameter is set, the cursor will change to a hand. Double-clicking the file unpacks it into the temporary folder "%TEMP%\_tc". If the unpacking is successful, a new "Total Commander" process is launched to display the unpacked file in the plugin, otherwise an error message will be displayed. The unpacked file is not deleted.
[+] For the "Resources" form, parsing of the "TYPELIB" resource in the "MSFT" format has been implemented. The "SLTG" format is not supported. Implemented the ability to view multiple "TYPELIB" resources, and not just the very first one, as in fileinfo.
[+] For the "Sections / Headings" form, the validity of the "OptionalHeader.CheckSum" and "Rich Header.CheckSum" fields has been implemented. If the value is incorrect, it is marked with an error color and the correct value is added in brackets.
[+] For the "Info" form, a line output of the full path of the file has been added. The short path (name~1) is converted to a long path. Also, the parameter settings file block has been moved to the beginning of the list.
[+] The "Info" tab now displays a file block of parameters for unsupported LE, NE and MZ formats.
[+] For the "Resources" form, I implemented the display of the number of elements in a node, as well as the display of a list of child elements.
[+] Added the "Detect compiler" option to the settings menu. Allows you to manage the search for signatures from the Signs.txt and UserDB.txt files.
[*] The project has been rebuilt with Embarcadero 12.2.1.
[*] For the "Info" form, the error in completing the auxiliary thread for calculating hashes and obtaining VT status when quickly running through files in Ctrl+Q mode (quick view) has been fixed.
[*] For the "Resources" form, reading all resources has been changed to use the file-to-memory mapping mechanism. All file operations and intermediate buffers are removed.
[*] Fixed an error in attribute checking when opening a directory.
[*] Fixed an error in reading the header of a PNG image.
[*] Fixed an error in reading the "PACKAGEINFO" resource.
[*] Fixed an error in parsing the import table.
[*] Fixed an error in setting the icon for the "Accelerators" resource.
[*] Fixed an error when determining the resource type.
[*] The block of copied information has been expanded when clicking on the brief information tab "PE32 ...". Implemented changing the mouse cursor when hovering. Also for a bookmark with a description of the error.
[*] The algorithm for opening a file in Ctrl+Q (quick view) mode on the '..' element when unpacking a file with the wcx plugin has been improved.
[*] Fixed error in displaying "Entry Point Raw Offset" from 8 to 4 bytes.
[*] A new parameter "GridLines" has been added to the PEViewer.ini configuration file for theme sections for displaying the grid in the list component. Also renamed the "ImportantColor" parameter to "HighlightColor2".
[*] Improved light theme. If you only need to set the style of flat buttons for the light theme and the standard color will not change, then in the configuration file you need to uncomment the line "MainForm.tcToolbar.Style=tsFlatButtons".
[*] Code optimization and minor GUI improvements.

3.0.15
[+] A new tab "Load Configuration" has been added.
[+] Added support for 24 types of processors for the PE format.
[+] Retrieving color values and font parameters from the PEViewer.ini configuration file has been implemented. Sections and parameters are described in PEViewer.ini of the plugin installation archive.
[+] The 'Theme' item has been added to the main menu with three modes: auto - the mode is taken from 'Total Commander', dark and light.
[*] The order of the tabs has been changed.
[*] For the "Import" form, the error of opening the imported library in the plugin if there are spaces in its path has been fixed.
[*] For the "Debug" form, two exceptions in processing data structures have been eliminated.
[*] For the "Resources" form, the drawing of jpeg, png and gif image types with animation through standard modules, and not through WIC, has been redone. The problem with displaying images in Windows XP has been resolved. Large images are now scaled to fit the display area.
[*] For the ListView component, the context menu item for copying column values ??has been improved.
[*] For the TreeView component, copying the name and value of a node with child elements has been improved.
[*] The sorting direction arrows of the ListView component have been changed.
[*] For data fields that reflect quantity or size, the output format has been changed to 'hex (int)'.
[*] Minor changes to the GUI and constant literals.

3.0.14
[+] For the "Info" form, functionality for interaction with virustotal.com has been implemented: obtaining the file status and generating a link for new and old browsers. The corresponding options are available in the main settings menu. The file status is displayed after the text "virustotal.com" in the "Property" column. The value "-/-" means that the transmitted hash of the file is not in the VirusTotal database. The value "Enumber" is the network communication error code.
[+] For the "Import" form, the imported library can be opened in a new instance of the plugin. "Total Commander" allows you to open a given plugin only in a separate process.
[+] Support for the new resource type "DIALOG" in two formats has been added for the "Resources" form.
[+] For the "CLR Header" form, the output of a list of installed ".Net Framework" and ".Net Core" in the OS has been implemented.
[+] For the "Info" form, a marker for the presence of an OLE interface has been added, i.e. DllRegisterServer and DllUnregisterServer functions.
[+] For list components, alternating background color of rows has been implemented. The option is available in the main settings menu.
[+] The hotkey F11 is assigned to the main menu item "On Top Of Windows".
[+] For the main menu item of the plugin version, items have been added to the plugin pages of the sites wincmd.ru and totalcmd.net.
[+] Added a Chinese (simplified) localization file for the program.
[*] For bookmarks, the problem of the “parasitic hint” (hint shadow) has been fixed.
[*] For the "Debug" form, the error of the large font size of the text description has been fixed.
[*] A memory leak has been fixed for the "Import" form.
[*] For the "Resources" form, the error in group saving of the "MUI", "MENU" and "DIALOG" resources has been fixed.
[*] For the "Resources" form, the crash error of "Total Commander" when parsing "STRING" resources has been fixed.
[*] For the "Resources" form, the output of the "STRING", "MESSAGE", "MENU" and "VERSION" resources has been improved.
[*] For the "Resources" form, the output of the "BITMAP", "ICON" and "CURSOR" resources has been redesigned. Code optimization.
[*] For the "Resources" form, the resource tree nodes have been renamed.
[*] For the "Info" form, detailed output of the values ??"File type", "File subtype", "File attributes" and "Target OS" has been implemented.
[*] Dynamic display of file size has been implemented for the "Info" form.
[*] The output of the "Language" and "Code page" fields has been improved: hexadecimal and decimal values.
[*] The context menu for the "Resources" form has been improved.

3.0.13
[+] For the "Info" form, an item with a link to virustotal.com has been added. When you double-click on the virustotal.com line, a page opens in the browser and the link is copied to the clipboard. SHA1 hash has been replaced with SHA256.
[+] For the "Info" form, a marker for the presence of the TYPELIB resource of the COM/ActiveX object has been added.
[+] For the list component, copying the contents of a cell by double click has been implemented. For the "Sections / Headings" form, the ability to go to the section node by double-clicking the list component element has been removed.
[+] Added a Czech localization file for the program.
[*] For the "Debug" form, the output of the IMAGE_DEBUG_NB10, IMAGE_DEBUG_RSDSI, IMAGE_DEBUG_TYPE_FPO and IMAGE_DEBUG_COFF structures has been improved and expanded. The text field is set to a monospace font. Some data has been translated into tabular form.
[+] For the "Resources" form, support for the new resource type "MENU" in two formats has been added.
[*] For the "Resources" form, the output of the "MUI" resource has been improved.
[*] For the "Info" form, the output of strings in the absence of the StringFileInfo structure has been corrected.
[*] The code for correctly releasing the plugin to avoid file blocking has been improved.
[*] The German localization file for the program has been updated.

3.0.12
[+] Added a new form "Debug".
[+] Added the "On Top Of Windows" option to the settings menu.
[+] For the "Import" form, the label has been added to display the number of delay import modules.
[+] For the "Sections / Headings" form, highlighting of the validity of the "Data Directories" and "ImageBase" fields has been added.
[*] For the list component, the error in copying a line with an empty caption has been fixed.
[*] For the "Resources" form, the problem with "Select all" not working from the context menu of the tree element has been fixed.
[*] For the "Resources" form, the problem of hot keys not working for the list of properties of the current resource has been fixed.
[*] For the "Resources" form, full copying of text resources to the clipboard without the need for selection has been implemented.
[*] For the "Resources" form, the error in displaying the size of the icon or cursor has been fixed.
[*] For the "Resources" form, the display of the Accelerator resource has been improved.
[*] For the "Import" form, loading of modules without an extension has been fixed.
[*] For the "Import" form, the sorting of functions by "Ordinal" has been fixed.
[*] For the "Sections / Headings" form, the error in displaying the number of "Data Directories" elements has been fixed.
[*] Fixed error in reading section headers.
[*] Fixed error in reading the certificate table.
[*] Fixed an error in reading the import table.
[*] Fixed an error in reading the delay import table.

3.0.11
[+] Support for Windows XP has been implemented. Fixed: display of Unicode characters, dark text of the selected tab, resource saving dialogs, height of the resource properties panel and section list.
[+] Added a German localization file for the program.
[+] Copying the text of the summary information tab and the error description tab to the clipboard by clicking the mouse has been implemented.
[*] For the "Info" form, the error in displaying the multilingual resource VERSION has been fixed.
[*] For the "Import" form, the error in loading the import table has been fixed.
[*] For the "Import" form, the error in finding the path for the "Universal CRT" modules has been fixed.
[*] For the "Import" form, the "Number" column of the list component of the module functions has been added. Functions that do not have a name and are called through a sequence number.
[*] For the "Resources" form, the error in displaying the "ID" of the resource string "String" for the third nesting level has been fixed.
[*] For the "Resources" form, the algorithm for recursive saving of resources has been improved.
[*] Small icons of resource tree nodes have been corrected for the “Resources” form.
[*] For the list component, the error of overwriting column labels has been fixed.
[*] For the list component, the error in calculating the width of the last column has been fixed.
[*] Fixed display of "Message Table" resources.
[*] Configuration file parameters have been renamed. Changed plugin parameter to use lsplugin.ini. Described in detail in the help.

3.0.10
[+] Added a new form "CLR Header". For .Net assemblies, the target platform is added to the information label.
[+] Implemented "Dark Mode". Installed automatically based on the TC theme. Grid is disabled for list components.
[+] For the "Resources" form, an algorithm for determining text resources (ANSI, UNICODE16LE, UNICODE16BE and UTF8) has been implemented. See Windows OS components.
[+] Support for new resource types "MUI", "HTML" and "REGISTRY" has been added for the "Resources" form.
[+] A properties panel for the current resource has been added to the "Resources" form.
[+] A plugin version item has been added to the settings menu. When clicked, the plugin web page opens.
[*] The "Import / Export" form is divided into two separate forms: "Import" and "Export".
[*] For the "Export" form, the list component is switched to virtual mode. It is now possible to view over 20,000 exported functions.
[*] For the "Signatures" form, "Status" verification fields for signatures and certificates have been added. "Type" field for signatures. Added names in X500 format for "Subject" and "Issuer". Long fields are hidden in child nodes.
[*] Display in HEX mode has been fixed for the “Resources” form.
[*] For the "Resources" form, the display of broken resources has been improved.
[*] For the "Import" form, the problem with displaying Unicode characters for the "Status" column has been fixed.
[*] Fixed sorting of the last column of the list component.
[*] Flickering of components during fast transitions in the "Quick View" TC mode has been eliminated.
[*] The code for applying localization without re-reading data has been improved.
[*] For forms, the display of separators and their correct position when loading have been improved.

3.0.9
[+] Added support for PE format for "ARMNT", "ARM64" and "Intel AI64" (Itanium) architectures.
[+] For the "Digital Signatures" form, parsing of the "Extensions", "Public Key" and "Encrypted Hash" fields has been implemented. Improved information display.
[+] For the "Resources" form, the text information output component has been replaced. Unicode support has been implemented.
[*] The output of brief information about the format, architecture and byte order has been updated.
[*] The "MachineType" description lines have been corrected.
[*] Improved definition of DOS format.
[*] Fixed a bug in applying localization.

3.0.8
[*] For the "Info" form, the error loading the "VersionInfo" resource has been fixed.
[*] For the "Resources" form, the error loading resources has been fixed.
[+] A new tab "Digital Signatures" has been added.
[+] For the "Resources" form, support for new resource types "Accelerator" and "Message Table" has been added.
[+] For the tree component, the context menu items "Copy Value" and "Copy Name" have been added.

3.0.7
[*] For the "Sections / Headers" form fixed an error of copying contents of tree nodes (Ctrl+C).
[*] Fixed bug of applying localization when opening two or more Listers.
[*] The algorithms for searching for signatures using the "PEiD" and "PE Sniffer" databases have been reworked.
[*] For the "Info" form, a permanent compiler definition has been implemented.
[+] For the "Info" form added output of MD5 and SHA1 file hashes.
[+] For the "Export / Import" form a waiting window is implemented when performing long calculation operations.
[*] Reworked the code for reading and saving settings to a configuration file. Removed the use of the PEViewer_config.ini file.

3.0.6
[*] Fixed error of reading "StringTable" structure with empty elements.
[*] Fixed a bug in loading the delay import catalog.
[*] Fixed error of loading a file with "IMAGE_NT_HEADERS" structure equalized at the 2Kb boundary.
[*] Fixed bug of searching for dependent modules.
[*] Fixed the problem of intermediate resizing and redraws when embedding the plugin's main form in the owner window. The effect is noticeable in "Quick View" mode when going through the list of files.
[*] For the "Sections / Headers" form fixed an error in displaying the description of "Flags" sections for the "Align" value.
[*] For the "Resources" form fixed the error of resource language code loss displayed in the status line.
[*] For the "Resources" form fixed hotkeys for resource display modes Ctrl+1-4.
[*] For the "Resources" form fixed vertical separator placement error.
[*] For the "Resources" form fixed the error of losing focus when canceling the save dialog.
[*] Fixed the algorithm for selecting and focusing components.
[*] AutoSize of columns of the list component has been improved.
[+] For the "Resources" form the algorithm of automatic detection of data formats for display has been implemented. It is described in detail in the help.
[+] For the "Info" form, the display of the "Characteristics", "DllCharacteristics" and "File Accessed" fields has been added.
[+] For the "Info" form, the display of the presence of the "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR" structure (CLR Header) has been added. One of the hallmarks of a .Net application.
[+] For the "Info" form, the presence of the headers "Rich Header" and "CLR Header" is highlighted.
[+] For the "Quick View" mode, additional keys for bypassing components inside the form (Enter and Shift+Enter) have been added. It is described in detail in the help.
[+] For the "Resources" form the copying of images to the clipboard has been implemented.
[+] For the "Resources" form, the component of the list of icons or cursors is hidden if it contains only one element.
[+] Added "Help" element to the main form in the settings menu.
[+] For the main form, the settings menu can be opened by pressing F12.
[*] The algorithm for opening files by the plugin has been changed. Removed "detect" string generation. It is described in detail in the help.
[*] For the "Export / Import" form, the processing time for structures of imported and exported functions has been reduced.
[*] For the "Export / Import" form, the time for building and checking imported modules and their functions has been reduced.
[*] For the "Resources" form, the function of saving graphic files has been redesigned. Also fixed the code for correctly saving "Bitmap" resources.
[*] Improved algorithm for detecting PE files.
[*] Improved code for displaying "Language" and "CodePage" on the "Info" and "Resources" forms.
[*] Reading of the list of elements of structures "StringFileInfo" and "VarFileInfo" is implemented.
[*] For the "Export / Import" form, symbolic display of module status has been simplified. It is described in detail in the help.
[*] For the "Resources" form, the display of strings from the resource of a packed file has been fixed. Now an inscription about the incorrectness of the data is displayed.
[*] For the "Resources" form, the rendering of graphic files has been improved and parasitic flickering of components has been eliminated.
[*] For the "Sections / Headers" form, the tree nodes "IMAGE_FILE_HEADER" and "IMAGE_OPTIONAL_HEADER" are expanded by default.
[*] Corrections of program localizations.
[*] Internal code optimization.

3.0.5
[+] For the "Headers / Sections" form display of the "Rich Header" structure has been implemented. A checksum verification algorithm has also been implemented. If the checksum is incorrect, "CheckSum" is displayed in red.
[+] For the "Info" form the presence of the "Rich Header" structure is displayed.
[+] For the "Headers / Sections" form backlighting of the "CheckSum" and "Data Directories" tree elements has been implemented.
[*] Fixed handling of number keys 1-8 in Lister.
[*] For the "Export / Import" form fixed error of "Delay" status loss (hourglass) for imported libraries.
[*] Internal code optimization.

3.0.4
[*] Updated and fixed flags for PE structures: "Section Flags", "Machine Types", "Characteristics", "Windows Subsystem" and "DLL Characteristics".
[*] Fixes for the fields of the IMAGE_OPTIONAL_HEADER structure.
[*] Fixed error in determining file offset address for exported functions.
[*] Fixed handling of F3, F5, F7 and Backspace keys in Lister.
[*] Fixed error when the program loses focus when canceling the save resources dialog.
[*] Localization fixes for the program.
[+] Using double buffering to draw the content of all forms.
[+] Use the same font for all forms.
[+] Ability to navigate through components using the Tab/Shift+Tab keys.
[+] For the status bar of the "Resources" form added ability to copy text by double mouse click.
[+] For the "Headers / Sections" form backlighting of some elements of the tree is implemented.
[*] For the "Headers / Sections" form transition from a list element to the corresponding tree element by double mouse click or Enter key is implemented.
[*] For the "Headers / Sections" form a single hotkey for copying text data Ctrl+C is assigned.
[*] For the "Headers / Sections" form hexadecimal output of the value itself has been added to the string format of field data.
[*] For the "Headers / Sections" form the "Attributes" column contains a text description.
[*] Internal code optimization.

3.0.3
[*] The algorithm for reading versioned structures has been redesigned. Now information for C# modules is displayed correctly.
[*] For the "Export/Import" tab added error output when reading import and export sections. Necessary for packed modules.
[*] The display order of information data blocks on the "Info" and "Resources" tabs (Version element) has been changed.
[*] Redesigned context menu. Added item "Copy name". Hotkey combinations have been changed.
[+] Added support for *.DRV, *.EFI and *.WINMD files.
[+] Added files of Belarusian and Ukrainian localizations of the program.
[+] Added the "Catalog" column for imported modules.
[*] GUI fixes.
[*] Localization fixes for the program.
[*] Eliminated program execution exceptions.
[*] Internal code optimization.

3.0.2
[+] Added the ability to group save resources.
[+] Added the ability to view PNG resources.
[+] Added English localization file for the program.
[*] GUI fixes.
[*] Localization fixes for the program.
[*] Internal code optimization.

3.0.1
[*] The project was rebuilt by Embarcadero 11.3.1.
[*] Fixed errors in the 64th version of the plugin.
[*] Fixed GUI bugs.
[*] Fixed errors in the display of different types of resources.
[*] Internal code optimization.
[*] The custom graphics components have been replaced by the standard ones.
[*] The "PEiD" database has been updated.
[+] Added support for High DPI.

Total Commander
Main page
Search site
Links RSS
Submit a Plugin

Downloads
FS Plugins
Lister Plugins
Packer Plugins
Content Plugins
TC Utilities
SynPlus for TC
MultiArc Addons
Far2wc Addons
Language Files
Icons
Developers
Others Text Editors

TOTALCMD.NET © 2004 Personal project
Idea, design and programming © Andrei Piasetski aka Ergo
This is an unofficial Total Commander site
Official Total Commander site is www.ghisler.com