13

I am looking for a way to automatically represent the relation between the content of a PE file and how it would be loaded in memory - either an IDA plugin, a combination of pefile script+R/SVG...

Something that could look like this (hand drawn):

enter image description here

(Not necessarily something that already supports PE, but that could be extended freely to support PE)

Improve this question
  • How did you draw this by hand ? – Mellowcandle Apr 28 '13 at 16:31
  • 2
    In Inkscape (FYI here is the file) – Ange Apr 28 '13 at 16:33
  • Yes, nice illustration! – dyasta Apr 28 '13 at 19:10
1

TeX (TikZ) could be used for it. See here for some discussion and examples.

Improve this answer
  • 1
    Try to add a short explanation or description for the application here itself. – asheeshr Apr 29 '13 at 14:20
1

You've seen CFF Explorer, right? It is a free PE Editor/viewer by Daniel Pistelli (the author of the IDA 6.x Qt GUI) that breaks out a PE file by field. This is not a vector graphic display like you are asking for, but it may serve the same need.

Improve this answer
  • I know and use regularly CFF Explorer and its sequel, Cerbero Profiler, but they don't have any graphical representation for section mappings. – Ange Apr 30 '13 at 6:53
  • My bad. In my defense, I did state that as a disclaimer in my answer. – dingo_kinznerhook Apr 30 '13 at 20:49
  • 2
    @dingo_kinznerhook Don't feel bad, there is nothing wrong with contributing an answer. That's why I don't like the fact that answers can be downvoted negative. I makes sense to vote them down to 0, but -1 is just an insult and discourages contribution :o. – dyasta May 2 '13 at 21:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.