Repolode
Submit
zodiacon

zodiacon/TotalPE2

A Windows-focused PE viewer and analyzer for EXE, DLL, SYS, static libraries, COFF objects and ELF files, with disassembly and decompilation.

Open-source alternative to:PE ExplorerCFF Explorer

View on GitHub
Stars
377
Forks
44
Open issues
3
Last commit
11 days ago

What is it?

Total PE 2 is a viewer for the internals of binary files. It opens Windows PE executables, DLLs and drivers, static libraries, COFF object files and ELF files, and detects the file type from its contents rather than its extension. Headers, sections with entropy, data directories, imports and exports, resources, Authenticode signatures, Control Flow Guard tables, CLR metadata and overlay data are all presented as browsable views.

For code analysis, it disassembles x86, x64 and ARM64 code with symbol names and cross references, draws flow graphs, and integrates Ghidra's decompiler to produce C output with renamed variables and types. Symbols can be loaded from PDB files, and library functions in binaries without symbols can be matched against signatures of Visual C++ and WDK static libraries. It also includes a hex view, a file comparison feature, a Search All function, and VirusTotal lookups.

The project is written in C++ and built with Visual Studio 2026 and vcpkg dependencies. It is licensed under MIT and described by its author as a work in progress.

Key features

  • 01Opens PE, COFF, static library and ELF files, recognized by content.
  • 02Shows headers, sections with entropy, imports, exports and data directories.
  • 03Disassembles x86, x64 and ARM64 code with cross references and flow graphs.
  • 04Decompiles functions to C using Ghidra's decompiler, with renaming and comments.
  • 05Loads PDB symbols and names library functions via static library signatures.
  • 06Compares two PE files and searches imports, exports, strings and symbols at once.

Use cases

  • Inspecting a suspicious Windows executable or DLL before running it.
  • Reviewing the imports, certificates and CFG data of a driver or binary.
  • Reverse engineering ELF binaries or object files built by Visual C++.
  • Comparing two builds of a PE file to see what changed.

Things to know

  • The README describes the project as a work in progress.
  • The README gives no build or install instructions.

In collections

Reverse engineering tools

Topics

#pe#reverse-engineering#disassembler#decompiler#windows#binary-analysis#elf#debugging

FAQ

What is TotalPE2?
A Windows-focused PE viewer and analyzer for EXE, DLL, SYS, static libraries, COFF objects and ELF files, with disassembly and decompilation. Total PE 2 is a viewer for the internals of binary files. It opens Windows PE executables, DLLs and drivers, static libraries, COFF object files and ELF files, and detects the file type from its contents rather than its extension. Headers, sections with entropy, data directories, imports and exports, resources, Authenticode signatures, Control Flow Guard tables, CLR metadata and overlay data are all presented as browsable views.
Is TotalPE2 free to use? What license does it have?
TotalPE2 is open source under the MIT license. Check the license terms before using it in commercial products.
Is TotalPE2 still maintained?
Actively maintained. The last commit to TotalPE2 was on Oct 26, 2026.
What can I use TotalPE2 for?
Inspecting a suspicious Windows executable or DLL before running it. Reviewing the imports, certificates and CFG data of a driver or binary. Reverse engineering ELF binaries or object files built by Visual C++. Comparing two builds of a PE file to see what changed.
Where can I get TotalPE2?
The source code and installation instructions are on GitHub: https://github.com/zodiacon/TotalPE2

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects