PE Inspector

§01 — About

PE Inspector is a read-only forensic bench for Windows executables. It parses the PE/COFF headers, sections and entropy, walks imports, exports and a linear-sweep disassembly with cross-references, pulls strings and resources, and recovers the URLs a binary stored obfuscated — surfacing each hidden endpoint as evidence with a byte offset. Findings map to MITRE ATT&CK and Authenticode integrity is checked offline. The binary is opened as data and is never executed or modified.

• 01

  Parses PE/COFF headers, sections and data directories, with per-section entropy to flag packed or encrypted regions

• 02

  Imports, exports, strings, resources and a linear-sweep disassembly with cross-references

• 03

  Recovers strings stored obfuscated (constant and position-dependent XOR, base64); hidden endpoints surface with byte offsets

• 04

  Auth and license decision-point mapping, MITRE ATT&CK heuristics, offline Authenticode integrity, YARA-style rules

• 05

  Read-only: the binary is read as data, never executed or modified, with no network request

• 06

  Signed auto-updates, light and dark themes, a command palette and a full accessibility pass

§03 — Built with