PE-bear

hasherezade·hasherezade.PE-bear

PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files.

winget install --id hasherezade.PE-bear --exact --source winget

Latest 0.7.2·June 5, 2026

Release Notes

BUGFIX

  • Removed hard-coded limit of the displayed resources (only 50 were visible)
  • Fixed GUI behavior on Windows 11 (i.e. invisible selection in hex editor and disasm view), fixed editing content in hex editor
  • Fixed crashing on fast editing content in hex edit
  • Fixed crashing when closing the signature search window before the search finished
  • Other small fixes FEATURE
  • Added Japanese language
  • In hex editor: any selected number can be now interpreted as an address within the PE and followed on demand via context menu (read more here)
  • Added string search (ANSI and Unicode) - as another option along to signature search (read more here)
  • In signature search: if it is defined by the string with odd length, assume that the last nibble is a wildcard rather than dropping the byte (i.e. 123 will be interpreted as 12 3?)
  • In hex editor: in addition to NOP/clear of the selected ranges, you can fill them with a custom character (read more here)
  • In Diff Window: unified a toolbar for both views WARNING: The Windows build with vs10 suffix is built with Qt4 (legacy) - in contrast to the other builds that are with Qt5, Qt6 (recommended). It is prepared for the purpose of backward compatibility with old versions of Windows (i.e. XP). ─────────────────────────────────────────────┬───────┬─────────────────────────┬─────────────────────────────────────┬───────────────────────────────────────────── File │Qt │OS │Depends │Info ─────────────────────────────────────────────┼───────┼─────────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────── PE-bear_0.7.2_qt6_x64_win_vs22.zip │6 │64-bit, Windows, portable│requires: VS2017 Redistributables │for Windows 10 and above ─────────────────────────────────────────────┼───────┼─────────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────── PE-bear_0.7.2_qt5_x64_win_vs17.zip │5 │64-bit, Windows, portable│requires: VS2017 Redistributables │recommended for Windows < 10 ─────────────────────────────────────────────┼───────┼─────────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────── PE-bear_0.7.2_qt5_x86_win_vs17.zip │5 │32-bit, Windows, portable│requires: VS2017 Redistributables │ ─────────────────────────────────────────────┼───────┼─────────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────── PE-bear_0.7.2_qt4_x86_win_vs10.zip │4 │32-bit, Windows, portable│ │legacy build for Windows XP (not recommended) ─────────────────────────────────────────────┼───────┼─────────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────── PE-bear_0.7.2_qt6_x64_macos.app.zip │6 │64-bit, MacOS, portable │ │ ─────────────────────────────────────────────┼───────┼─────────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────── PE-bear_0.7.2_qt6_x86_64_linux.AppImage │6.4.2 │64-bit, Linux, portable │AppImage │ ─────────────────────────────────────────────┼───────┼─────────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────── PE-bear_0.7.2_qt6.4.2_x64_linux.tar.xz │6.4.2 │64-bit, Linux │requires Qt installation │ ─────────────────────────────────────────────┼───────┼─────────────────────────┼─────────────────────────────────────┼───────────────────────────────────────────── PE-bear_0.7.2_qt5.15.13_x64_linux.tar.xz │5.15.13│64-bit, Linux │requires Qt installation │ ─────────────────────────────────────────────┴───────┴─────────────────────────┴─────────────────────────────────────┴───────────────────────────────────────────── No build available for your system? You can build is from the sources: following 📖 Wiki.

Installer type: zip

ArchitectureScopeDownloadSHA256
x64DownloadA9420CD7F417813E32C762DE83806AF631A48C1E70725FB2DF9A664B3F34977D
x86Download58431C57CBFFE63348F4E9FE0BE82DA32E0C8B298685A78642307A012CA728DD

Details

Homepage
https://github.com/hasherezade/pe-bear
License
GPL-2.0
Publisher
hasherezade
Support
https://github.com/hasherezade/pe-bear/issues

Tags

bearparsermalware-analysismultiplatformpe-analyzerpe-analyzer-guipe-editorpe-filepe-format

Older versions (2)

0.7.1
ArchitectureScopeDownloadSHA256
x64Download28732ad3ab70ef889d02699658a81d696f208b26bb0f3d72c8c1eb60220d42a0
x86Download1413362f917946ccde3c2fd99f80fa21a32320714233961828463dd7c52e2e3d
0.7.0
ArchitectureScopeDownloadSHA256
x64Download3FDA3132417A19F99FBE802C6F78CB06049186F03D828DBAC87525EFB1913012