PE File Inspector

Drag in a Windows Portable Executable (.exe, .dll, .sys) and this parses its real structure — DOS/COFF/Optional headers, sections, imports, exports, and more — directly from the raw bytes in your browser. The file is never uploaded and never executed — this only reads bytes with a `DataView`, the same way a hex editor would. Packed/suspicious indicators are shown as observations grounded in well-known heuristics (section entropy, known packer section names, writable+executable sections), never as a verdict.

What's parsed

DOS header (MZ signature), COFF file header (machine type, section count, timestamp, characteristics), Optional Header (PE32/PE32+ auto-detected, entry point, image base, subsystem, DLL characteristics like ASLR/DEP/CFG), all section headers (with per-section Shannon entropy — a real, standard measure of how compressed/random the bytes look), the import table (walked from each DLL's thunk array, so real function names are shown, not guessed), the export table when present, the fixed-size version resource (file/product version numbers — the free-text fields like company name aren't parsed), and whether a digital signature is present (its presence only — this does not validate the certificate chain or trust). Corrupted or truncated files are caught and reported, not silently misread.