PeXplorer is a PE (Portable Executable) file analyzer and editor for Windows, written in Delphi 6. It was developed between 2003 and 2006 as a tool for developers, reverse engineers, and system programmers who need to examine and modify the internal structure of Windows executables (.exe, .dll, .sys, etc.).
Historical note: This is an archival release of source code from 2003–2006. It was built with Borland Delphi 6 and targets Windows XP/2000 era systems.
- Full PE header display: DOS header, File header, Optional header fields
- Section enumeration and inspection
- Data Directory viewer
- Import table viewer
- Export table viewer
- RVA ↔ File Offset converter
- Edit all PE header fields (with automatic
.bakbackup before saving) - Add new PE sections
- Delete existing sections
- Edit section header flags and attributes
- Edit Data Directory entries
- Recalculate PE checksum (ImageHlp)
- CRC-16, CRC-32, CRC-ARC (XModem, PKZIP variants)
- PE header checksum calculation and verification
- List all running processes and their loaded modules
- Dump process memory (full or partial)
- Set process priority (Idle, Normal, High, Realtime)
- Kill processes
- Load memory dumps directly into PeXplorer
- Graphics resource extractor (GfxRip)
- Window/control object inspector (Object Control)
- Binary file comparison
- Shell context menu integration ("Load Into PeXplorer")
- Command-line file opening support
- Audio module player (BASSMOD integration — yes, it played music)
The application is a Delphi 6 SDI application using the VCL (Visual Component Library). Each major feature lives in its own form/unit. The core PE manipulation is done via direct memory-mapped structures (packed record types matching the Windows PE format exactly) over TMemoryStream.
PeXplorer.dpr — Main project file
Main.pas — Central hub form
PeLib.pas — PE structure definitions
PeFunctions.pas — Core utility functions
ProcWiz.pas — Process wizard (enumerate, dump, control)
CRC.pas — CRC calculation engine
Imports.pas — Import table viewer
Export.pas — Export table viewer
SecEdit.pas — Section header editor
AddSection.pas — Add PE sections dialog
DirEdit.pas — Data Directory editor
Directory.pas — Directory viewer
RvanOffset.pas — RVA/Offset calculator
ObjectControl.pas — Window object inspector
CompareBF.pas — Binary file comparison
GfxRip.pas — Graphics resource extractor
Options.pas — Settings/preferences
About.pas — About dialog
bassmod_dynamic.pas — BASSMOD DLL dynamic wrapper
Requirements:
- Borland Delphi 6 (or later Delphi versions may work with minor adjustments)
- Windows target (uses Windows API extensively)
- BASSMOD.dll (included) — required at runtime for audio features
Steps:
- Open
PeXplorer.dprin Delphi 6 - Build → Compile All
- The output executable will be placed in the project directory
The yoda's PE corpus/ directory contains a collection of exotic and non-standard PE files assembled by Sistemo (April 2003) for testing PE tools. It includes samples from:
.NET— .NET / COM+ PE filesDelphi— Delphi-compiled binaries with unusual features (TLS, reloc)PE32Plus (64bit!!)— 64-bit PE32+ filesVB— Visual Basic compiled binariesWatcom Compiler— Watcom compiler outputs with non-standard PE layouts- Root corpus files with merged sections, delay imports, no imports, optimized PE, etc.
Credit: yoda's 32-bit PE file test corpus by Sistemo (sistemo@gmx.net)
From the original development notes (PeXNotes.txt):
- Loading live modules into PeXplorer causes an I/O Error 32 (file locked) — a temporary file system workaround was planned but not implemented
- Export tables that are not in sorted order (exotic PE files) may display values out of order
- Tab index navigation system was planned but not fully implemented
MIT License — see LICENSE