Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
PETriage — PETriage: A symbol-unified PE file reader for triage, built for multi-platform and multi-interface use. | Kitploit
Tools/GitHubGitHub/uky007/petriage
Static AnalysisVulnerability AnalysisReverse EngineeringForensicsMalware AnalysisDigital ForensicsBinary AnalysisAnomaly Detection
GitHubuky007/petriage

PETriage

PETriage: A symbol-unified PE file reader for triage, built for multi-platform and multi-interface use.

View Repository
1341 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Website
Share

PETriage

PETriage

Crates.io Docs.rs License GitHub tag

A fast, cross-platform PE (Portable Executable) surface analysis tool for malware triage, written in Rust. Designed for analysts who need practical PE triage on Linux, macOS, and Windows without relying on a Windows-only workflow.

Formerly readpe (renamed to avoid naming collisions with existing tools).

Concept

  • Static-only -- The PE is never loaded or executed. Safe for malware triage.
  • CLI-first -- Lightweight default workflow suitable for batch analysis and automation.
  • Composable -- JSON/NDJSON output for piping to , SIEMs, and scripting pipelines.
jq
  • Offline -- No network calls. Suitable for fully air-gapped environments.

    • Interfaces

    InterfaceBuildDescription
    CLIcargo build --releaseDefault workflow for PE triage, structured output, anomaly detection, and batch automation.
    TUIcargo build --release --features tuiInteractive hex viewer with PE region navigation.
    GUIcargo build --release --features guiTabbed analysis, drag & drop, import/string filters, entropy color-coding, PE header editor, overlay carve/strip.

    Quick Install

    Default CLI build:

    root@kitploit:~
    cargo install petriage

    For TUI and GUI builds, build from source with feature flags.

    Or build from source:

    root@kitploit:~
    git clone https://github.com/uky007/petriage.git
cd petriage
cargo build --release

    See docs/installation.md for GUI/TUI build dependencies and cross-compilation.

    Quick Usage

    root@kitploit:~
    petriage <file.exe>              # Surface analysis (all except strings)
petriage <file.exe> -a           # All information including strings
petriage <file.exe> -H           # Headers only
petriage <file.exe> -i           # Imports only
petriage <file.exe> --hashes     # File hashes only
petriage <file.exe> --json       # JSON output
petriage --batch <dir> --ndjson  # Batch-analyze all PEs in a directory
petriage <file.exe> --fail-on warning  # Exit code 3 if anomalies meet the selected threshold
petriage <file.exe> --strip-overlay stripped.exe  # Save PE without overlay
petriage <file.exe> --carve-overlay overlay.bin   # Extract overlay data
    root@kitploit:~
    petriage -x <file.exe>           # TUI hex viewer
petriage-gui                     # GUI (file dialog)
petriage-gui <file.exe>          # GUI (open file directly)

    See docs/usage.md for full CLI options, jq recipes, TUI/GUI details, and example output.

    Key Features

    • 25 anomaly rules -- Packing, code injection, timestamp manipulation, structural anomalies, OPSEC leaks, Rich Header tampering, Export Directory anomalies
    • OPSEC analysis -- PDB paths, credential patterns, endpoint detection, CI/CD path hints, source path username leaks
    • Build fingerprinting -- .NET / Go / Rust / MSVC / MinGW detection with packer identification (UPX, Themida, VMProtect, NSIS, etc.)
    • Overlay carve/strip -- Extract overlay data or save PE without overlay (CLI and GUI)
    • Export Directory analysis -- DLL name, timestamp, function counts with anomalous timestamp detection
    • Semantic header editing (GUI) -- Machine/Subsystem dropdowns, human-readable timestamps, DllCharacteristics flag checkboxes
    • Non-standard section highlighting -- Yellow highlight for unusual section names in CLI and GUI

    Screenshots

    CLI

    PETriage CLI

    GUI

    PETriage GUI

    Headers (Structure View + Editor)

    PETriage Headers

    Header Editor (Inline Editing)

    PETriage Editor

    Exit Codes

    CodeMeaning
    0Success
    1Input error (file not found, read failure, invalid PE)
    2Output error (file write failure)
    3Anomaly threshold exceeded (--fail-on)

    Docs

    • Overview & Features
    • Installation
    • Usage & Examples
    • Survey of Existing Tools
    • Future Work

    License

    MIT OR Apache-2.0

    Download Tool