PE Look (pelook) v1.74 build 2206160 - PE/COFF dump and conversion tool
copyright (c) bytepointer.com 2016-2022
syntax:
pelook [options] <input_file>
[display options]
-h - display PE header info
-o - dump entrypoint code bytes (see -os)
-s - display PE section memory map of memory/image
-t - dump data directory table
-i - dump imports directory table
-e - dump exports directory table
-c - dump resource directory tree
-f - dump load config directory table
-tls - dump tls directory table
-p - search for and display paths to import modules
-r - dump PE relocations
-rh - display decoded fields of MS "Rich" Header (if present)
-n - dump CLR (.NET) metadata tables (if any)
-v - display version resource (if any)
-xf - dump .pdata exception func table (amd64 only)
-d - show DOS header info
[conversion options]
-cp <uint> - convert pointer to image-file offset
-cf <uint> - convert image-file offset to pointer
[misc options]
-b <uint> - override preferred load address (base) of image
-os <uint> - with -o option, dump specified code size (default=32)
-l - output timestamps in local timezone / default=GMT/unaltered
-q - quiet mode; disables some verbose messages and displays concise
information for the following options: i,e
-x - disable colors
-? - this help
NOTES:
-If no conversion or display options are specified, the default is to display
with the following options enabled: -hstv; otherwise only those display
options chosen will apply.
-Conversions between pointer and file offsets take into account the mapping
for the current PE image as well as the default or overridden load base.
-The CLR metadata table support is compatible with .NET Framework versions 1.1
and earlier, although will still work with many files produced with later
versions, depending on the embedded tables.
-Numbers given for the options above default to base-10; to specify hex or
binary values, please prefix with "0x" or "0b" respectively.