Skip Navigation

PE TREE: How Covid19 Spurred A New Malware Reverse Engineering Tool

Overview

Title: PE TREE. How Covid19 Spurred A New Malware Reverse Engineering Tool

Date: Tuesday, November 17, 2020

Time: 10 AM GMT | 11 AM CET

Duration: 1 hour

Register Now

By completing this form, you agree to BlackBerry processing your personal data for the purpose of contacting you about the software or service you have selected.

You're registered! You will receive a confirmation email shortly.

Error submitting form. Please try again later.

Summary

PE Tree is a new open-source tool developed by the BlackBerry Research and Intelligence team for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Aimed at the reverse engineering community, PE Tree also integrates with HexRays’ IDA Pro decompiler to allow for easy navigation of PE structures, as well as dumping in-memory PE files and performing import reconstruction.

In this webinar, Tom Bonner, the author of PE, will demonstrate the basic operation of PE Tree, as well as IDA Pro and Rekall integration, dumping PE files from memory and reconstructing imports.

During the talk, Tom will also discuss why this is so important for security engineers and share the origin story of the tool which was inspired by his son who has been stuck at home with him due to COVID-19. .

Speaker

Tom Bonner

Distinguished Threat Researcher
BlackBerry