hasherezade/pe-bear

Shellcode support

naksyn opened this issue · 0 comments

Thanks for the amazing tool!
It'll be nice to have support for viewing hex and disassembly of shellcode files.

It'll be also a lot useful if one could set a "parsing point" manually into the shellcode, let's say, if we have a shellcode wich has an embedded PE in it, it'll be nice to set the "parsing pont" of the PE manually on the MZ header to be found manually, then obtain a classic valid PE-bear view of the embedded PE, keeping the unparsed previous shellcode part above, for example under a tag "invalid PE data".

Thanks again for PE-bear!!