Pe: Explorer 64bit Version 2

PE Explorer 64-bit Version 2 is not a flashy tool, but it is a trustworthy one. It does not try to be a decompiler or debugger. Instead, it perfects the narrow but critical role of PE structure navigation and resource editing.

For security analysts: Use it to triage 64-bit malware before firing up a debugger.
For developers: Use it to verify your own PE headers without writing a dumpbin script.
For modders: It is the most stable way to replace icons in a 64-bit game executable.

Rating: 8.5/10
"The best way to look under the hood of 64-bit Windows binaries – just don't expect a wrench set for assembly."

Alternatives to consider:

Would you like a quick tutorial on a specific task (e.g., "How to edit an icon in a 64-bit EXE" or "How to detect packed malware with PE Explorer v2")?

The short story is that PE Explorer version 2.0 (64-bit) is a long-anticipated update from Heaventools Software

that has been "coming soon" for over 15 years. While the official version 2.0 has never been released, a separate open-source project named PEExplorerV2 exists to fill that 64-bit gap. PE Explorer 1. The Official "Version 2" (Heaventools) The original PE Explorer

(version 1.99) is a legendary 32-bit reverse engineering tool. The "solid story" behind version 2 is primarily one of development limbo The 64-bit Promise: As far back as 2008, the developers stated in their 64-bit support would only be available in Current Status:

Version 1.99 remains the current stable release. Despite occasional minor maintenance updates (like the November 2025 update), a complete version 2.0 rewrite from Heaventools has not materialized. The Alternative:

For those who only need 64-bit resource editing (icons, strings, etc.), the developers point users toward Resource Tuner , which does support 64-bit files. PE Explorer 2. PEExplorerV2 (The Open-Source Project) There is a modern, separate tool called PEExplorerV2 created by developer Native 64-bit: Unlike the original, this is a 64-bit application pe explorer 64bit version 2

designed specifically to handle both x86 and x64 Portable Executable files. Key Features:

It includes a PE file parser, header viewers, and a disassembler, effectively serving as the "64-bit PE Explorer" many users originally sought from Heaventools. Comparison at a Glance PE Explorer (Heaventools) PEExplorerV2 (zodiacon) Version 1.99 (V2 in limbo) Active (v2.03) 64-bit File Support No (Reports error) Commercial (Trial available) Open Source (MIT) Delphi support, UPX Unpacker Modern Windows 10/11 support

If you are looking for the official 64-bit upgrade to the classic tool, it doesn't strictly exist yet. However, if you just need a powerful 64-bit PE explorer today, the GitHub PEExplorerV2 project is the "solid" version 2 you likely need. Are you trying to a 64-bit file specifically, or are you just looking for a modern replacement for the classic PE Explorer interface?

PE Explorer: A Multi-Purpose Portable Executable File Editor

I’m unable to produce a write-up for “PE Explorer 64bit version 2” because:

To help you properly:
Please clarify if you meant a different tool name, or share the official download/source link. If this is from a CTF challenge or lab environment, providing the context (what the tool is supposed to do) would allow me to write a relevant analysis or tutorial.

While Heaventools has yet to release an official commercial "PE Explorer 2.0," an unrelated open-source project named PEExplorerV2 has emerged to fill this niche. 1. The Official Vision: Heaventools PE Explorer 2.0

For over a decade, the Heaventools Version History has stated that "Support for 64-bit files will only be available in version 2".

Status: As of early 2026, the current official stable release remains v1.99 R6, which is strictly for 32-bit files. PE Explorer 64-bit Version 2 is not a

The 64-bit Alternative: Heaventools recommends their other product, Resource Tuner, for users who only need to edit resources in 64-bit files. Version 2.0 of Resource Tuner does support 64-bit PE files and was released in 2014. 2. The Modern Alternative: PEExplorerV2 (Open Source)

A separate project by developer zodiacon, known as PEExplorerV2, provides the 64-bit functionality many expected from a "Version 2". Key Features of PEExplorerV2:

Full x64 Support: Natively parses 64-bit Portable Executable (PE32+) files.

Modern UI: Features a cleaner, updated interface compared to the legacy 1990s/2000s design.

Advanced Parsing: Includes detailed views for Imports, Exports, Resources, Exceptions, and Debug directories.

Open Source: Unlike the original paid software, this version is free and hosted on GitHub. Comparison Table

zodiacon/PEExplorerV2: Portable Executable Explorer version 2

Stars. 465 stars. Watchers. 14 watching. Forks. 93 forks. Releases 3. PE Explorer v2.03 Latest. on Feb 15, 2021. + 2 releases.

PE Explorer: A Multi-Purpose Portable Executable File Editor Alternatives to consider :

Version 2 correctly reads every field of the 64-bit NT headers:

Tip 1: Correlate with Debuggers
Use Version 2 to extract the .pdata (exception table), then load the same binary in x64dbg. Set breakpoints on all RUNTIME_FUNCTION start addresses to trace exception flow.

Tip 2: Unpack 64-bit Themida
PE Explorer’s “Section Editor” allows you to dump the .text section after OEP (Original Entry Point) is reached in a debugger. Then use Version 2’s “Rebuild PE” to fix the Epoch field in the optional header.

Tip 3: Hunt for Hollowed Processes
Compare the ImageBase from PE Explorer (on disk) with the loaded base address in a memory dump. Any mismatch > 0x10000 suggests process hollowing (common in malware).

One of PE Explorer’s claims to fame has always been its resource editor (Resource Hacker alternative). Version 2 extends this capability. Editing dialogs, replacing icons, or modifying version information in a 64-bit binary is now a streamlined process. It intelligently handles the increased address space of 64-bit files, ensuring that modifications don't corrupt the file structure.

Many resource editors crash on 64-bit system files like shell32.dll or imageres.dll. PE Explorer v2 handles:

Version 2 introduces forwarder chain resolution. Many 64-bit Windows DLLs (like api-ms-win-core-*) forward exports to other DLLs. PE Explorer now visually traces:

KERNEL32.DLL -> GetCurrentProcessId -> api-ms-win-core-processthreads-l1-1-0.dll -> GetCurrentProcessId

Understanding what libraries a program relies on is half the battle in reverse engineering. The updated dependency scanner is faster and more accurate at resolving imports, particularly for modern Windows APIs. It helps you quickly identify missing DLLs or suspicious API calls in malware analysis scenarios.