LordPE

LordPE is an advanced application for PC technicians, programmers, and other expert users, which facilitates tools for manipulating various parts of PE files. It features a PE editor, a breaking and entering function, PE rebuilder, unsplitter, and dumper server.

Before proceeding any further, you should know that it hasn't been updated for a really long time, so you might experience issues with certain PE files or later Windows versions.

LordPE is packed in a portable package, so you can save its files anywhere on the hard disk or on a USB flash drive, in order to directly run the program on any computer with minimum effort. Its main window has a neatly organized layout and contains a lot of options in the right-click menu.

Once started, the application automatically identifies and displays currently running processes, showing the process ID and image base and size for each entry. Clicking an item from the list reveals other processes which depend on it.

It's possible to dump full information about processes to file. Alternatively, you can select a specific address and size, or dump multiple selected regions. There are two dumping engines available, LordPE and IntelliDump, so you can choose the preferred one. Moreover, the utility can be asked to automatically correct image sizes or burn processes.

The PE editor lets you modify a process' entry point, image base and size, code and data base, section and file alignment, subsystem, number of sections, time and date stamp, header size, characteristics, checksum, and optional header size.

You can view the section table and edit the headers' hexadecimal code, save and load sections from disk, add or remove them, truncate at the start or end of a section, split and unsplit headers, as well as examine a table with the section headers.

It's possible to modify directory information, such as export and import table, resource, exception, security, relocation, debug, copyright, and COM. LordPE also puts at your disposal a file location calculator, an encoder and decoder for time and date stamps, along with a comparison feature for EXE, DLL and DMP-formatted files.

The app lets you break EXE or DLL files at the entry point, rebuild the PE structure of EXE, DLL and DMP files, unsplit INI files, or attempt to connect to the dumper server.

When it comes to program configuration, you can make the frame stay on top of other windows, register a shell extension for breaking and entering, disable PE validation, the rebuilding of import tables and wipe relocation, delete temporary files for the PE editor, and so on.

It didn't put a strain on computer performance in our tests, using low CPU and RAM. Generally, tasks were carried out pretty fast. However, it popped up errors when attempting to break and enter various files in our case, and failed to connect to the dumper server, which is expected from such an old app. Otherwise, LordPE comes loaded with rich options for editing PE files.