![ida pro 7.0 github ida pro 7.0 github](https://hex-rays.com/wp-content/uploads/2019/12/codexplorer.png)
To install and run as an IDAPython plugin you can either use setuptools or install manually.
Git clone the repository and setup for development: Windows > git clone Install directly from GitHub using a fresh virtual environment and pip: Windows > virtualenv env Double-click VA/RVA to disassemble with capstone.Extract PE files from ZIP archives (including password protected with infected).The PE Tree standalone application finds portable executables in files, folders and ZIP archives. Rebuild IAT and IDT from disassembly (using IDA Pro, Ghidra or capstone).Reconstruct import address and directory tables (IAT/IDT) using several methods:.Remove unnecessary data directory pointers.Export to CyberChef for further manipulation.Displays the following PE headers in a tree-view:.Allows for fast visual overview and comparison of PE samples.
![ida pro 7.0 github ida pro 7.0 github](https://pbs.twimg.com/media/EWoYRIeX0AINLh0.jpg)
Provides a high-level overview of PE structures, size and file location.Windows memory dumps (raw, EWF, vmem etc.).ZIP archives (including password protected).Parsing PE files and memory images from:.Standalone application with plugins for:.It can also be used with IDA Pro, Ghidra, Volatility, Rekall and minidump to view and dump in-memory PE files, as well as perform import table reconstruction. PE Tree is a Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5.