# Included tools

## cpload

    Usage: cpload [-m MESSAGE] FILE
    Load .cpl (Control Panel Item) files for debugging

    Example: cpload -m init notafiscal.cpl

    Options:

    If -m is present, MESSAGE should be:

    	Option		Message
    	------------------------------
    	init		CPL_INIT
    	getcount	CPL_GETCOUNT
    	inquire		CPL_INQUIRE
    	select		CPL_SELECT
    	dblclk		CPL_DBLCLK
    	stop		CPL_STOP
    	exit		CPL_EXIT
    	newinquire	CPL_NEWINQUIRE
    	startwparms	CPL_STARTWPARMS
    	setup		CPL_SETUP

    Otherwise, cpload will send all messages to CPlApplet()

## ofs2rva

    Usage: ofs2rva <offset> FILE
    Convert raw file offset to RVA

    Example: ofs2rva 0x1b9b8 calc.exe

    Options:
     -v, --version                          show version and exit
     --help                                 show this help and exit

## pedis

    Usage: pedis OPTIONS FILE
    Disassemble PE sections and functions (by default, until found a RET or LEAVE instruction)

    Example: pedis -r 0x4c4df putty.exe

    Options:
     --att                                  set AT&T syntax
     -e, --entrypoint                       disassemble entrypoint
     -f, --format <text|csv|xml|html> change output format (default: text)
     -m, --mode <16|32|64>            disassembly mode (default: auto)
     -i, <number>                     number of instructions to be disassembled
     -n, <number>                     number of bytes to be disassembled
     -o, --offset <offset>            disassemble at specified file offset
     -r, --rva <rva>                  disassemble at specified RVA
     -s, --section <section_name>     disassemble entire section given
     -V, --version                          show version and exit
     --help                                 show this help and exit

## pehash

    Usage: pehash OPTIONS FILE
    Calculate hashes of PE pieces

    Example: pehash -s '.text' winzip.exe

    Options:
     -f, --format <text|csv|xml|html>    change output format (default: text)
     -a, --all                                 hash file, sections and headers with md5, sha1, sha256, ssdeep and imphash
     -c, --content                             hash only the file content (default)
     -h, --header <dos|coff|optional>    hash only the header with the specified name
     -s, --section <section_name>        hash only the section with the specified name
     --section-index <section_index>     hash only the section at the specified index (1..n)
     -V, --version                             show version and exit
     --help                                    show this help and exit

## pepack

    Usage: pepack FILE
    Search for packers in PE files

    Example: pepack putty.exe

    Options:
     -d, --database <file>                  use database file (default: ./userdb.txt)
     -f, --format <text|csv|xml|html>       change output format (default: text)
     -V, --version                                show version and exit
     --help                                       show this help and exit

## peres

    Usage: peres OPTIONS FILE
    Show information about resource section and extract it

    Example: peres -a putty.exe

    Options:
     -a, --all                              Show all information, statistics and extract resources
     -i, --info                             Show resources information
     -s, --statistics                       Show resources statistics
     -x, --extract                          Extract resources
     -v, --file-version                     Show File Version from PE resource directory
     -V, --version                          show version and exit
     --help                                 Show this help and exit

## pescan

    Usage: pescan OPTIONS FILE
    Search for suspicious things in PE files

    Example: pescan putty.exe

    Options:
     -f, --format <text|csv|xml|html>       change output format (default: text)
     -v, --verbose                                show more info about items found
     -V, --version                                show version and exit
     --help                                       show this help and exit

## pesec

    age: pesec [OPTIONS] FILE
    Check for security features in PE files

    Example: pesec wordpad.exe

    Options:
     -f, --format <text|csv|xml|html>       change output format (default: text)
     -c, --certoutform <text|pem>           specifies the certificate output format (default: text)
     -o, --certout <filename>               specifies the output filename to write certificates to (default: stdout)
     -v, --version                                show version and exit
     --help                                       show this help and exit

## pestr

    Usage: pestr OPTIONS FILE
    Search for strings in PE files

    Example: pestr acrobat.exe

    Options:
     -n, --min-length                       set minimum string length (default: 4)
     -o, --offset                           show string offset in file
     -s, --section                          show string section, if exists
     -V, --version                          show version and exit
     --help                                 show this help and exit

## readpe

    Usage: readpe OPTIONS FILE
    Show PE file headers

    Example: readpe --header optional winzip.exe

    Options:
     -A, --all                              full output (default)
     -H, --all-headers                      print all PE headers
     -S, --all-sections                     print all PE sections headers
     -f, --format <text|csv|xml|html> change output format (default: text)
     -d, --dirs                             show data directories
     -h, --header <dos|coff|optional> show specific header
     -i, --imports                          show imported functions
     -e, --exports                          show exported functions
     -V, --version                          show version and exit
     --help                                 show this help and exit

## rva2ofs

    Usage: rva2ofs <rva> FILE
    Convert RVA to raw file offset

    Example: rva2ofs 0x12db cards.dll

    Options:
     -V, --version                          show version and exit
     --help                                 show this help and exit