<chapter id="tools">
<title>Included tools</title>

<sect1 id="cpload">
<title>cpload</title>
<screen>
Usage: cpload [-m MESSAGE] FILE
Load .cpl (Control Panel Item) files for debugging

Example: cpload -m init notafiscal.cpl

Options:

If -m is present, MESSAGE should be:

	Option		Message
	------------------------------
	init		CPL_INIT
	getcount	CPL_GETCOUNT
	inquire		CPL_INQUIRE
	select		CPL_SELECT
	dblclk		CPL_DBLCLK
	stop		CPL_STOP
	exit		CPL_EXIT
	newinquire	CPL_NEWINQUIRE
	startwparms	CPL_STARTWPARMS
	setup		CPL_SETUP

Otherwise, cpload will send all messages to CPlApplet()
</screen>
</sect1>


<sect1 id="ofs2rva">
<title>ofs2rva</title>
<screen>
Usage: ofs2rva &lt;offset&gt; FILE
Convert raw file offset to RVA

Example: ofs2rva 0x1b9b8 calc.exe

Options:
 -v, --version                          show version and exit
 --help                                 show this help and exit
</screen>
</sect1>


<sect1 id="pedis">
<title>pedis</title>
<screen>
Usage: pedis OPTIONS FILE
Disassemble PE sections and functions (by default, until found a RET or LEAVE instruction)

Example: pedis -r 0x4c4df putty.exe

Options:
 --att                                  set AT&amp;T syntax
 -e, --entrypoint                       disassemble entrypoint
 -f, --format &lt;text|csv|xml|html&gt; change output format (default: text)
 -m, --mode &lt;16|32|64&gt;            disassembly mode (default: auto)
 -i, &lt;number&gt;                     number of instructions to be disassembled
 -n, &lt;number&gt;                     number of bytes to be disassembled
 -o, --offset &lt;offset&gt;            disassemble at specified file offset
 -r, --rva &lt;rva&gt;                  disassemble at specified RVA
 -s, --section &lt;section_name&gt;     disassemble entire section given
 -V, --version                          show version and exit
 --help                                 show this help and exit
</screen>
</sect1>


<sect1 id="pehash">
<title>pehash</title>
<screen>
Usage: pehash OPTIONS FILE
Calculate hashes of PE pieces

Example: pehash -s '.text' winzip.exe

Options:
 -f, --format &lt;text|csv|xml|html&gt;    change output format (default: text)
 -a, --all                                 hash file, sections and headers with md5, sha1, sha256, ssdeep and imphash
 -c, --content                             hash only the file content (default)
 -h, --header &lt;dos|coff|optional&gt;    hash only the header with the specified name
 -s, --section &lt;section_name&gt;        hash only the section with the specified name
 --section-index &lt;section_index&gt;     hash only the section at the specified index (1..n)
 -V, --version                             show version and exit
 --help                                    show this help and exit
</screen>
</sect1>


<sect1 id="pepack">
<title>pepack</title>
<screen>
Usage: pepack FILE
Search for packers in PE files

Example: pepack putty.exe

Options:
 -d, --database &lt;file&gt;                  use database file (default: ./userdb.txt)
 -f, --format &lt;text|csv|xml|html&gt;       change output format (default: text)
 -V, --version                                show version and exit
 --help                                       show this help and exit
</screen>
</sect1>


<sect1 id="peres">
<title>peres</title>
<screen>
Usage: peres OPTIONS FILE
Show information about resource section and extract it

Example: peres -a putty.exe

Options:
 -a, --all                              Show all information, statistics and extract resources
 -i, --info                             Show resources information
 -s, --statistics                       Show resources statistics
 -x, --extract                          Extract resources
 -v, --file-version                     Show File Version from PE resource directory
 -V, --version                          show version and exit
 --help                                 Show this help and exit
</screen>
</sect1>


<sect1 id="pescan">
<title>pescan</title>
<screen>
Usage: pescan OPTIONS FILE
Search for suspicious things in PE files

Example: pescan putty.exe

Options:
 -f, --format &lt;text|csv|xml|html&gt;       change output format (default: text)
 -v, --verbose                                show more info about items found
 -V, --version                                show version and exit
 --help                                       show this help and exit
</screen>
</sect1>


<sect1 id="pesec">
<title>pesec</title>
<screen>
age: pesec [OPTIONS] FILE
Check for security features in PE files

Example: pesec wordpad.exe

Options:
 -f, --format &lt;text|csv|xml|html&gt;       change output format (default: text)
 -c, --certoutform &lt;text|pem&gt;           specifies the certificate output format (default: text)
 -o, --certout &lt;filename&gt;               specifies the output filename to write certificates to (default: stdout)
 -v, --version                                show version and exit
 --help                                       show this help and exit
</screen>
</sect1>


<sect1 id="pestr">
<title>pestr</title>
<screen>
Usage: pestr OPTIONS FILE
SSearch for strings in PE files

Example: pestr acrobat.exe

Options:
 -n, --min-length                       set minimun string length (default: 4)
 -o, --offset                           show string offset in file
 -s, --section                          show string section, if exists
 -V, --version                          show version and exit
 --help                                 show this help and exit
</screen>
</sect1>


<sect1 id="readpe">
<title>readpe</title>
<screen>
Usage: readpe OPTIONS FILE
Show PE file headers

Example: readpe --header optional winzip.exe

Options:
 -A, --all                              full output (default)
 -H, --all-headers                      print all PE headers
 -S, --all-sections                     print all PE sections headers
 -f, --format &lt;text|csv|xml|html&gt; change output format (default: text)
 -d, --dirs                             show data directories
 -h, --header &lt;dos|coff|optional&gt; show specific header
 -i, --imports                          show imported functions
 -e, --exports                          show exported functions
 -V, --version                          show version and exit
 --help                                 show this help and exit
</screen>
</sect1>


<sect1 id="rva2ofs">
<title>rva2ofs</title>
<screen>
Usage: rva2ofs &lt;rva&gt; FILE
Convert RVA to raw file offset

Example: rva2ofs 0x12db cards.dll

Options:
 -V, --version                          show version and exit
 --help                                 show this help and exit
</screen>
</sect1>


</chapter>
