# EXE/DLL Info Viewer (PE Viewer)

Drop an .exe, .dll or .sys file to see its processor, build time, ASLR and DEP settings, section permissions and entropy, the DLLs and functions it imports, and its version info. The file is not run, and this is not a virus check. For the contents of XML or images, use another tool.

- URL: https://tools.itlibra.com/en/pe-viewer
- On-device・No upload
- Last updated: 2026-10-31

## How to use

1. Drop an .exe, .dll or .sys file onto the frame, or choose it with "Choose file" (up to 200 MB).
2. Check the Overview for the type (EXE, DLL or SYS), processor, format (PE32 or PE32+) and build time.
3. Review the Things to note list for ASLR or DEP being off, sections that can be both written and executed, and high-entropy sections.
4. See the DLLs and functions the file imports under Imports, and the function names it exports under Exports. Version info includes product and company names.
5. To try it without a file, press "Try a sample". The tool builds a small PE in code and shows its structure.

## Use cases

- Check whether a downloaded exe is 32-bit or 64-bit, and which Windows processor it targets
- See which DLLs a file loads and which functions a DLL exports, without running it
- Check the build time, company and version of an internal tool
- Find out whether an old executable uses ASLR and DEP
- Spot sections that may be compressed or obfuscated from their entropy

## What it does

### Reads without running

The file is never run. The tool reads the DOS header, PE signature, COFF and optional headers, section table, imports, exports and version resource, reading only the parts it needs.

### Checks ranges before reading

Offsets, RVAs and lengths are checked to lie inside the file before any read. A broken part is listed under "parts that could not be read", and the rest of the report still shows.

### Security settings at a glance

From DllCharacteristics, shows ASLR (DYNAMIC\_BASE), DEP (NX\_COMPAT), CFG (GUARD\_CF) and high-entropy ASLR. Also flags sections that can be both written and executed.

### Entropy as a hint

Shows the Shannon entropy (0–8) of each section. A value of 7.2 or more is noted as a possible sign of compression, encryption or obfuscation, but not as a conclusion. Entropy is computed over the first 16 MB of each section.

### Imports, exports and version info

Imports are listed per DLL with function names (up to 10,000). Exports show the names the DLL provides. Version info reads product name, file version, company and description.


## Supported formats

### Input

- .exe (PE32 and PE32+)
- .dll
- .sys (drivers)
- Other PE files (start with MZ and have a PE signature)

### Output

- Overview, sections, imports, exports, version info, and things to note (notes and info)


## Capability matrix

| Feature | Support | Notes |
| --- | --- | --- |
| Reading the DOS, PE, COFF and optional headers | Supported | — |
| PE32 and PE32+ (32-bit and 64-bit) | Supported | — |
| Section permissions and entropy | Supported | Entropy is computed over the first 16 MB of each section |
| Imports and exports (function names) | Partial | Imports up to 10,000. Delay-load imports are not shown |
| Version info (VS\_VERSION\_INFO) | Supported | Fixed version and the main StringFileInfo fields |
| Verifying a digital signature (certificate, tampering) | Not supported | Shows only whether signature data exists and its size |
| Virus or malware detection | Not supported | The notes are hints from the structure, not a verdict |
| Running the file or dynamic analysis | Not supported | The file is never run |
| .NET metadata (types and methods) | Not supported | Shows only whether a CLR header exists |
| Resources such as icons and strings | Not supported | Only the version resource is read |
| Offline use | Supported | Works without a network connection after the page has loaded once |

## Limits & notes

- Files up to 200 MB. Larger files are refused before they are read.
- Up to 10,000 imports. DLL and function names are shown up to 256 characters.
- Up to 96 sections are read.
- Entropy is computed over the first 16 MB of each section, and over 64 MB in total across all sections (later sections are not computed).
- Long lists may be shortened on the screen.

## Privacy & safety

The file is read only inside your browser. It is never run, and nothing is sent to or stored on a server, including signature and certificate data.

## FAQ

### Can I check an exe without running it?

Yes. The tool does not run the file. It reads the bytes and shows the headers, sections, imports and version info. It does not judge whether the file is safe.

### Can I see what a DLL loads and exports?

Yes. Imports lists each DLL and the function names it loads; Exports lists the names the DLL provides. Delay-load imports are not shown.

### What is the problem if ASLR and DEP are off?

ASLR moves code to a random address on each load, and DEP stops data from being run as code. A file without them has fewer defenses, but their absence is a note, not a verdict.

### Can I verify a digital signature here?

No. The tool shows only whether signature data is present and how large it is. Verify the signature with your OS, for example in the file’s Digital Signatures tab in Properties.

### Can this tool tell me if a file is a virus?

No. Entropy and permission combinations are hints. Use anti-virus software for scanning, and do not run files from untrusted sources.