PEiD專業(yè)的查殼軟件哦！ 幾乎可以偵測出所有的殼，其數(shù)量已超過470 種PE 文檔 的加殼類型和簽名。PEiD能檢測大多數(shù)編譯語言.、病毒和加密的殼，它主要利用查特征串搜索來完成識別工作的，各種開發(fā)語言都有固定的啟動代碼部分，利用這點(diǎn)可識別是何種語言編譯的，被加殼程序處理過的程序，在殼里會留下相關(guān)加殼軟件的信息，利用這點(diǎn)就可識別是保種殼所加密的，它提供了一個擴(kuò)展接口文件userdb.txt ，用啟可以自定義一些特征碼，這樣可以識別出新的文件類型，簽名的制作可以用插件Add Signature來完成！

所有插件：

本漢化版為全插件版，是目前網(wǎng)絡(luò)中最完美的版本，插件是特別全面的，又為廣大的脫殼愛好者提供了好工具啦！

advanced_scan.dll AntiSPack.dll
crc32.dll Easy Screen 1.3.0.dll
eCrap.dll eCrapOepVerify.dll
EPScan.dll ExtOverlay.dll
ExtractOverlay.dll FC.DLL
FileInfo.dll FixCRC.DLL
FNE.dll frant.dll
FSG v1.33脫殼.dll GenOEP.dll
GUID.dll hh.dll
HideCapt.dll HideCapt2.dll
IDToText.DLL Imploder.DLL
ImpREC.dll kanal.dll
Morphine.DLL oepscan.dll
ohfixer_v01.dll Overlay1.0.dll
Overlay1.0漢化.dll Oversaver.dll
PackUPX.DLL Patch_Maker_0.5.0.dll
PE2HTML.dll PE2HTML.exe
PEExtract.DLL PEiDBundle.DLL
PESniffer4PEiD.ASM PESniffer4PEiD.DLL
PlgLdr.dll PluginEx.dll
pluzina.dll pluzina1.dll
pluzina4.dll pluziny.nfo
QuickChSum.dll RebuildPE.dll
RelocRebuilder.dll s.bat
s.txt SecFix.dll
SecTool.DLL Sendspy.dll
StringViewer.dll unbero.dll
UnCDS_SS.DLL undef.dll
UnFakeNinja.DLL unfsg.dll
UnitsBrowser.dll UnPPP.DLL
UnRCrypt.DLL UnRPolyCrypt.DLL
UnUPolyX.dll UNUPX.DLL
unupx2.dll UnUPXShit.dll
UPXI.dll UPXScramb.dll
uupx.dll VerA.dll
VerA.txt xInfo.DLL
XNResourceEditor_Plugin.DLL XP.dll
YPP.DLL ypp.ini
ZDRx.dll [[-=About PEiD =-]]
PEiD怎么用？
PEiD最常用的插件就是脫殼，PEiD的插件里有個通用脫殼器，能脫大部分的殼，如果脫殼后import表損害，還可以自動調(diào)用ImportREC修復(fù)import表，點(diǎn)擊"=>"打開插件列表，如圖：

根據(jù)插件列表，還可以專門針對一些殼脫殼，效果比通用脫殼器會好

點(diǎn)擊EP后的>可以展開Section塊列表:

再在Section塊表上右擊鼠標(biāo)，可以看到以下菜單選項(xiàng)：

點(diǎn)擊搜索全0處，會把所有塊中全0的區(qū)塊搜出來，這樣我們可以在這些代碼上加自己想加的code，非常方便:

直接用winhex改就行了,

命令行參數(shù)

PEiD now fully supports commandline parameters.
peid -time// Show statistics before quitting 顯示信息
peid -r// Recurse through subdirectories  掃描子目錄
peid -nr// Don't scan subdirectories even if its set 不掃描子目錄
peid -hard// Scan files in Hardcore Mode 采用核心掃描模式
peid -deep// Scan files in Deep Mode  采用深度掃描模式
peid -norm// Scan files in Normal Mode 采用正常掃描模式
peid <file1> <file2> <dir1> <dir2>
You can combine one or more of the parameters.
For example.
peid -hard -time -r c:\windows\system32
peid -time -deep c:\windows\system32\*.dll

PEID的掃描模式：

正常掃描模式：可在PE文檔的入口點(diǎn)掃描所有記錄的簽名
深度掃描模式：可深度掃描所有記錄的簽名，這種模式要比上一種的掃描范圍更廣，更深入
核心掃描模式：可完整的掃描整個PE文檔，但相對有點(diǎn)慢
版本更新說明

0.7 Beta -> First public release.
0.8 Public->Added support for 40 more packers. OEP finding module. Task viewing/control module.
GUI changes. General signature bug fixes. Multiple File and Directory Scanning module.
0.9 Recode->Completely recoded from scratch.  New Plugin Interface which lets you use extra features.
Added more than 130 new signatures. Fixed many detections and general bugs.
0.91 Reborn-> Recoded everything again. New faster and better scanning engine. New internal signature system.
 MFS v0.02 now supports Recursive Scanning. Commandline Parser now updated and more powerful.
Detections fine tuned and newer detections added. Very basic Heuristic scanning.
0.92 Classic->Added support for external database, independent of internal signatures. Added PE details lister.
Added Import, Export, TLS and Section viewers. Added Disassembler. Added Hex Viewer.
Added ability to use plugins from Multiscan window. Added exporting of Multiscan results.
Added ability to abort MultiScan without loosing results.
Added ability to show process icons in Task Viewer.
Added ability to show modules under a process in Task Viewer. Added some more detections.
0.93 Elixir->Added sorting of Plugin menu items. Submenus are created based on subfolders in the directory.
Added Brizo disassembler core. Added some more detections.
Fixed documented and undocumented vulnerability issues.
Fixed some general bugs.
Removed mismatch mode scanner which needs further improvements.
0.94 Flux->Too much is new to remember.
MFS, Task Viewer and Disassembler windows maximizable.
New smaller and lighter disassembler core CADT.
New KANAL 2.90 with much more detections and export features.
Added loads of new signatures. Thanks to all the external signature collections online.
String References integrated into disassembler.
Fixed documented and undocumented crashes.
Fixed some general bugs.
0.95 Phoenix->Fixed some crashing bugs.
   Minor Core update.
   Crash Fix in Securom detection.

方便破解軟件的朋友，好的情況下我們需要知道，軟件用什么加殼，我們再想法破解，修改等操作
PEiD 可以探測大多數(shù)的 PE 文件封包器、加密器和編譯器。當(dāng)前可以探測 600 多個不同簽名。
PEiD 是最強(qiáng)大的一個查殼工具。

漢化包中包含了絕大多數(shù)插件。
注：探殼工具及插件有可能被一些殺毒軟件誤報(bào)毒，故壓縮包加上解壓密碼：www.jb51.net
部分插件不支持Win7，Win7啟動程序后會出錯，可以將plugins目錄改名或者刪除，使用不帶插件的漢化程序。

peid0.95_en_x64 是綠色的沒有插件的版本，支持x64的系統(tǒng)。