When I try to open a PE executable , it's automatically run.
How can I just open it statically without running it? I just want to see the binary file in hex format.
+1
A:
If you really want see it in "hex format" - just use any of hex viewer or hex editor. There are lots of them, including plugins for file managers (FAR, Total Commander) or hex editors like WinHex.
If you want to see it disassembled - use disassembler. IDA, hiew, etc.
Or, start OllyDbg, than in menu select View -> File .
Also, there is PE file header view mode (right mouse button (RMB) -> Special -> PE header). You can edit (RMB -> Binary -> Edit) and save file (RMB -> save) too.
You can read this in OllyDbg help, "Tips and tricks", 1st line.
Abyx
2010-09-22 08:48:16
@Abyx,thanks! In the `RMB -> Binary -> Edit` dialog,there's a "Keep Size" option which is checked by default,what does that mean?
Alan
2010-09-22 13:31:48
If the answer of Abyx helped you should vote it up, don't you think? So +1
jyzuz
2010-10-09 22:57:19