PEiD

What is PEiD?

PEiD is a small, free Windows tool that identifies which compiler, packer or protector was used to build a PE executable (.exe, .dll, .sys). For years it was the first program any malware analyst or cracking hobbyist opened before loading a binary into a disassembler: in a second it told you whether you were looking at "Microsoft Visual C++", "UPX" or "ASPack", and that completely changed how you approached the analysis.

Let's be clear from the start: PEiD is a legacy tool. Development stopped many years ago, its signature database does not recognize modern compilers and protectors well, and it does not handle 64-bit executables reliably. It is still useful to understand the concept and for old samples, but today the sensible choice is Detect It Easy (DIE) as your main tool.

What PEiD is used for

• Detecting packers: if a binary is compressed with UPX, ASPack, PECompact or similar, the real code won't be readable until it is unpacked.
• Identifying the compiler: knowing whether it is Delphi, Visual Basic, MSVC or .NET tells you which tools to use next (for example, a .NET-specific decompiler).
• Malware triage: in quick static analysis, an unknown packer or high section entropy are red flags.
• Reversing challenges and CTFs: many classic crackmes are packed, and the first step is finding out with what.

Getting started with PEiD

PEiD has no installer: it ships as a portable executable plus a signature file, userdb.txt. Since the original website is gone, you'll find it on archives and wikis such as aldeid. Always download it inside an analysis virtual machine, never on your main computer, and check the file hash if the source publishes one.

1. Run PEiD.exe and drag the binary onto the window.
2. Read the result in the main bar (for example, UPX 0.89.6 - 1.02 / 1.05 - 2.90 -> Markus & Laszlo).
3. Try the scan modes: Normal (entry point), Deep (entry point section) and Hardcore (whole file, slower and with more false positives).
4. Open the advanced options to see sections, entropy (EP Section, First Bytes) and plugins such as KANAL, which detects crypto constants (MD5, SHA1, AES...).

Practical examples

Using PEiD signatures from Python

The userdb.txt signature database is still usable. The pefile library includes the peutils module, which can load it:

pip install pefile

import pefile, peutils

sigs = peutils.SignatureDatabase("userdb.txt")
pe = pefile.PE("sample.exe")
print(sigs.match(pe, ep_only=True))

This lets you automate triage of hundreds of samples without opening the GUI.

Confirming and unpacking a UPX binary

If PEiD reports UPX, you can verify and unpack it with UPX itself (this only works if the packer hasn't been tampered with):

upx -t sample.exe
upx -d sample.exe -o sample_unpacked.exe

The modern alternative: Detect It Easy

Detect It Easy does the same job as PEiD, but with updated signatures, 64-bit support, ELF, Mach-O, APK and a console version:

diec sample.exe

Only run this kind of analysis on your own binaries or samples you are authorized to handle.

Pro tips

• Don't trust a single result: an attacker can fake the signature so a binary looks like another compiler. Cross-check with DIE, Exeinfo PE and section entropy.
• "Nothing found" does not mean "not packed"; it may be a custom packer.
• Section names like UPX0/UPX1 or an almost empty import table are clues as useful as the signature itself.
• For manual unpacking, the next step is usually a debugger such as x64dbg to find the OEP (original entry point).

PEiD pros and cons

Pros	Cons
Free, portable and very lightweight	Abandoned for years
Simple interface, great for learning	Outdated signatures and poor 64-bit support
Signature database reusable with pefile	False positives in Hardcore mode
Plugins such as KANAL	Third-party downloads may be tampered with

PEiD alternatives

• Detect It Easy: the de facto successor, maintained and cross-platform.
• x64dbg: for manual unpacking and following execution.
• Ghidra: for full static analysis once the binary is unpacked.
• Binwalk: for identifying embedded data and files inside binaries and firmware.

Frequently asked questions

Is PEiD free?

Yes, PEiD has always been freeware. Detect It Easy, its modern alternative, is also free and open source.

Does PEiD still work on Windows 10 and 11?

It usually runs, but its results on modern binaries are unreliable. For real work use Detect It Easy and keep PEiD for old samples or for learning.

Is PEiD legal?

Yes. Identifying the compiler or packer of an executable is legitimate static analysis. What may not be legal is bypassing protections on licensed software; stick to your own software, malware in controlled environments or challenges designed for it.

How do you use PEiD to detect UPX?

Drag the executable onto the PEiD window and read the result line. If it says UPX, confirm with upx -t and unpack with upx -d.

If you want to practice the full binary analysis workflow step by step, check out the Hackers en Acción Academy.