Explorer Suite

[Baxajaun]

Created by Daniel Pistelli, a freeware suite of tools including a PE editor called CFF Explorer and a process viewer. The PE editor has full support for PE32/64. Special fields description and modification (.NET supported), utilities, rebuilder, hex editor, import adder, signature scanner, signature manager, extension support, scripting, disassembler, dependency walker etc. First PE editor with support for .NET internal structures. Resource Editor (Windows Vista icons supported) capable of handling .NET manifest resources. The suite is available for x86 and x64.

https://ntcore.com/?page_id=388

I originally wrote this tool for a friend of mine who needed it. This very little tool patches x86 executables in order to let them have 4GB (instead of only 2) of virtual memory on x64 platforms. This tool comes very handy for applications which need a great amount of virtual memory like games, 3D renderization, multimedia etc. To gain these 2GB, you just have to use this tool to patch the executable (*.exe file) of the software you want to have these additional GBs of virtual memory. It can be used by clicking on it and choosing the file or through command line (e.g.: “4gb_patch file.exe”). It automatically creates a backup copy of the original executable.

Why things are this way on x64 is easy to explain. On x86 applications have 2GB of virtual memory out of 4GB (the other 2GB are reserved for the system). On x64 these two other GB can now be accessed by 32bit applications. In order to achieve this, a flag has to be set in the file’s internal format. This is, of course, very easy for insiders who do it every day with the CFF Explorer. This tool was written because not everybody is an insider, and most probably a lot of people don’t even know that this can be achieved. Even I wouldn’t have written this tool if someone didn’t explicitly ask me to.

https://ntcore.com/files/4gb_patch.zip

Regards

[Antonio Linares]

On x64 these two other GB can now be accessed by 32bit applications. In order to achieve this, a flag has to be set in the file’s internal format.

Very interesting !!!