PEiD "userdb.txt" full (3 compilaction merged)
type: NewsArticle
description: This article is a compiled database file for PEiD, a popular software tool used to identify packers, cryptors, and compilers in executable files. The file merges three separate "userdb.txt" sources into one comprehensive list, containing hex signature patterns and metadata for detecting various software protectors and development environments. Each entry in the database provides a unique byte signature and instructions for PEiD to identify specific packers or compilers based on the executable's entry point code.
date published: 2018-12-01T08:32:21+00:00
date modified: 2026-05-23T11:36:46+00:00
language: en
is accessible for free: true
article body: Last active May 23, 2026 11:35 - - Save ttodua/a7876b9aed1e93890b3c7aaebddc9f4e to your computer and use it in GitHub Desktop. PEiD "userdb.txt" full (3 compilaction merged) This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. [Learn more about bidirectional Unicode characters](https://github.co/hiddenchars)| ; 3 DBs together: | | | ; https://handlers.sans.org/jclausing/userdb.txt | | | ; https://web.archive.org/web/20160611182612/https://reverse-engineering-scripts.googlecode.com/files/UserDB.TXT | | | ; https://web.archive.org/web/20140924084024/http://research.pandasecurity.com/blogs/images/userdb.txt | | | ; current page: https://gist.github.com/ttodua/a7876b9aed1e93890b3c7aaebddc9f4e | | | [!EP (ExE Pack) V1.0 -> Elite Coding Group] | | | signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 | | | ep_only = true | | | [!EPack 1.4 lite (final) - by 6aHguT] | | | signature = 33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 | | | ep_only = true | | | [$pirit v1.5] | | | signature = ?? ?? ?? 5B 24 55 50 44 FB 32 2E 31 5D | | | ep_only = true | | | [$PIRIT v1.5] | | | signature = B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21 | | | ep_only = true | | | [* PseudoSigner 0.1 --> Anorganix] | | | signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 | | | ep_only = true | | | [* PseudoSigner 0.1 [32Lite 0.03] --> Anorganix] | | | signature = 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9 | | | ep_only = true | | | [* PseudoSigner 0.1 [ACProtect 1.09] --> Anorganix] | | | signature = 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 | | | ep_only = true | | | [* PseudoSi…
publisher: Web Pulse
keywords: cybersecurity, open-source, developer-tools, research, data
mentions: PEiD
mentions: SANS Institute
mentions: Panda Security
mentions: Google Code
mentions: Elite Coding Group
mentions: Anorganix
mentions: ACProtect
mentions: PseudoSigner
citation: CreativeWork