Pe sieve
Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches. Detects inline hooks, Process Hollowing, Process Doppelgänging, Reflective DLL Injection, etc. The project is written primarily in C++, distributed under the BSD 2-Clause "Simplified" License license, first published in 2017. It has gained significant community traction with 3,705 stars and 474 forks on GitHub. Key topics include: anti-malware, hooking, libpeconv, malware-analysis, memory-forensics.
Intro
<b>PE-sieve</b> is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches.<br/>
Detects inline hooks, Process Hollowing, Process Doppelgänging, Reflective DLL Injection, etc.
PE-sieve is meant to be a light-weight engine dedicated to scan a single process at the time. It can be built as an EXE or as a DLL. The DLL version exposes a simple API and can be easily integrated with other applications.
📦 Uses library: libPEConv
Help
❓ FAQ - Frequently Asked Questions
🤔 Do you have any question that was not included in the FAQ? Join Discussions!
PE-sieve tools family
There are few other tools that use PE-sieve as an engine, but focus on some specific usecases. They offer additional features and filters on the top of its base.
📌 HollowsHunter - if instead of scanning a single process you want to scan multiple processes at once, or even the full system with PE-sieve, this is the tool for you
📌 MalUnpack - offers quick unpacking of supplied malware sample
Clone
Use recursive clone to get the repo together with the submodule:
consolegit clone --recursive https://github.com/hasherezade/pe-sieve.git
Builds
Download the latest release, or read more.
Available also via:
<hr/>
logo by Baran Pirinçal
Contributors
Showing top 11 contributors by commit count.
