Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/hasherezade/pe-sieve
Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
https://github.com/hasherezade/pe-sieve
anti-malware hooking libpeconv malware-analysis memory-forensics pe-analyzer pe-dumper pe-format pe-sieve process-analyzer scans
Last synced: 2 months ago
JSON representation
Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
- Host: GitHub
- URL: https://github.com/hasherezade/pe-sieve
- Owner: hasherezade
- License: bsd-2-clause
- Created: 2017-08-22T01:33:00.000Z (almost 7 years ago)
- Default Branch: master
- Last Pushed: 2024-04-07T22:32:29.000Z (2 months ago)
- Last Synced: 2024-04-07T23:27:15.910Z (2 months ago)
- Topics: anti-malware, hooking, libpeconv, malware-analysis, memory-forensics, pe-analyzer, pe-dumper, pe-format, pe-sieve, process-analyzer, scans
- Language: C++
- Homepage: https://hshrzd.wordpress.com/pe-sieve/
- Size: 87.6 MB
- Stars: 2,871
- Watchers: 101
- Forks: 411
- Open Issues: 11
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Lists
- my-awesome-stars - pe-sieve - memory patches). | hasherezade | 2603 | (C++)
- awesome-csirt - pe-sieve - memory patches). (Operating Systems / Windows)
- awesome-stars - hasherezade/pe-sieve - Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches). (malware-analysis)
- awesome - hasherezade/pe-sieve - Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches). (C++)
- awesome-csirt - pe-sieve - memory patches). (Operating Systems / Windows)
- awesome-computer-science - code - [PE-sieve](https://github.com/hasherezade/pe-sieve) - PE-sieve is a light-weight tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches. (Reverse Engine)
- awesome-stars - pe-sieve - memory patches). | hasherezade | 2927 | (C++)
- awesome-cyber-security - **940**星 - memory patches). (<a id="e1fc1d87056438f82268742dc2ba08f5"></a>事件响应&&取证&&内存取证&&数字取证 / <a id="1fc5d3621bb13d878f337c8031396484"></a>取证&&Forensics&&数字取证&&内存取证)
README
[](https://ci.appveyor.com/project/hasherezade/pe-sieve)
[](https://app.codacy.com/gh/hasherezade/pe-sieve/dashboard?branch=master)
[](https://github.com/hasherezade/pe-sieve/commits)
[](https://github.com/hasherezade/pe-sieve/commits)
[](https://github.com/hasherezade/pe-sieve/releases)
[](https://github.com/hasherezade/pe-sieve/releases)
[](https://github.com/hasherezade/pe-sieve/releases)
[](https://github.com/hasherezade/pe-sieve/releases)
[](https://github.com/hasherezade/pe-sieve/blob/master/LICENSE)
[](https://github.com/hasherezade/pe-sieve)
[](https://github.com/hasherezade/pe-sieve/discussions)
[](https://twitter.com/intent/tweet?original_referer=https://github.com/hasherezade/pe-sieve&text=%23PEsieve%3A+an+open-source+process+scanner%2C+detecting+and+dumping+malicious+implants:%20https://github.com/hasherezade/pe-sieve)
## Intro
PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches.
Detects inline hooks, Process Hollowing, Process Doppelgänging, Reflective DLL Injection, etc.
PE-sieve is meant to be a **light-weight engine** dedicated to scan **a single process** at the time. It can be built as an EXE or as a DLL. The DLL version exposes [a simple API](https://github.com/hasherezade/pe-sieve/wiki/5.-API) and can be easily integrated with other applications.
📦 Uses library: [libPEConv](https://github.com/hasherezade/libpeconv.git)
## Help
❓ [FAQ - Frequently Asked Questions](https://github.com/hasherezade/pe-sieve/wiki/1.-FAQ)
📖 [Read Wiki](https://github.com/hasherezade/pe-sieve/wiki)
🤔 Do you have any question that was not included in the [FAQ](https://github.com/hasherezade/pe-sieve/wiki/1.-FAQ)? Join [Discussions](https://github.com/hasherezade/pe-sieve/discussions)!
## PE-sieve tools family
There are few other tools that use PE-sieve as an engine, but focus on some specific usecases. They offer additional features and filters on the top of its base.
📌 [HollowsHunter](https://github.com/hasherezade/hollows_hunter) - if instead of scanning a single process you want to **scan multiple processes at once, or even the full system** with PE-sieve, this is the tool for you
📌 [MalUnpack](https://github.com/hasherezade/mal_unpack) - offers quick **unpacking** of supplied malware sample
## Clone
Use **recursive clone** to get the repo together with the submodule:
```console
git clone --recursive https://github.com/hasherezade/pe-sieve.git
```
## Builds
Download the latest [release](https://github.com/hasherezade/pe-sieve/releases), or [read more](https://github.com/hasherezade/pe-sieve/wiki/1.-FAQ#how-to-get-it).
 Available also via [Chocolatey](https://community.chocolatey.org/packages/pesieve)
logo by [Baran Pirinçal](https://github.com/baranpirincal)