hollows_hunter

Build status License

A process scanner detecting and dumping hollowed PE modules.

Uses PE-sieve (DLL version): https://github.com/hasherezade/pe-sieve.git

WARNING: This is an early beta version. Bugs? Remarks? Mail me: [email protected]

Clone:

Use recursive clone to get the repo together with all the submodules:

git clone --recursive https://github.com/hasherezade/hollows_hunter.git
S
Description
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Readme BSD-2-Clause
17 MiB
Languages
C 52.2%
C++ 45.4%
CMake 2.3%
Shell 0.1%