Awesome Open Source
Awesome Open Source

Build status Codacy Badge License GitHub release Github All Releases Twitter URL

❓ FAQ - Frequently Asked Questions

πŸ“– Read Wiki

PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches.
Detects inline hooks, Process Hollowing, Process DoppelgΓ€nging, Reflective DLL Injection, etc.

PE-sieve is meant to be a light-weight engine dedicated to scan a single process at the time. It can be built as an EXE or as a DLL. The DLL version exposes a simple API and can be easily integrated with other applications.

If instead of scanning a particular process you want to scan your full system with PE-sieve, you can use HollowsHunter. It contains PE-sieve (a DLL version), but offers also some additional features and filters on the top of this base.

Uses library:


Use recursive clone to get the repo together with the submodule:

git clone --recursive


Download the latest release, or read more.

logo by Baran Pirinçal

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
c-plus-plus (15,818)Β 
malware-analysis (112)Β 
hooking (26)Β 
scans (14)Β 

Find Open Source By Browsing 7,000 Topics Across 59 Categories