AwesomeREA.org

Tool

Hollows Hunter

Windows command-line memory scanner by hasherezade that runs the PE-sieve engine across many processes, or the whole system, instead of a single PID. It recognizes and dumps replaced or implanted PE modules, shellcode, hooks and other in-memory patches for further analysis, selecting processes by PID list, name list or creation time relative to the scan. Scans can repeat in a loop or, in the 64-bit build, run as an ETW listener whose INI profile chooses the triggering events.

Requirements & limits

  • Latest release at review: v0.4.1.1, published 2025-09-13, with 32- and 64-bit executables, ZIP archives and DLL-build archives; the README also points to a Chocolatey package, and the wiki to unstable AppVeyor test builds. The reviewed master commit identifies itself as the unreleased 0.4.1.3, 37 commits later and mostly PE-sieve submodule updates.
  • Windows only. Source builds need a recursive clone with the pinned PE-sieve, paramkit and Microsoft krabsetw submodules, plus CMake 3.12+; AppVeyor builds x86 and x64 with Visual Studio 2019, and mingw_build.sh shows a MinGW-w64 cross-build. ETW mode works only in the 64-bit build, must run as Administrator and writes HH_ETWProfile.ini to the current directory.
  • It scans processes running on the analyst's own system or VM, and the repository holds no samples. Hook and patch scanning is off by default and enabled with /hooks, dumps go to the current directory unless /dir is given, and the wiki calls looped full-system scans processor-intensive. The wiki warns that detected processes are not necessarily malicious and links PE-sieve's false-positive FAQ, so reports and dumps need review; the optional /suspend and /kill responses act on live processes.
  • AppVeyor runs ctest after each build: the tests check that the executable starts and that scans of the clean build machine report zero suspicious processes, then run IAT, hook, thread and shellcode-pattern scans that only check the report format. The only GitHub workflow publishes Doxygen code documentation.
  • BSD-2-Clause, like PE-sieve; krabsetw is MIT, and the pinned paramkit commit has no license file. The reviewed sources state no REA use, and no processes were scanned for this record.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · hasherezade/hollows_hunter · Revision 831561c
  2. https://github.com/hasherezade/hollows_hunter/wiki/Home/33d85ea58ca60980d911348a867488b957f13639
  3. CMakeLists.txt GitHub · hasherezade/hollows_hunter · Revision 831561c
  4. .appveyor.yml GitHub · hasherezade/hollows_hunter · Revision 831561c
  5. .gitmodules GitHub · hasherezade/hollows_hunter · Revision 831561c
  6. mingw_build.sh GitHub · hasherezade/hollows_hunter · Revision 831561c
  7. hh_ver_short.h GitHub · hasherezade/hollows_hunter · Revision 831561c
  8. LICENSE GitHub · hasherezade/hollows_hunter · Revision 831561c
  9. https://github.com/hasherezade/hollows_hunter/releases/tag/v0.4.1.1
  10. README.md GitHub · hasherezade/pe-sieve · Revision 98788a6
  11. LICENSE GitHub · microsoft/krabsetw · Revision 6900de0

More in Native binaries

All 86 entries in Native binaries