AwesomeREA.org

Tool

PE-sieve

Windows process scanner by hasherezade that finds and dumps implants in one running process: replaced or injected PE modules, shellcode, inline and IAT hooks and other in-memory patches, with the README naming Process Hollowing, Process Doppelgänging and reflective DLL injection among the techniques it detects. Options add shellcode detection by patterns or statistics, scans of thread call stacks, non-executable pages and encrypted or obfuscated content, a choice of dump mode with import-table recovery for dumped PEs, minidumps and JSON reports. It builds as an EXE, as a DLL with a small API that Python, Go and Rust bindings use, or as a static library, and is the engine behind HollowsHunter and MalUnpack.

Requirements & limits

  • Latest release at review: v0.4.1.1, published 2025-09-13, with 32- and 64-bit EXEs and DLLs; the README also lists Chocolatey and Scoop packages. The reviewed master commit (2026-06-06) reports version 0.4.1.5, so the pinned sources may describe unreleased changes. PE-sieve runs on Windows and scans one process per run, selected by PID; the separate HollowsHunter scans many processes or the whole system.
  • Source builds use CMake 3.12+ (or the MinGW build script) and a recursive clone for the libpeconv, paramkit and sig_finder submodules, with an option to build an EXE, a DLL or a static library. The Python bindings in the repository and the separate Go and Rust bindings load pe-sieve32.dll or pe-sieve64.dll from PESIEVE_DIR or the current directory. Optional symbol download fetches symbols for the scanned modules.
  • Inputs are running processes on a machine the analyst controls, and the README describes the results as potentially malicious material collected for further analysis, so detections and dumps need review. AppVeyor builds x86 and x64 Release and Debug configurations, and its only CTest check runs pe-sieve -? and expects a version string; the GitHub workflow publishes Doxygen documentation. No process was scanned.
  • BSD-2-Clause (LICENSE, 2017-2026 @hasherezade); the submodules keep their own licenses.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · hasherezade/pe-sieve · Revision 98788a6
  2. params.h GitHub · hasherezade/pe-sieve · Revision 98788a6
  3. CMakeLists.txt GitHub · hasherezade/pe-sieve · Revision 98788a6
  4. pe_sieve_ver_short.h GitHub · hasherezade/pe-sieve · Revision 98788a6
  5. .gitmodules GitHub · hasherezade/pe-sieve · Revision 98788a6
  6. bindings/README.md GitHub · hasherezade/pe-sieve · Revision 98788a6
  7. .appveyor.yml GitHub · hasherezade/pe-sieve · Revision 98788a6
  8. .github/workflows/main.yml GitHub · hasherezade/pe-sieve · Revision 98788a6
  9. LICENSE GitHub · hasherezade/pe-sieve · Revision 98788a6
  10. https://github.com/hasherezade/pe-sieve/releases/tag/v0.4.1.1

More in Native binaries

All 86 entries in Native binaries