DOCSEARCHbyAlgolia
Submit Docs

PE-sieve Documentation

repository·master·Indexed 26 days ago

https://github.com/hasherezade/pe-sieve

A lightweight process scanning engine used to detect and dump malicious in-memory implants such as shellcode, hooks, and injected PEs. It supports detection of process hollowing, process doppelgänging, and reflective DLL injection. PE-sieve can be used as a standalone CLI tool or integrated into other software via a DLL API with available bindings for Python, GoLang, and Rust.

Tokens
900
Snippets
1
Records
8
Agent score
87%

What's inside PE-sieve

  1. Overview of PE-sieve

    master

    PE-sieve is a lightweight engine designed to detect malware running on a system and collect potentially malicious material for analysis. It scans a single process at a time to recognize and dump various in-memory implants, including:

    • Replaced or injected PEs
    • Shellcodes
    • Hooks (including inline hooks)
    • Other in-memory patches
    • Process Hollowing
    • Process Doppelgänging
    • Reflective DLL Injection

    PE-sieve can be used as a standalone executable (EXE) or integrated into other applications via its DLL version, which exposes a simple API.

  3. Related tools in the PE-sieve family

    master

    PE-sieve serves as an engine for other specialized tools:

    • HollowsHunter: Used for scanning multiple processes at once or scanning the entire system.
    • MalUnpack: Focused on the quick unpacking of supplied malware samples.

  6. Configure PE-sieve DLL paths for bindings

    master

    When using Python, GoLang, or Rust bindings, the libraries require the PE-sieve DLLs (pe-sieve64.dll and pe-sieve32.dll) to function. You can make these available to the bindings in two ways:

    1. Environment Variable: Set the PESIEVE_DIR environment variable to the directory containing the DLLs.
    2. Current Directory: Place pe-sieve64.dll and pe-sieve32.dll in the same directory as your executable/script.

  7. Use PE-sieve CLI to scan processes

    master

    PE-sieve is a command-line tool used to scan processes for suspicious activity, such as in-memory patches, hollowed modules, or injected code. When running the executable, it accepts various parameters to define the target PID, output filters, and dump modes.

    If no arguments are provided, the tool prints its banner and brief information.

    Key Execution Logic:

    • Inaccessible Pages: If you request scanning of inaccessible pages (PE_DATA_SCAN_INACCESSIBLE or PE_DATA_SCAN_INACCESSIBLE_ONLY), the tool automatically enables reflection mode to ensure successful scanning.
    • Output Formats: Results can be output as a standard string report or as a JSON object if the --json-output flag is used.
    • Exit Codes:
      • PESIEVE_DETECTED: Suspicious activity was found.
      • PESIEVE_NOT_DETECTED: No suspicious activity was found.
      • PESIEVE_INFO: Information was displayed (e.g., help or invalid arguments).
      • PESIEVE_ERROR: An error occurred during execution.

  8. PE-sieve CLI Exit Codes

    master

    The PE-sieve executable returns specific exit codes that can be used to programmatically determine the results of a scan:

    • PESIEVE_DETECTED: Suspicious activity was detected in the target process.
    • PESIEVE_NOT_DETECTED: No suspicious activity was detected.
    • PESIEVE_INFO: The tool provided information (e.g., help text) or encountered invalid parameters.
    • PESIEVE_ERROR: An error occurred during the scanning process.