hollows_hunter

hollowshunter Hollows Hunter is a command-line application based on PE-sieve passive memory scanner. Recognizes and dumps a variety of potentially malicious implants replaced/implanted PEs, shellcodes, hooks, in-memory patches. While in case of PE-sieve you can select the process only by its PID,...

HyperBone

HyperBone Minimalistic VT-X hypervisor with hooks Features, all PG-compatible Syscall hooks via MSRLSTAR Kernel inline hooks Kernel page substitution Kernel page EPT TLB splitting MSR hooks IDT hooks Supported hardware Intel processors with VT-x and EPT support Supported platforms Windows 7 -...

pe-sieve

Introducción PE-sieve es una herramienta que ayuda a detectar malware en ejecución en el sistema, así como a recolectar el material potencialmente malicioso para su posterior análisis. Reconoce y vuelca una variedad de implantes dentro del proceso escaneado: PE reemplazados/inyectados, shellcodes...