# hasherezade/pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

Repository: https://github.com/hasherezade/pe-sieve
Canonical: https://ross.abutalabs.com/products/pe-sieve
Homepage: https://hshrzd.wordpress.com/pe-sieve/
Language: C++
License: BSD-2-Clause
License Family: permissive
Topics: pe-format, hooking, pe-dumper, pe-analyzer, libpeconv, process-analyzer, scans, anti-malware, pe-sieve, malware-analysis, memory-forensics
Last push: 2026-06-06T12:46:00+00:00

## Health v2 (maintenance only)
Score: 71/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 86, release rhythm 35, longevity 100
- inputs: {"age_days": 3299, "days_push": 88, "days_rel": 354, "gap_med": 49, "n_releases_24m": 4}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3867, forks 494 (observed 2026-08-28T04:08:27.709700+00:00)

## What it is
PE-sieve is a lightweight Windows tool that scans a given process for malicious implants such as replaced or injected PE files, shellcodes, inline hooks, and in-memory patches, then dumps the suspicious material for further analysis. It can be built as a standalone EXE or as a DLL with a simple API for integration into other applications, and it produces JSON reports detailing the indicators found.

## Use cases
- detect malware running on a windows system
- dump injected pe files and shellcodes from a process memory
- detect process hollowing and reflective dll injection
- find inline hooks and in-memory patches in a running process
- collect malicious material from a live process for malware analysis
- integrate a process scanner into a security tool via dll api
- scan all running processes for suspicious implants

## When to choose
- you need to triage a suspicious process on windows and extract its in-memory implants
- you want lightweight, per-process scanning with json reports of indicators
- you need to detect techniques like process hollowing, process doppelgänging, or reflective dll injection
- you want a dll engine you can embed into your own security or incident-response tooling

## When to avoid
- you need a cross-platform scanner for linux or macos
- you want a full antivirus with real-time protection rather than an on-demand analysis tool
- you need static file analysis of samples on disk instead of live process memory inspection

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, reverse-engineering, cli, developer-tools
- domain: security, reverse-engineering, windows, developer-tools
- platform: windows, cli
- tags: malware-analysis, memory-forensics, pe-dumper, process-scanner, hook-detection, process-hollowing, dll-injection, incident-response, libpeconv, json-reports

## Member repositories
- hasherezade/pe-sieve (main) score 71

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:27.709700+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:25:50.390975+00:00, confidence not recorded.
  - readme: https://github.com/hasherezade/pe-sieve (fetched 2026-08-28T04:08:27.709700+00:00, sha 2dd81914f86a)
  - homepage: https://hshrzd.wordpress.com/pe-sieve/ (fetched 2026-08-29T09:20:06.156821+00:00, sha e5f332f42ba7)
- Data as of 2026-08-30T08:39:29.467469+00:00.