Popular repositories

1. pe-sieve

   Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

   C++ 1.3k 217

2. hollows_hunter

   Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

   C 648 106

3. pe_to_shellcode

   Converts PE into a shellcode

   Assembly 586 166

4. demos

   Demos of various injection techniques found in malware

   C 557 153

5. dll_to_exe

   Converts a DLL into EXE

   C++ 497 123

6. libpeconv

   A library to load, manipulate, dump PE files. See also: https://github.com/hasherezade/libpeconv_tpl

   C++ 408 96