### Example pattern tag file content Source: https://github.com/hasherezade/pe-sieve/wiki/4.11.-Detect-shellcode-by-custom-patterns-(pattern) An example showing the content of a .pattern.tag file. ```plaintext 16b0;Heavens_Gate1;c 1728;Heavens_Gate1;c 17b1;Heavens_Gate1;c ``` -------------------------------- ### Example TAG file content Source: https://github.com/hasherezade/pe-sieve/wiki/3.1.-Investigating-hooks-and-patches An example of a TAG file showing detected hooks for CreateWindowExW and CharUpperW. ```text ec7c;CreateWindowExW->402551[400000+2551:KeygenMe V7.exe:0];5 1e981;CharUpperW->4017be[400000+17be:KeygenMe V7.exe:0];5 ``` -------------------------------- ### Scan Report Example Source: https://github.com/hasherezade/pe-sieve/wiki/4.8.-Create-Process-Reflection-(refl) Example JSON snippet from a scan report indicating that reflection mode was used. ```json "used_reflection" : 1, ``` -------------------------------- ### Patterns file format - Example signature Source: https://github.com/hasherezade/pe-sieve/wiki/4.11.-Detect-shellcode-by-custom-patterns-(pattern) A complete example of a signature definition in the patterns file. ```plaintext Heavens_Gate1 12 6A 33 E8 00 00 00 00 83 ?? ?? 05 CB ``` -------------------------------- ### Testing Setup Source: https://github.com/hasherezade/pe-sieve/blob/master/CMakeLists.txt Enables testing and defines a basic test case to check if the application runs and outputs version information. ```cmake if (NOT PESIEVE_IS_STATIC) install(TARGETS ${PROJECT_NAME} DESTINATION ${CMAKE_INSTALL_PREFIX} COMPONENT ${PROJECT_NAME} ) # Setup testing if(PESIEVE_BUILD_TESTING) enable_testing() # 0) does the application run add_test (TestRuns ${CMAKE_INSTALL_PREFIX}/pe-sieve -?) set_tests_properties(TestRuns PROPERTIES PASS_REGULAR_EXPRESSION "Version:") endif() endif() ``` -------------------------------- ### Example of ignoring multiple modules Source: https://github.com/hasherezade/pe-sieve/wiki/4.6.-Ignore-modules-(mignore) An example demonstrating how to use the /mignore command to exclude multiple DLL files from the scan. ```shell /mignore clr.dll;ntdll.dll ``` -------------------------------- ### Patterns file format - Byte definition examples Source: https://github.com/hasherezade/pe-sieve/wiki/4.11.-Detect-shellcode-by-custom-patterns-(pattern) Examples of valid byte definitions within a pattern signature, including wildcard usage. ```plaintext 23 56 12 68 55 0? 34 12 40 ?? 4? 8? e? ``` -------------------------------- ### Example of a harmless hook detection Source: https://github.com/hasherezade/pe-sieve/wiki/1.-FAQ This example shows how PE-sieve might report a hook, and how to interpret it as harmless by checking the target module. ```text 17be0;BaseThreadInitThunk->5a622e30[5a620000+2e30:mozglue.dll:0];5 ``` -------------------------------- ### Basic Demo of PESieve_scan_ex Source: https://github.com/hasherezade/pe-sieve/wiki/5.-API A C++ example demonstrating how to load the PE-sieve.dll, retrieve the PESieve_scan_ex function, set up parameters, perform a scan, and process the JSON report. ```cpp #include #include #include int main() { // Load PE-sieve.dll, and retrieve the function: HMODULE dll = LoadLibraryA("pe-sieve.dll"); FARPROC proc = GetProcAddress(dll, "PESieve_scan_ex"); if (!proc) { std::cout << "Loading function failed!\n"; return -1; } auto _PESieve_scan_ex = reinterpret_cast(proc); // Set up the scan parameters PEsieve_params pp = { 0 }; pp.pid = GetCurrentProcessId(); // scan current process pp.threads = true; pp.shellcode = pesieve::SHELLC_PATTERNS; pp.quiet = true; pp.results_filter = pesieve::SHOW_SUSPICIOUS; const PEsieve_rtype rtype = pesieve::REPORT_ALL; // Prepare the buffer for the output report const size_t buf_size = 0x1000; char json_buf[buf_size] = { 0 }; size_t needed_size = 0; // Perform the scan: PEsieve_report report = _PESieve_scan_ex(pp, rtype, json_buf, buf_size, &needed_size); if (needed_size > buf_size) { // The supplied buffer was too small to fit in the whole JSON report std::cout << "Couldn't retrieve the full buffer. Needed size: " << std::hex << needed_size << std::endl; } // Print the obtained report: std::cout << json_buf << "\n"; return 0; } ``` -------------------------------- ### Scan report - General Summary Example Source: https://github.com/hasherezade/pe-sieve/wiki/3.3.-JSON-reports An example of the general summary section of the scan report, detailing process information and detected anomalies across various modules. ```json { "pid" : 684, // PID of the process that was scanned "is_64_bit" : 1, // Flag indicating if the process was 64 bit: 1 if true, 0 if false "is_managed" : 0, // Flag indicating if the process was managed (.NET) : 1 if true (.NET process) , 0 if false (native process) "main_image_path" : "", // The path of the main image (from PEB). If empty, it often indicates process Doppelgänging. "used_reflection" : 0, // Flag indicating if the scan was performed on the raw process, or on process reflection "scanned" : { "total" : 48, // total count of scanned modules "skipped" : 0, // count of modules excluded from the scan, for example: // excluded on demand by the parameter: /mignore "modified" : // list of all the modules in which any of the suspicious indicators were detected { "total" : 2, // total count of modules detected as suspicious "patched" : 0, // count of modules detected as patched (possible inline hooks or other code modifications) "iat_hooked" : 0, // count of modules where IAT hooks were detected "replaced" : 1, // count of hollowed/replaced modules "hdr_modified" : 0, //count of modules with PE headers modified (but without modifications typical for replaced modules) "implanted_pe" : 0, // count of manually mapped PEs (not associated with any PE file on the disk) "implanted_shc" : 0, // count of sections with code mapped outside of any PE (shellcodes, JITs) "unreachable_file" : 0, // count of modules that were associated with a PE file on the disk, but // this file was deleted or inaccessible "other" : 1 // any additional indicators - such as // inconsistency between the path of mapped module and corresponding path set in the PEB }, "errors" : 0 // count of inconclusive scans, interrupted by some errors }, [...] } ``` -------------------------------- ### Using custom patterns with PE-sieve Source: https://github.com/hasherezade/pe-sieve/wiki/4.11.-Detect-shellcode-by-custom-patterns-(pattern) Example of how to use the /pattern argument to specify a custom patterns file. ```bash pe-sieve.exe /pid 1243 /pattern my_patterns.txt ``` -------------------------------- ### Import Reconstruction Status JSON Example Source: https://github.com/hasherezade/pe-sieve/wiki/3.3.-JSON-reports An example of a JSON object detailing the status of import reconstruction, including file paths for reports and the result of the reconstruction process. ```json { "module" : "400000", "module_size" : "723000", "dump_file" : "400000.HxD.exe", "tags_file" : "400000.HxD.exe.tag", "imports_file" : "400000.HxD.exe.imports.txt", // The report of all the imports that were found by PE-sieve. "imp_rec_result" : "IMP_ALREADY_OK", // The import table was left as is - not overwritten. // This may happen depending on the mode in which the import reconstruction was requested. // If the autodetect mode was selected, PE-sieve will not overwrite the import table if a valid one was detected "imp_not_recovered_file" : "400000.HxD.exe.not_fixed_imports.txt", // There were some thunks that could not be resolved, and they have been stored in additional report. "dump_mode" : "UNMAPPED", "is_shellcode" : 0, "status" : 1 } ``` -------------------------------- ### Using custom patterns with hardcoded patterns Source: https://github.com/hasherezade/pe-sieve/wiki/4.11.-Detect-shellcode-by-custom-patterns-(pattern) Example of using both custom patterns and hardcoded patterns. ```bash pe-sieve.exe /pid 1243 /pattern my_patterns.txt /shellc P ``` -------------------------------- ### Example IAT Hook Report Entry Source: https://github.com/hasherezade/pe-sieve/wiki/4.7.-Scan-for-IAT-Hooks-(iat) An example of a PE-sieve report entry for a detected IAT hook, showing a patched MessageBoxW function. ```text 4068;[user32.MessageBoxW #533]->1000100c[10000000+100c:nagmenot.MBox #1:0] ``` -------------------------------- ### Scan report - Specific Scans Example Source: https://github.com/hasherezade/pe-sieve/wiki/3.3.-JSON-reports An example of the 'scans' array within the scan report, showing detailed findings from specific scan types like mapping_scan and headers_scan. ```json "scans" : [ // list of the reports from particular scans { "mapping_scan" : { "module" : "7ff6bc950000", "module_file" : "C:\\Windows\\notepad.exe", "mapped_file" : "", "status" : 1 } }, { "headers_scan" : { "module" : "7ff6bc950000", "module_file" : "C:\\Windows\\notepad.exe", "status" : 1, "is_pe_replaced" : 1, "dos_hdr_modified" : 1, "file_hdr_modified" : 1, "nt_hdr_modified" : 1, "ep_modified" : 1, "sec_hdr_modified" : 1 } } ] ``` -------------------------------- ### Dump report (with IAT hooks file) Source: https://github.com/hasherezade/pe-sieve/wiki/3.3.-JSON-reports Example of a dump report entry including an 'iat_hooks_file' field for IAT hook details. ```json { "module" : "400000", "module_size" : "6336", "dump_file" : "400000.hooked2.exe", "iat_hooks_file" : "400000.hooked2.exe.iat_hooks.txt", "dump_mode" : "UNMAPPED", "is_shellcode" : 0, "status" : 1 } ``` -------------------------------- ### Dump report (summary) Source: https://github.com/hasherezade/pe-sieve/wiki/3.3.-JSON-reports Example JSON structure for a general dump report, summarizing dumped modules. ```json { "pid" : 684, "output_dir" : "process_684", "dumped" : { "total" : 2, "dumped" : 2 }, "dumps" : [ { "module" : "7ff6bc950000", "module_size" : "e4000", "dump_file" : "7ff6bc950000.notepad.exe", "dump_mode" : "UNMAPPED", "is_shellcode" : 0, "status" : 1 }, [...] ] } ``` -------------------------------- ### Dump report (with tag file) Source: https://github.com/hasherezade/pe-sieve/wiki/3.3.-JSON-reports Example of a dump report entry including a 'tags_file' field for patched details. ```json "dumps" : [ { "module" : "75660000", "module_size" : "153000", "dump_file" : "75660000.user32.dll", "tags_file" : "75660000.user32.dll.tag", "dump_mode" : "UNMAPPED", "is_shellcode" : 0, "status" : 1 } ``` -------------------------------- ### Example of return addresses extracted during thread callstack scan Source: https://github.com/hasherezade/pe-sieve/wiki/4.9.-Scan-threads-callstack-(threads) This snippet shows a sample output from a thread callstack scan, highlighting consecutive return addresses and identifying a potential shellcode location. ```text > 7ffdbd76d3f4 : ntdll.dll > 7ffdbb22962e : KERNELBASE.dll > 7ff6f0661269 : ShellcodeFluctuation64.exe > 20fa9d1022d 20fa9d1022d <=== SHELLCODE ``` -------------------------------- ### Workingset scan report (PE detected) Source: https://github.com/hasherezade/pe-sieve/wiki/3.3.-JSON-reports Example JSON structure for a workingset scan report when a complete PE file is detected. ```json "workingset_scan" : { "module" : "6f66740000", "status" : 1, "has_pe" : 1, "has_shellcode" : 0, "is_listed_module" : 0, "protection" : "40", "mapping_type" : "MEM_PRIVATE", "pe_artefacts" : { "pe_base_offset" : "0", "nt_file_hdr" : "fc", "sections_hdrs" : "200", "sections_count" : 7, "is_dll" : 0, "is_64_bit" : 1 } } ``` -------------------------------- ### Workingset scan report (Shellcode detected) Source: https://github.com/hasherezade/pe-sieve/wiki/3.3.-JSON-reports Example JSON structure for a workingset scan report when only shellcode is detected. ```json "workingset_scan" : { "module" : "7ff7d9fe1000", "status" : 1, "has_pe" : 0, "has_shellcode" : 1, "is_listed_module" : 0, "protection" : "20", "mapping_type" : "MEM_PRIVATE" } ``` -------------------------------- ### Example of JSON output for thread scan anomalies Source: https://github.com/hasherezade/pe-sieve/wiki/4.9.-Scan-threads-callstack-(threads) This JSON snippet illustrates the structure of scan results when callstack anomalies are detected, including thread ID, state, callstack information, and suspicious indicators. ```json [ ...] "scans" : [ { "thread_scan" : { "status" : 1, "thread_id" : 8080, "thread_info" : { "state" : "Waiting", "wait_reason" : "UserRequest", "callstack" : { "stack_ptr" : "51ff8ffa50", "frames_count" : 1, "frames" : ["7ffaaf3826b1;ntdll.dll!RtlUserThreadStart+0x21"] }, "last_sysc" : "NtSignalAndWaitForSingleObject", "last_func" : "RtlUserThreadStart" }, "indicators" : ["SUS_RET", "SUS_CALLS_INTEGRITY", "SUS_CALLSTACK_CORRUPT"], "susp_return_addr" : "1c988087780" } } ] [...] ``` -------------------------------- ### Clone the repository Source: https://github.com/hasherezade/pe-sieve/wiki/2.-How-to-build Clones the PE-sieve repository including its submodules recursively. ```bash git clone --recursive https://github.com/hasherezade/pe-sieve.git ``` -------------------------------- ### Help for Obfuscation Option Source: https://github.com/hasherezade/pe-sieve/wiki/4.10.-Detect-obfuscated-areas-(obfusc) Command to display all possible arguments for the /obfusc option. ```shell pe-sieve /obfusc ? ``` -------------------------------- ### Enable Reflection Mode Source: https://github.com/hasherezade/pe-sieve/wiki/4.8.-Create-Process-Reflection-(refl) Command-line option to enable reflection mode in PE-sieve. ```bash /refl ``` -------------------------------- ### PE-sieve Help Output Source: https://github.com/hasherezade/pe-sieve/wiki/4.-Additional-features-(options) The main screen and detailed help output when running PE-sieve with the /help parameter. ```console .______ _______ _______. __ ___________ ____ _______ | _ \ | ____| / || | | ____\ \ / / | ____| | |_) | | |__ ______ | (----`| | | |__ \ \/ / | |__ | ___/ | __| |______| \ \ | | | __| \ / | __| | | | |____ .----) | | | | |____ \ / | |____ | _| |_______| |_______/ |__| |_______| \__/ |_______| _ _______ _______ __ _______ __ _______ ________________________________________________________________________ Version: 0.3.9 (x64) Built on: Feb 24 2024 ~ from hasherezade with love ~ Scans a given process, recognizes and dumps a variety of in-memory implants: replaced/injected PEs, shellcodes, inline hooks, patches etc. URL: https://github.com/hasherezade/pe-sieve --- Required: /pid : Set the PID of the target process. Optional: ---1. scanner settings--- /quiet : Print only the summary. Do not log on stdout during the scan. /refl : Make a process reflection before scan. ---2. scan exclusions--- /dnet <*dotnet_policy> : Set the policy for scanning managed processes (.NET). /mignore : Do not scan module/s with given name/s. ---3. scan options--- /data <*data_scan_mode> : Set if non-executable pages should be scanned. /iat <*iat_scan_mode> : Scan for IAT hooks. /obfusc <*obfusc_mode> : Detect encrypted content, and possible obfuscated shellcodes. /pattern : Set additional shellcode patterns (file in the SIG format). /shellc <*shellc_mode> : Detect shellcode implants (by patterns or statistics). /threads : Scan threads' callstack. Detect shellcodes, incl. 'sleeping beacons'. ---4. dump options--- /dmode <*dump_mode> : Set in which mode the detected PE files should be dumped. /imp <*imprec_mode> : Set in which mode the ImportTable should be recovered /minidmp : Create a minidump of the full suspicious process. ---5. output options--- /dir : Set a root directory for the output (default: current directory). /jlvl <*json_lvl> : Level of details of the JSON report. /json : Print the JSON report as the summary. /ofilter <*ofilter_id> : Filter the dumped output. Info: /help : Print complete help. /help : Print help about a given keyword. / ? : Print details of a given parameter. /version : Print version info. --- ``` -------------------------------- ### Module Definitions Source: https://github.com/hasherezade/pe-sieve/blob/master/CMakeLists.txt Defines variables for module paths and includes necessary headers. ```cmake # modules: set ( M_PARSER "libpeconv/libpeconv" ) set ( M_SIGFIND "sig_finder/sig_finder" ) # modules paths: set ( PECONV_DIR "${PROJECT_SOURCE_DIR}/${M_PARSER}" CACHE PATH "PEConv main path") set ( SIGFIND_DIR "${PROJECT_SOURCE_DIR}/${M_SIGFIND}" CACHE PATH "SigFinder main path") # modules headers: include_directories ( ${PECONV_DIR}/include ) include_directories ( ${SIGFIND_DIR}/include ) ``` -------------------------------- ### Project Libraries and Subdirectories Source: https://github.com/hasherezade/pe-sieve/blob/master/CMakeLists.txt Defines subdirectories for parsing, signature finding, and parameter kit, and sets cache variables for library paths. ```cmake add_subdirectory (${M_PARSER}) set ( PECONV_LIB $ CACHE PATH "PEConvLib library path" ) add_subdirectory(${M_SIGFIND}) set ( SIGFIND_LIB $ CACHE PATH "SigFinder library path" ) ``` -------------------------------- ### Build Mode Configuration Source: https://github.com/hasherezade/pe-sieve/blob/master/CMakeLists.txt Configures the build mode for PE-sieve (EXE, DLL, or STATIC) and validates the input. ```cmake set(PESIEVE_BUILD_MODE "EXE" CACHE STRING "Build PE-sieve as EXE, DLL, or static LIB") set_property(CACHE PESIEVE_BUILD_MODE PROPERTY STRINGS EXE DLL STATIC) if(NOT PESIEVE_BUILD_MODE STREQUAL "EXE" AND NOT PESIEVE_BUILD_MODE STREQUAL "DLL" AND NOT PESIEVE_BUILD_MODE STREQUAL "STATIC") message(FATAL_ERROR "Invalid PESIEVE_BUILD_MODE '${PESIEVE_BUILD_MODE}'. Choose: EXE DLL STATIC" ) endif() set(PESIEVE_IS_EXE OFF) set(PESIEVE_IS_DLL OFF) set(PESIEVE_IS_STATIC OFF) if(PESIEVE_BUILD_MODE STREQUAL "EXE") set(PESIEVE_IS_EXE ON) elseif(PESIEVE_BUILD_MODE STREQUAL "DLL") set(PESIEVE_IS_DLL ON) elseif(PESIEVE_BUILD_MODE STREQUAL "STATIC") set(PESIEVE_IS_STATIC ON) endif() ``` -------------------------------- ### Help for /shellc parameter Source: https://github.com/hasherezade/pe-sieve/wiki/4.1.-Detect-shellcodes-(shellc) Command to display all possible arguments for the /shellc parameter. ```shell pe-sieve /shellc ? ``` -------------------------------- ### LibPEConv Options Source: https://github.com/hasherezade/pe-sieve/blob/master/CMakeLists.txt Configures options for the LibPEConv library, specifically redirecting logs to Debug output. ```cmake # options for LibPEConv set(PECONV_LOG_USE_DEBUGOUT ON CACHE BOOL "" FORCE) # no logs from libPEconv on stdout, redirect all to Debug output mark_as_advanced(PECONV_LOG_USE_DEBUGOUT) # hide the option from menu ``` -------------------------------- ### GNU Compiler Options Source: https://github.com/hasherezade/pe-sieve/blob/master/CMakeLists.txt Sets specific compile and link options for the GNU compiler, including static linking. ```cmake if (CMAKE_CXX_COMPILER_ID STREQUAL "GNU") option(LINK_STATICALLY "Link PE-Sieve with static versions of linked libraries" ON) enable_language(RC) set(CMAKE_RC_COMPILE_OBJECT " -O coff -i -o