📖 README.md

Using: PE-sieve v0.4.1.1
https://github.com/hasherezade/pe-sieve/releases/tag/v0.4.1.1

BUGFIX

• Updated PE-sieve: fixed dumping reflectively loaded PEs (automatically find suitable base)
• Protected against DLL hijacking
• Fixed building resources with MinGW
• Other small fixes

📖 README.md

Using: PE-sieve v0.4.1
https://github.com/hasherezade/pe-sieve/releases/tag/v0.4.1

BUGFIX

• In PE-sieve: fixed Thread Scan (compatibility issue with Windows 11 >=23H2), other small fixes

FEATURE

• In PE-sieve: added detailed report about the indications found in each detected thread (complete call-stack with symbols, etc)
• Changed the description of /jlvl argument, following its extended functionality

📖 README.md

Using: PE-sieve v0.4.0.1
https://github.com/hasherezade/pe-sieve/releases/tag/v0.4.0.1

BUGFIX

• Updated PE-sieve: fixed error in Import Table reconstruction
• Changed API for retrieving processes start time (improved results)

📖 README.md

Using: PE-sieve v0.4.0
https://github.com/hasherezade/pe-sieve/releases/tag/v0.4.0

FEATURE

• Added new parameter: /etw (64-bit only) - allows to run HH as an ETW listener. The types of listened events can be enabled/disabled by editing HH_ETWProfile.ini
• Improved caching. From now modules caching is enabled by default when run in continuous scan mode (/loop or /etw). Settings can be changed via parameter /cache.
• Updated CLI to follow the changes in PE-sieve. Support new parameters: /rebase and /report.

BUGFIX

• Fixed crashing at the end of scan (occurring in 32-bit HH)
• Other small fixes and improvements

📖 README.md

Using: PE-sieve v0.3.9
https://github.com/hasherezade/pe-sieve/releases/tag/v0.3.9

FEATURE

• Added new parameter /pattern <file> allowing to supply custom signatures to be searched in memory. The format is defined by SigFinder and described in the relevant README. If pattern file was defined, a .tag file for the found patterns will be generated, with the extension .pattern.tag

📖 README.md

Using: PE-sieve v0.3.8
https://github.com/hasherezade/pe-sieve/releases/tag/v0.3.8

BUGFIX

• Added parameter /obfusc into a group scan options

📖 README.md

Updated PE-sieve (v0.3.8):
https://github.com/hasherezade/pe-sieve/releases/tag/v0.3.8

FEATURE

• Supported new PE-sieve param: /obfusc
• Supported new options for PE-sieve /shellc param

📖 README.md

Updated PE-sieve (v0.3.6):
https://github.com/hasherezade/pe-sieve/releases/tag/v0.3.6

BUGFIX

• Fixed quiet mode - enabled with the parameter /quiet

📖 README.md

Updated PE-sieve (v0.3.5):
https://github.com/hasherezade/pe-sieve/releases/tag/v0.3.5

FEATURE

• Added version information to resources

BUGFIX

• Use GetTickCount instead of GetTickCount64 (backward compat.) - Issue #13
• Other small fixes

📖 README.md

Updated PE-sieve (v0.3.4):
https://github.com/hasherezade/pe-sieve/releases/tag/v0.3.4

FEATURE

• Supported changes in the implementation of /mignore
• Supported new PE-sieve param: /threads: enabling scan of the threads' callstack . This is another layer of shellcode detection, allowing to capture "sleeping beacons", and others, decrypted just before the execution.