https://cybertoolchain.io/tools/hollows-hunter New releases and features in hollows_hunter, tracked by The Cyber Toolchain. en Sat, 14 Dec 2024 16:06:42 GMT https://github.com/hasherezade/hollows_hunter/releases/tag/v0.4.0 https://github.com/hasherezade/hollows_hunter/releases/tag/v0.4.0 Sat, 14 Dec 2024 16:06:42 GMT hollows_hunter v0.4.0 adds ETW listener mode via /etw flag and new PE-sieve CLI params • `/etw` flag enables ETW listening mode in hollows_hunter (64-bit only) • `HH_ETWProfile.ini` controls which ETW event types are listened to • `/rebase` and `/report` flags added via updated CLI following PE-sieve changes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hollows-hunter https://github.com/hasherezade/hollows_hunter/releases/tag/v0.3.9 https://github.com/hasherezade/hollows_hunter/releases/tag/v0.3.9 Sat, 24 Feb 2024 21:30:29 GMT hollows_hunter v0.3.9 adds `/pattern` CLI flag for custom signature scanning • Adds the `/pattern <file>` CLI argument to supply custom signatures for memory scanning, with SigFinder format support and optional `.pattern.tag` output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hollows-hunter https://github.com/hasherezade/hollows_hunter/releases/tag/v0.3.8.1 https://github.com/hasherezade/hollows_hunter/releases/tag/v0.3.8.1 Fri, 10 Nov 2023 22:41:11 GMT Adds `/obfusc` scan option to hollows_hunter • Adds `scan options` group with `/obfusc` parameter Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hollows-hunter https://github.com/hasherezade/hollows_hunter/releases/tag/v0.3.8 https://github.com/hasherezade/hollows_hunter/releases/tag/v0.3.8 Thu, 09 Nov 2023 18:10:49 GMT Adds `--pe-sieve-options=/obfusc` and expanded `/shellc` support in hollows_hunter v0.3.8 • `/obfusc` parameter is now supported as an option passed to the embedded PE-sieve engine. • The `/shellc` parameter for PE-sieve now accepts a wider set of options. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hollows-hunter https://github.com/hasherezade/hollows_hunter/releases/tag/v0.3.5 https://github.com/hasherezade/hollows_hunter/releases/tag/v0.3.5 Sun, 06 Nov 2022 14:45:37 GMT v0.3.5 adds PE resource version info extraction to hollows_hunter • Adds `version information` extraction for PE resources in the updated PE-sieve engine (v0.3.5) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hollows-hunter https://github.com/hasherezade/hollows_hunter/releases/tag/v0.3.4 https://github.com/hasherezade/hollows_hunter/releases/tag/v0.3.4 Thu, 10 Feb 2022 22:58:23 GMT Adds `/threads` flag to scan thread callstacks for sleeping beacons and changes to `/mignore`. • Supports new PE-sieve parameter `/threads`: enabling scan of the threads' callstack as a shellcode detection layer. • Updates implementation of the `/mignore` flag. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hollows-hunter https://github.com/hasherezade/hollows_hunter/releases/tag/v0.3.3 https://github.com/hasherezade/hollows_hunter/releases/tag/v0.3.3 Mon, 24 Jan 2022 00:03:57 GMT HollowsHunter v0.3.3 adds /cache CLI parameter for optional caching and a default dump directory. • Adds `hollows_hunter.exe` `/cache` flag to enable optional process memory scanning cache • Sets default output directory to `hollows_hunter.dumps` when no explicit path is specified Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hollows-hunter https://github.com/hasherezade/hollows_hunter/releases/tag/v0.3.2 https://github.com/hasherezade/hollows_hunter/releases/tag/v0.3.2 Tue, 28 Dec 2021 19:07:57 GMT Adds import reconstruction modes R0-R2 via /imp and automatic /refl toggle with inaccessible data scans • Adds `/imp` flag to specify import reconstruction mode from restrictive (`R0`) to aggressive (`R2`) • Automatically enables `/refl` mode when scanning inaccessible memory regions (e.g., `/data 4` or `/data 5`) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hollows-hunter