search

hasherezade / pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
https://hshrzd.wordpress.com/pe-sieve/
BSD 2-Clause "Simplified" License
3.01k stars 421 forks source link

Reconstruct Import Table from the scratch #34

Closed hasherezade closed 5 years ago

hasherezade commented 5 years ago

So far PE-sieve can reconstruct corrupt import table basing on its artefacts. However, in some cases we may need full rebuilding of import table. PE-sieve should be able to make a fully new import table basing on the found IAT, and attach it at the end of the PE file by extending the last section.