# Hollows Hunter

> Windows command-line memory scanner by hasherezade that runs the PE-sieve engine across many processes, or the whole system, instead of a single PID. It recognizes and dumps replaced or implanted PE modules, shellcode, hooks and other in-memory patches for further analysis, selecting processes by PID list, name list or creation time relative to the scan. Scans can repeat in a loop or, in the 64-bit build, run as an ETW listener whose INI profile chooses the triggering events.

- Type: Tool
- Targets: Binary
- Category: Debugging and dynamic analysis
- Relationship: Foundation tool
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-11-02
- Original resource: <https://github.com/hasherezade/hollows_hunter>
- Primary source: <https://github.com/hasherezade/hollows_hunter/blob/831561cd0c63d0d9c257ad3bc963327bd828b491/README.md>
- Catalog page: <https://awesomerea.org/resources/hollows-hunter/>
- Record JSON: <https://awesomerea.org/resources/hollows-hunter/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/hollows-hunter/index.md)

## Requirements & limits

- Latest release at review: v0.4.1.1, published 2025-09-13, with 32- and 64-bit executables, ZIP archives and DLL-build archives; the README also points to a Chocolatey package, and the wiki to unstable AppVeyor test builds. The reviewed master commit identifies itself as the unreleased 0.4.1.3, 37 commits later and mostly PE-sieve submodule updates.
- Windows only. Source builds need a recursive clone with the pinned PE-sieve, paramkit and Microsoft krabsetw submodules, plus CMake 3.12+; AppVeyor builds x86 and x64 with Visual Studio 2019, and mingw_build.sh shows a MinGW-w64 cross-build. ETW mode works only in the 64-bit build, must run as Administrator and writes HH_ETWProfile.ini to the current directory.
- It scans processes running on the analyst's own system or VM, and the repository holds no samples. Hook and patch scanning is off by default and enabled with /hooks, dumps go to the current directory unless /dir is given, and the wiki calls looped full-system scans processor-intensive. The wiki warns that detected processes are not necessarily malicious and links PE-sieve's false-positive FAQ, so reports and dumps need review; the optional /suspend and /kill responses act on live processes.
- AppVeyor runs ctest after each build: the tests check that the executable starts and that scans of the clean build machine report zero suspicious processes, then run IAT, hook, thread and shellcode-pattern scans that only check the report format. The only GitHub workflow publishes Doxygen code documentation.
- BSD-2-Clause, like PE-sieve; krabsetw is MIT, and the pinned paramkit commit has no license file.

## Primary sources

1. <https://github.com/hasherezade/hollows_hunter/blob/831561cd0c63d0d9c257ad3bc963327bd828b491/README.md>
2. <https://github.com/hasherezade/hollows_hunter/wiki/Home/33d85ea58ca60980d911348a867488b957f13639>
3. <https://github.com/hasherezade/hollows_hunter/blob/831561cd0c63d0d9c257ad3bc963327bd828b491/CMakeLists.txt>
4. <https://github.com/hasherezade/hollows_hunter/blob/831561cd0c63d0d9c257ad3bc963327bd828b491/.appveyor.yml>
5. <https://github.com/hasherezade/hollows_hunter/blob/831561cd0c63d0d9c257ad3bc963327bd828b491/.gitmodules>
6. <https://github.com/hasherezade/hollows_hunter/blob/831561cd0c63d0d9c257ad3bc963327bd828b491/mingw_build.sh>
7. <https://github.com/hasherezade/hollows_hunter/blob/831561cd0c63d0d9c257ad3bc963327bd828b491/hh_ver_short.h>
8. <https://github.com/hasherezade/hollows_hunter/blob/831561cd0c63d0d9c257ad3bc963327bd828b491/LICENSE>
9. <https://github.com/hasherezade/hollows_hunter/releases/tag/v0.4.1.1>
10. <https://github.com/hasherezade/pe-sieve/blob/98788a6ef98cd3c1a0ee481dc5a6847cb4f92432/README.md>
11. <https://github.com/microsoft/krabsetw/blob/6900de05d8ad7a38867719974f0406d5fd57af02/LICENSE>

## More in Native binaries

- [restore-symbol](https://awesomerea.org/resources/restore-symbol/index.md) · Tool
- [FakeNet-NG](https://awesomerea.org/resources/fakenet-ng/index.md) · Tool
- [Joern](https://awesomerea.org/resources/joern/index.md) · Tool
- [Speakeasy](https://awesomerea.org/resources/speakeasy/index.md) · Tool
- [LazyIDA](https://awesomerea.org/resources/lazyida/index.md) · Tool
- [Tiny Tracer](https://awesomerea.org/resources/tiny-tracer/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.