{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/hasherezade/hollows_hunter/wiki/Home/33d85ea58ca60980d911348a867488b957f13639",
    "https://github.com/hasherezade/hollows_hunter/blob/831561cd0c63d0d9c257ad3bc963327bd828b491/CMakeLists.txt",
    "https://github.com/hasherezade/hollows_hunter/blob/831561cd0c63d0d9c257ad3bc963327bd828b491/.appveyor.yml",
    "https://github.com/hasherezade/hollows_hunter/blob/831561cd0c63d0d9c257ad3bc963327bd828b491/.gitmodules",
    "https://github.com/hasherezade/hollows_hunter/blob/831561cd0c63d0d9c257ad3bc963327bd828b491/mingw_build.sh",
    "https://github.com/hasherezade/hollows_hunter/blob/831561cd0c63d0d9c257ad3bc963327bd828b491/hh_ver_short.h",
    "https://github.com/hasherezade/hollows_hunter/blob/831561cd0c63d0d9c257ad3bc963327bd828b491/LICENSE",
    "https://github.com/hasherezade/hollows_hunter/releases/tag/v0.4.1.1",
    "https://github.com/hasherezade/pe-sieve/blob/98788a6ef98cd3c1a0ee481dc5a6847cb4f92432/README.md",
    "https://github.com/microsoft/krabsetw/blob/6900de05d8ad7a38867719974f0406d5fd57af02/LICENSE"
  ],
  "category": "dynamic-analysis",
  "description_en": "Windows command-line memory scanner by hasherezade that runs the PE-sieve engine across many processes, or the whole system, instead of a single PID. It recognizes and dumps replaced or implanted PE modules, shellcode, hooks and other in-memory patches for further analysis, selecting processes by PID list, name list or creation time relative to the scan. Scans can repeat in a loop or, in the 64-bit build, run as an ETW listener whose INI profile chooses the triggering events.",
  "description_zh": "hasherezade 开发的 Windows 命令行内存扫描器，把 PE-sieve 引擎从单个 PID 扩展到多个进程乃至整个系统。它识别并转储被替换或植入的 PE 模块、shellcode、钩子及其他内存补丁，供进一步分析，可按 PID 列表、进程名列表或相对于扫描开始时间的进程创建时间选择目标。扫描可以循环执行；64 位版本还能作为 ETW 监听器运行，由 INI 配置文件选择触发扫描的事件。",
  "entry_url": "https://awesomerea.org/resources/hollows-hunter/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/hollows-hunter/",
  "evidence_url": "https://github.com/hasherezade/hollows_hunter/blob/831561cd0c63d0d9c257ad3bc963327bd828b491/README.md",
  "group": "tools",
  "id": "hollows-hunter",
  "json_url": "https://awesomerea.org/resources/hollows-hunter/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/hollows-hunter/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/hollows-hunter/index.md",
  "name": "Hollows Hunter",
  "name_zh": "Hollows Hunter 进程内存植入扫描器",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v0.4.1.1, published 2025-09-13, with 32- and 64-bit executables, ZIP archives and DLL-build archives; the README also points to a Chocolatey package, and the wiki to unstable AppVeyor test builds. The reviewed master commit identifies itself as the unreleased 0.4.1.3, 37 commits later and mostly PE-sieve submodule updates.",
    "Windows only. Source builds need a recursive clone with the pinned PE-sieve, paramkit and Microsoft krabsetw submodules, plus CMake 3.12+; AppVeyor builds x86 and x64 with Visual Studio 2019, and mingw_build.sh shows a MinGW-w64 cross-build. ETW mode works only in the 64-bit build, must run as Administrator and writes HH_ETWProfile.ini to the current directory.",
    "It scans processes running on the analyst's own system or VM, and the repository holds no samples. Hook and patch scanning is off by default and enabled with /hooks, dumps go to the current directory unless /dir is given, and the wiki calls looped full-system scans processor-intensive. The wiki warns that detected processes are not necessarily malicious and links PE-sieve's false-positive FAQ, so reports and dumps need review; the optional /suspend and /kill responses act on live processes.",
    "AppVeyor runs ctest after each build: the tests check that the executable starts and that scans of the clean build machine report zero suspicious processes, then run IAT, hook, thread and shellcode-pattern scans that only check the report format. The only GitHub workflow publishes Doxygen code documentation.",
    "BSD-2-Clause, like PE-sieve; krabsetw is MIT, and the pinned paramkit commit has no license file."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v0.4.1.1，发布于 2025-09-13，提供 32 位和 64 位可执行文件、ZIP 压缩包以及 DLL 构建压缩包；README 还指向 Chocolatey 软件包，wiki 则提到不稳定的 AppVeyor 测试构建。所审阅的 master 提交标为尚未发布的 0.4.1.3，比该版本多 37 个提交，主要是 PE-sieve 子模块更新。",
    "仅支持 Windows。从源码构建需递归克隆固定版本的 PE-sieve、paramkit 和 Microsoft krabsetw 子模块，并需要 CMake 3.12+；AppVeyor 使用 Visual Studio 2019 构建 x86 和 x64 版本，mingw_build.sh 展示了 MinGW-w64 交叉编译。ETW 模式仅适用于 64 位版本，需以管理员身份运行，并在当前目录写入 HH_ETWProfile.ini。",
    "它扫描的是分析者自己系统或虚拟机中正在运行的进程，仓库中不含任何样本。钩子与补丁扫描默认关闭，需用 /hooks 启用；未指定 /dir 时转储写入当前目录；wiki 指出循环扫描全系统会占用大量处理器资源。wiki 提醒检测到的进程不一定是恶意的，并链接 PE-sieve 关于误报的 FAQ，因此报告和转储需人工复核；可选的 /suspend 与 /kill 会直接作用于正在运行的进程。",
    "AppVeyor 在每次构建后运行 ctest：测试检查可执行文件能否启动，以及在干净的构建机上扫描时可疑进程数是否为零，随后执行 IAT、钩子、线程和 shellcode 模式扫描，但只检查报告格式。唯一的 GitHub 工作流用于发布 Doxygen 代码文档。",
    "与 PE-sieve 一样采用 BSD-2-Clause；krabsetw 采用 MIT，固定版本的 paramkit 提交没有许可证文件。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/hasherezade/hollows_hunter",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}