diff --git a/README.md b/README.md index ccbde5d..d1635e0 100644 --- a/README.md +++ b/README.md @@ -1089,6 +1089,10 @@ My curated list of awesome links, resources and tools hasherezade/libpeconv/runpe RunPE (aka Process Hollowing) is a well known technique allowing to injecting a new PE into a remote processes, imprersonating this process. The given implementation works for PE 32bit as well as 64bit. + + hasherezade/pe-sieve + Scans a given process, searching for the modules containing in-memory code modifications. When found, it dumps the modified PE. + hegusung/AVSignSeek Tool written in python3 to determine where the AV signature is located in a binary/payload