pandaadir05 449cfe9708 Enhance process hollowing detection with deep PE comparison ...

Added comprehensive section-by-section PE comparison that reads the
executable from disk, parses PE sections, and compares them against
memory using SHA-256 hashing. Detects:

- Modified code sections (>5% difference from disk)
- Missing PE sections in memory
- Section hash mismatches

This catches sophisticated hollowing techniques that modify specific
code sections while preserving the PE header structure.

2025-11-21 01:08:49 +02:00

858 B

Raw Blame History

View Raw