Home
Start by reading the FAQ - Frequently Asked Questions
- FAQ
- How to build
- Default features
-
Additional features
- Create a process reflection before the full scan (
/refl) - Ignore modules (
/mignore) - Scan non executable memory (
/data) - Detect IAT Hooks (
/iat) - Detect obfuscated/encrypted areas (
/obfusc) - Detect shellcodes by (hardcoded) patterns, and statistics (
/shellc) - Detect shellcode by custom patterns (
/pattern) - Detect shellcode by scanning threads' callstack (
/threads) - Import table reconstruction (
/imp) - Create a MiniDump of the full process (
/minidmp) - Change dump mode (
/dmode) - Rebase the dump to the default base (
/rebase)
- Create a process reflection before the full scan (
- API
- Docs 📚
- Videos 🎬
- References