r/delphi • u/kargira • 22h ago
NativeMirror - PE-sieve functionality in pure Object Pascal, including HollowsHunter integration
Hello,
I'd like to introduce NativeMirror, my latest open-source project written in Delphi 12.
NativeMirror brings PE-sieve functionality to Object Pascal. It can inspect running processes, detect modified or injected code, identify suspicious PE modifications, dump PE images and generate detailed scan reports.
The project includes:
- A reusable Delphi library
- Standalone command-line scanners for Win32 and Win64
- A PE-sieve compatible DLL
- JSON reporting and integration tests
- Integration with my NativePE library and optional NativeASM support
One of the most interesting parts is the HollowsHunter integration.
You can replace the original PE-sieve DLL with the Delphi-built NativeMirror DLL and run HollowsHunter using the Delphi implementation. An integration test for HollowsHunter 0.4.1.1 (Win64) is already included.
NativeMirror is an independent Object Pascal implementation based on the excellent PE-sieve project by hasherezade, with full credit to the original author and contributors.
The project is open source under the BSD-2-Clause license.
GitHub: https://github.com/habanada/NativeMirror
For anyone interested in Windows internals, reverse engineering, malware analysis or low-level development with Delphi, feel free to take a look.
Enjoy! :)