4.1. Detect shellcodes (shellc)

Option: /shellc

By default, PE-sieve detects only implanted PE files (they don't need to be 100% valid PE, but they must follow some of the patterns typical for PE file).

Sometimes it is not enough, and we want to detect also a shellcode. This option allows to enable it. The memory regions where the shellcode was detected will be dumped with an .shc extension.