HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
HHScanner Class Reference

#include <hh_scanner.h>

Public Member Functions

 HHScanner (t_hh_params &_args, time_t _initTime=0)
 
HHScanReportscan ()
 
bool writeToLog (HHScanReport *hh_report)
 
void summarizeScan (HHScanReport *hh_report, const pesieve::t_results_filter rfilter)
 

Static Public Member Functions

static bool isScannerCompatibile ()
 
static t_single_scan_status shouldScanProcess (const hh_params &hh_args, const time_t hh_initTime, const DWORD pid, const WCHAR *exe_file)
 

Protected Member Functions

void printScanRoundStats (size_t found, size_t ignored_count, size_t not_matched_count)
 
size_t scanProcesses (HHScanReport &my_report)
 
void printSingleReport (pesieve::t_report &report)
 
t_single_scan_status scanNextProcess (DWORD pid, WCHAR *image_buf, HHScanReport &report)
 
void initOutDir (time_t scan_time, pesieve::t_params &pesieve_args)
 

Protected Attributes

t_hh_paramshh_args
 
std::string outDir
 
time_t initTime
 
bool isScannerWow64
 

Detailed Description

Definition at line 24 of file hh_scanner.h.

Constructor & Destructor Documentation

◆ HHScanner()

HHScanner::HHScanner ( t_hh_params & _args,
time_t _initTime = 0 )

Definition at line 122 of file hh_scanner.cpp.

Here is the call graph for this function:

Member Function Documentation

◆ initOutDir()

void HHScanner::initOutDir ( time_t scan_time,
pesieve::t_params & pesieve_args )
protected

Definition at line 141 of file hh_scanner.cpp.

Here is the call graph for this function:

◆ isScannerCompatibile()

bool HHScanner::isScannerCompatibile ( )
static

Definition at line 131 of file hh_scanner.cpp.

Here is the call graph for this function:

◆ printScanRoundStats()

void HHScanner::printScanRoundStats ( size_t found,
size_t ignored_count,
size_t not_matched_count )
protected

Definition at line 154 of file hh_scanner.cpp.

Here is the call graph for this function:

◆ printSingleReport()

void HHScanner::printSingleReport ( pesieve::t_report & report)
protected

Definition at line 229 of file hh_scanner.cpp.

Here is the call graph for this function:

◆ scan()

HHScanReport * HHScanner::scan ( )

Definition at line 335 of file hh_scanner.cpp.

Here is the call graph for this function:

◆ scanNextProcess()

t_single_scan_status HHScanner::scanNextProcess ( DWORD pid,
WCHAR * image_buf,
HHScanReport & report )
protected

Definition at line 303 of file hh_scanner.cpp.

Here is the call graph for this function:

◆ scanProcesses()

size_t HHScanner::scanProcesses ( HHScanReport & my_report)
protected

Definition at line 186 of file hh_scanner.cpp.

Here is the call graph for this function:

◆ shouldScanProcess()

t_single_scan_status HHScanner::shouldScanProcess ( const hh_params & hh_args,
const time_t hh_initTime,
const DWORD pid,
const WCHAR * exe_file )
static

Definition at line 271 of file hh_scanner.cpp.

Here is the call graph for this function:

◆ summarizeScan()

void HHScanner::summarizeScan ( HHScanReport * hh_report,
const pesieve::t_results_filter rfilter )

Definition at line 362 of file hh_scanner.cpp.

Here is the call graph for this function:

◆ writeToLog()

bool HHScanner::writeToLog ( HHScanReport * hh_report)

Definition at line 348 of file hh_scanner.cpp.

Here is the call graph for this function:

Member Data Documentation

◆ hh_args

t_hh_params& HHScanner::hh_args
protected

Definition at line 44 of file hh_scanner.h.

◆ initTime

time_t HHScanner::initTime
protected

Definition at line 48 of file hh_scanner.h.

◆ isScannerWow64

bool HHScanner::isScannerWow64
protected

Definition at line 49 of file hh_scanner.h.

◆ outDir

std::string HHScanner::outDir
protected

Definition at line 45 of file hh_scanner.h.


The documentation for this class was generated from the following files: