HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
etw_settings.h
Go to the documentation of this file.
1#pragma once
2
3#include <iostream>
4
5struct ETWProfile {
6public:
8 bool img_load;
10 bool tcpip;
11 bool obj_mgr;
12
13 ETWProfile(bool _process_start = false, bool _img_load = false, bool _allocation = false, bool _tcpip = false, bool _obj_mgr = false)
14 : process_start(_process_start), img_load(_img_load), allocation(_allocation), tcpip(_tcpip), obj_mgr(_obj_mgr)
15 {
16 }
17
18 bool initProfile(const std::string& fileName)
19 {
20 bool isOk = loadIni(fileName);
21 if (!isOk) {
22 setAll();
23 isOk = saveIni(fileName);
24 }
25 return isOk;
26 }
27
28 bool loadIni(const std::string& fileName);
29 bool saveIni(const std::string& fileName);
30
31 void setAll()
32 {
33 this->process_start = true;
34 this->img_load = true;
35 this->allocation = true;
36 this->tcpip = true;
37 this->obj_mgr = true;
38 }
39
40 bool isEnabled()
41 {
42 if (this->process_start
43 || this->img_load
44 || this->allocation
45 || this->tcpip
46 || this->obj_mgr
47 )
48 {
49 return true;
50 }
51 return false;
52 }
53
54protected:
55 static const char DELIM;
56
57 bool fillSettings(std::string line);
58 void stripComments(std::string& str);
59};
bool isEnabled()
bool allocation
Definition etw_settings.h:9
void stripComments(std::string &str)
bool loadIni(const std::string &fileName)
ETWProfile(bool _process_start=false, bool _img_load=false, bool _allocation=false, bool _tcpip=false, bool _obj_mgr=false)
static const char DELIM
void setAll()
bool process_start
Definition etw_settings.h:7
bool fillSettings(std::string line)
bool initProfile(const std::string &fileName)
bool img_load
Definition etw_settings.h:8
bool saveIni(const std::string &fileName)