HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
etw_settings.h
Go to the documentation of this file.
1
#pragma once
2
3
#include <iostream>
4
5
struct
ETWProfile
{
6
public
:
7
bool
process_start
;
8
bool
img_load
;
9
bool
allocation
;
10
bool
tcpip
;
11
bool
obj_mgr
;
12
13
ETWProfile
(
bool
_process_start =
false
,
bool
_img_load =
false
,
bool
_allocation =
false
,
bool
_tcpip =
false
,
bool
_obj_mgr =
false
)
14
:
process_start
(_process_start),
img_load
(_img_load),
allocation
(_allocation),
tcpip
(_tcpip),
obj_mgr
(_obj_mgr)
15
{
16
}
17
18
bool
initProfile
(
const
std::string& fileName)
19
{
20
bool
isOk =
loadIni
(fileName);
21
if
(!isOk) {
22
setAll
();
23
isOk =
saveIni
(fileName);
24
}
25
return
isOk;
26
}
27
28
bool
loadIni
(
const
std::string& fileName);
29
bool
saveIni
(
const
std::string& fileName);
30
31
void
setAll
()
32
{
33
this->process_start =
true
;
34
this->img_load =
true
;
35
this->allocation =
true
;
36
this->tcpip =
true
;
37
this->obj_mgr =
true
;
38
}
39
40
bool
isEnabled
()
41
{
42
if
(this->process_start
43
|| this->img_load
44
|| this->allocation
45
|| this->tcpip
46
|| this->obj_mgr
47
)
48
{
49
return
true
;
50
}
51
return
false
;
52
}
53
54
protected
:
55
static
const
char
DELIM
;
56
57
bool
fillSettings
(std::string line);
58
void
stripComments
(std::string& str);
59
};
ETWProfile
Definition
etw_settings.h:5
ETWProfile::isEnabled
bool isEnabled()
Definition
etw_settings.h:40
ETWProfile::obj_mgr
bool obj_mgr
Definition
etw_settings.h:11
ETWProfile::allocation
bool allocation
Definition
etw_settings.h:9
ETWProfile::stripComments
void stripComments(std::string &str)
Definition
etw_settings.cpp:93
ETWProfile::loadIni
bool loadIni(const std::string &fileName)
Definition
etw_settings.cpp:140
ETWProfile::ETWProfile
ETWProfile(bool _process_start=false, bool _img_load=false, bool _allocation=false, bool _tcpip=false, bool _obj_mgr=false)
Definition
etw_settings.h:13
ETWProfile::DELIM
static const char DELIM
Definition
etw_settings.h:55
ETWProfile::tcpip
bool tcpip
Definition
etw_settings.h:10
ETWProfile::setAll
void setAll()
Definition
etw_settings.h:31
ETWProfile::process_start
bool process_start
Definition
etw_settings.h:7
ETWProfile::fillSettings
bool fillSettings(std::string line)
Definition
etw_settings.cpp:101
ETWProfile::initProfile
bool initProfile(const std::string &fileName)
Definition
etw_settings.h:18
ETWProfile::img_load
bool img_load
Definition
etw_settings.h:8
ETWProfile::saveIni
bool saveIni(const std::string &fileName)
Definition
etw_settings.cpp:163
Generated by
1.12.0