HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
hh_params.cpp
Go to the documentation of this file.
1
#include "
hh_params.h
"
2
3
void
hh_params::init
()
4
{
5
//reset PE-sieve params:
6
memset(&
pesieve_args
, 0,
sizeof
(pesieve::t_params));
7
8
//reset output path:
9
out_dir
=
HH_DEFAULT_DIR
;
10
cache_mode
=
CACHE_AUTO
;
11
pesieve_args
.quiet =
true
;
12
pesieve_args
.no_hooks =
true
;
13
pesieve_args
.results_filter = pesieve::SHOW_SUSPICIOUS;
14
15
suspend_suspicious
=
false
;
16
kill_suspicious
=
false
;
17
loop_scanning
=
false
;
18
etw_scan
=
false
;
19
unique_dir
=
false
;
20
21
quiet
=
false
;
22
log
=
false
;
23
json_output
=
false
;
24
ptimes
=
TIME_UNDEFINED
;
25
}
26
27
hh_params
&
hh_params::operator=
(
const
hh_params
& other)
28
{
29
//copy PE-sieve params:
30
::memcpy(&
pesieve_args
, &other.
pesieve_args
,
sizeof
(pesieve::t_params));
31
32
// copy HHParams
33
this->
out_dir
= other.
out_dir
;
34
35
this->
suspend_suspicious
= other.
suspend_suspicious
;
36
this->
kill_suspicious
= other.
kill_suspicious
;
37
this->
loop_scanning
= other.
loop_scanning
;
38
this->
etw_scan
= other.
etw_scan
;
39
this->
unique_dir
= other.
unique_dir
;
40
41
this->
quiet
= other.
quiet
;
42
this->
log
= other.
log
;
43
this->
json_output
= other.
json_output
;
44
this->
ptimes
= other.
ptimes
;
45
46
// copy lists:
47
this->
names_list
= other.
names_list
;
48
this->
pids_list
= other.
pids_list
;
49
this->
ignored_names_list
= other.
ignored_names_list
;
50
51
return
*
this
;
52
}
hh_params.h
HH_DEFAULT_DIR
#define HH_DEFAULT_DIR
Definition
hh_params.h:8
TIME_UNDEFINED
#define TIME_UNDEFINED
Definition
hh_params.h:7
CACHE_AUTO
@ CACHE_AUTO
autodetect if cache should be enabled
Definition
hh_params.h:13
hh_params
Definition
hh_params.h:20
hh_params::operator=
hh_params & operator=(const hh_params &other)
Definition
hh_params.cpp:27
hh_params::init
void init()
Definition
hh_params.cpp:3
hh_params::pids_list
std::set< long > pids_list
Definition
hh_params.h:34
hh_params::log
bool log
Definition
hh_params.h:29
hh_params::json_output
bool json_output
Definition
hh_params.h:30
hh_params::kill_suspicious
bool kill_suspicious
Definition
hh_params.h:27
hh_params::ignored_names_list
std::set< std::wstring > ignored_names_list
Definition
hh_params.h:35
hh_params::pesieve_args
pesieve::t_params pesieve_args
Definition
hh_params.h:36
hh_params::out_dir
std::string out_dir
Definition
hh_params.h:22
hh_params::etw_scan
bool etw_scan
Definition
hh_params.h:25
hh_params::quiet
bool quiet
Definition
hh_params.h:28
hh_params::names_list
std::set< std::wstring > names_list
Definition
hh_params.h:33
hh_params::cache_mode
t_cache_mode cache_mode
Definition
hh_params.h:32
hh_params::loop_scanning
bool loop_scanning
Definition
hh_params.h:24
hh_params::suspend_suspicious
bool suspend_suspicious
Definition
hh_params.h:26
hh_params::unique_dir
bool unique_dir
Definition
hh_params.h:23
hh_params::ptimes
LONGLONG ptimes
Definition
hh_params.h:31
Generated by
1.12.0