HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
hh_params.cpp
Go to the documentation of this file.
1#include "hh_params.h"
2
4{
5 //reset PE-sieve params:
6 memset(&pesieve_args, 0, sizeof(pesieve::t_params));
7
8 //reset output path:
11 pesieve_args.quiet = true;
12 pesieve_args.no_hooks = true;
13 pesieve_args.results_filter = pesieve::SHOW_SUSPICIOUS;
14
15 suspend_suspicious = false;
16 kill_suspicious = false;
17 loop_scanning = false;
18 etw_scan = false;
19 unique_dir = false;
20
21 quiet = false;
22 log = false;
23 json_output = false;
25}
26
28{
29 //copy PE-sieve params:
30 ::memcpy(&pesieve_args, &other.pesieve_args, sizeof(pesieve::t_params));
31
32 // copy HHParams
33 this->out_dir = other.out_dir;
34
36 this->kill_suspicious = other.kill_suspicious;
37 this->loop_scanning = other.loop_scanning;
38 this->etw_scan = other.etw_scan;
39 this->unique_dir = other.unique_dir;
40
41 this->quiet = other.quiet;
42 this->log = other.log;
43 this->json_output = other.json_output;
44 this->ptimes = other.ptimes;
45
46 // copy lists:
47 this->names_list = other.names_list;
48 this->pids_list = other.pids_list;
50
51 return *this;
52}
#define HH_DEFAULT_DIR
Definition hh_params.h:8
#define TIME_UNDEFINED
Definition hh_params.h:7
@ CACHE_AUTO
autodetect if cache should be enabled
Definition hh_params.h:13
hh_params & operator=(const hh_params &other)
Definition hh_params.cpp:27
void init()
Definition hh_params.cpp:3
std::set< long > pids_list
Definition hh_params.h:34
bool log
Definition hh_params.h:29
bool json_output
Definition hh_params.h:30
bool kill_suspicious
Definition hh_params.h:27
std::set< std::wstring > ignored_names_list
Definition hh_params.h:35
pesieve::t_params pesieve_args
Definition hh_params.h:36
std::string out_dir
Definition hh_params.h:22
bool etw_scan
Definition hh_params.h:25
bool quiet
Definition hh_params.h:28
std::set< std::wstring > names_list
Definition hh_params.h:33
t_cache_mode cache_mode
Definition hh_params.h:32
bool loop_scanning
Definition hh_params.h:24
bool suspend_suspicious
Definition hh_params.h:26
bool unique_dir
Definition hh_params.h:23
LONGLONG ptimes
Definition hh_params.h:31