![]() |
HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include <pe_sieve_api.h>#include <string>#include <set>Go to the source code of this file.
Classes | |
| struct | hh_params |
Macros | |
| #define | TIME_UNDEFINED LONGLONG(-1) |
| #define | HH_DEFAULT_DIR "hollows_hunter.dumps" |
Typedefs | |
| typedef struct hh_params | t_hh_params |
Enumerations | |
| enum | t_cache_mode { CACHE_DISABLED = 0 , CACHE_AUTO , CACHE_ENABLED , CACHE_MODES_COUNT } |
| #define HH_DEFAULT_DIR "hollows_hunter.dumps" |
Definition at line 8 of file hh_params.h.
| #define TIME_UNDEFINED LONGLONG(-1) |
Definition at line 7 of file hh_params.h.
| typedef struct hh_params t_hh_params |
| enum t_cache_mode |
| Enumerator | |
|---|---|
| CACHE_DISABLED | cache always disabled |
| CACHE_AUTO | autodetect if cache should be enabled |
| CACHE_ENABLED | cache always enabled |
| CACHE_MODES_COUNT | |
Definition at line 11 of file hh_params.h.