hh_params.h

Go to the documentation of this file.

#pragma once
 
#include <pe_sieve_api.h>
#include <string>
#include <set>
 
#define TIME_UNDEFINED LONGLONG(-1)
#define HH_DEFAULT_DIR "hollows_hunter.dumps"
 
 
typedef enum {
    CACHE_DISABLED = 0,  
    CACHE_AUTO,          
    CACHE_ENABLED,       
    CACHE_MODES_COUNT
} t_cache_mode;
 
typedef enum {
    PROCESS_ALL = 0,
    PROCESS_32BIT = 1,
    PROCESS_64BIT = 2,
    PROCESS_TYPES_COUNT
} t_process_type;
 
//HollowsHunter's parameters:
typedef struct hh_params
{
public:
    std::string out_dir;
    bool unique_dir;
    bool loop_scanning;
    bool etw_scan;
    bool suspend_suspicious;
    bool kill_suspicious;
    bool quiet;
    bool log;
    bool json_output;
    LONGLONG ptimes;
    t_cache_mode cache_mode;
    std::set<std::wstring> names_list;
    std::set<long> pids_list;
    std::set<std::wstring> ignored_names_list;
    t_process_type process_arch;
    pesieve::t_params pesieve_args; //PE-sieve parameters
 
    void init();
    hh_params& operator=(const hh_params& other);
 
} t_hh_params;