HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include "hh_scanner.h"
#include <iostream>
#include <fstream>
#include <sstream>
#include <iomanip>
#include <codecvt>
#include <locale>
#include <time.h>
#include <tlhelp32.h>
#include "util/suspend.h"
#include "util/time_util.h"
#include "term_util.h"
#include "util/process_util.h"
#include <paramkit.h>
#include <mutex>
Go to the source code of this file.
Namespaces | |
namespace | files_util |
namespace | util |
Macros | |
#define | PID_FIELD_SIZE 8 |
Functions | |
std::string | files_util::join_path (const std::string &baseDir, const std::string &subpath) |
std::string | files_util::make_dir_name (const std::string &baseDir, time_t timestamp) |
bool | files_util::set_output_dir (t_params &args, const std::string &new_dir) |
bool | files_util::write_to_file (const std::string &report_path, const std::wstring &summary_str, const bool append) |
bool | util::is_searched_name (const WCHAR *processName, const std::set< std::wstring > &names_list) |
bool | util::is_searched_pid (long pid, const std::set< long > &pids_list) |
template<typename TYPE_T > | |
std::string | util::list_to_str (const std::set< TYPE_T > &list) |
#define PID_FIELD_SIZE 8 |
Definition at line 20 of file hh_scanner.cpp.