![]() |
HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include "hh_scanner.h"#include <iostream>#include <fstream>#include <sstream>#include <iomanip>#include <codecvt>#include <locale>#include <time.h>#include <tlhelp32.h>#include "util/suspend.h"#include "util/time_util.h"#include "term_util.h"#include "util/process_util.h"#include <paramkit.h>#include <mutex>Go to the source code of this file.
Namespaces | |
| namespace | files_util |
| namespace | util |
Macros | |
| #define | PID_FIELD_SIZE 8 |
Functions | |
| std::string | files_util::join_path (const std::string &baseDir, const std::string &subpath) |
| std::string | files_util::make_dir_name (const std::string &baseDir, time_t timestamp) |
| bool | files_util::set_output_dir (t_params &args, const std::string &new_dir) |
| bool | files_util::write_to_file (const std::string &report_path, const std::wstring &summary_str, const bool append) |
| bool | util::is_searched_name (const WCHAR *processName, const std::set< std::wstring > &names_list) |
| bool | util::is_searched_pid (long pid, const std::set< long > &pids_list) |
| template<typename TYPE_T> | |
| std::string | util::list_to_str (const std::set< TYPE_T > &list) |
| #define PID_FIELD_SIZE 8 |
Definition at line 20 of file hh_scanner.cpp.