HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
Enumerations | |
enum | stringsim_type { SIM_NONE = 0 , SIM_SUBSTR = 1 , SIM_LAV_DIST , SIM_HIST } |
Functions | |
BOOL | set_privilege (HANDLE hToken, LPCTSTR Privilege, BOOL bEnablePrivilege) |
bool | set_debug_privilege () |
std::string | to_lowercase (std::string) |
bool | is_cstr_equal (char const *a, char const *b, const size_t max_len) |
size_t | levenshtein_distance (const char s1[], const char s2[]) |
size_t | str_hist_diffrence (const char s1[], const char s2[]) |
stringsim_type | is_string_similar (const std::string ¶m, const std::string &filter) |
Enumerator | |
---|---|
SIM_NONE | |
SIM_SUBSTR | |
SIM_LAV_DIST | |
SIM_HIST |
Definition at line 9 of file strings_util.h.
bool hhunter::util::is_cstr_equal | ( | char const * | a, |
char const * | b, | ||
const size_t | max_len ) |
Definition at line 12 of file strings_util.cpp.
hhunter::util::stringsim_type hhunter::util::is_string_similar | ( | const std::string & | param, |
const std::string & | filter ) |
Definition at line 82 of file strings_util.cpp.
size_t hhunter::util::levenshtein_distance | ( | const char | s1[], |
const char | s2[] ) |
Definition at line 25 of file strings_util.cpp.
bool hhunter::util::set_debug_privilege | ( | ) |
BOOL hhunter::util::set_privilege | ( | HANDLE | hToken, |
LPCTSTR | Privilege, | ||
BOOL | bEnablePrivilege ) |
Definition at line 11 of file process_privilege.cpp.
size_t hhunter::util::str_hist_diffrence | ( | const char | s1[], |
const char | s2[] ) |
Definition at line 55 of file strings_util.cpp.
std::string hhunter::util::to_lowercase | ( | std::string | str | ) |
Definition at line 6 of file strings_util.cpp.