![]() |
HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
Classes | |
| struct | AutoBuffer |
Functions | |
| std::string | trim (std::string &s) |
| bool | iequals (const std::string &a, const std::string &b) |
| size_t | splitList (const std::string &sline, const char delimiter, std::vector< std::string > &args) |
| int | loadInt (const std::string &str, bool as_hex=false) |
| bool | loadBoolean (const std::string &str, bool defaultVal) |
| std::string | booleanToStr (bool val) |
| bool | is_searched_name (const WCHAR *processName, const std::set< std::wstring > &names_list) |
| bool | is_searched_pid (long pid, const std::set< long > &pids_list) |
| template<typename TYPE_T> | |
| std::string | list_to_str (const std::set< TYPE_T > &list) |
| std::wstring | strtime (const time_t t) |
| LONGLONG | LargeTime_to_POSIX (LARGE_INTEGER date) |
| LONGLONG | FileTime_to_POSIX (FILETIME ft) |
| LONGLONG | process_start_time (IN DWORD processID) |
Variables | |
| std::string | WHITESPACES = " \t\n\v\f\r" |
| std::string util::booleanToStr | ( | bool | val | ) |
Definition at line 87 of file etw_settings.cpp.
| LONGLONG util::FileTime_to_POSIX | ( | FILETIME | ft | ) |
| bool util::iequals | ( | const std::string & | a, |
| const std::string & | b ) |
Definition at line 41 of file etw_settings.cpp.
| bool util::is_searched_name | ( | const WCHAR * | processName, |
| const std::set< std::wstring > & | names_list ) |
Definition at line 83 of file hh_scanner.cpp.
| bool util::is_searched_pid | ( | long | pid, |
| const std::set< long > & | pids_list ) |
Definition at line 94 of file hh_scanner.cpp.
| LONGLONG util::LargeTime_to_POSIX | ( | LARGE_INTEGER | date | ) |
Definition at line 28 of file time_util.cpp.
| std::string util::list_to_str | ( | const std::set< TYPE_T > & | list | ) |
Definition at line 104 of file hh_scanner.cpp.
| bool util::loadBoolean | ( | const std::string & | str, |
| bool | defaultVal ) |
| int util::loadInt | ( | const std::string & | str, |
| bool | as_hex = false ) |
Definition at line 63 of file etw_settings.cpp.
| LONGLONG util::process_start_time | ( | IN DWORD | processID | ) |
| size_t util::splitList | ( | const std::string & | sline, |
| const char | delimiter, | ||
| std::vector< std::string > & | args ) |
Definition at line 52 of file etw_settings.cpp.
| std::wstring util::strtime | ( | const time_t | t | ) |
Definition at line 15 of file time_util.cpp.
| std::string util::trim | ( | std::string & | s | ) |
Definition at line 34 of file etw_settings.cpp.
| std::string util::WHITESPACES = " \t\n\v\f\r" |
Definition at line 16 of file etw_settings.cpp.