HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
params.h File Reference
#include <sstream>
#include <codecvt>
#include <locale>
#include <pe_sieve_types.h>
#include <paramkit.h>
#include "pe_sieve_params_info.h"
#include "../term_util.h"

Go to the source code of this file.

Classes

class  HHParams
 

Macros

#define HH_URL   "https://github.com/hasherezade/hollows_hunter"
 
#define PARAM_IAT   "iat"
 
#define PARAM_HOOKS   "hooks"
 
#define PARAM_SHELLCODE   "shellc"
 
#define PARAM_OBFUSCATED   "obfusc"
 
#define PARAM_THREADS   "threads"
 
#define PARAM_DATA   "data"
 
#define PARAM_MODULES_IGNORE   "mignore"
 
#define PARAM_PROCESSES_IGNORE   "pignore"
 
#define PARAM_PNAME   "pname"
 
#define PARAM_PID   "pid"
 
#define PARAM_LOOP   "loop"
 
#define PARAM_ETW   "etw"
 
#define PARAM_REFLECTION   "refl"
 
#define PARAM_CACHE   "cache"
 
#define PARAM_DOTNET_POLICY   "dnet"
 
#define PARAM_PTIMES   "ptimes"
 
#define PARAM_IMP_REC   "imp"
 
#define PARAM_DUMP_MODE   "dmode"
 
#define PARAM_REBASE   "rebase"
 
#define PARAM_QUIET   "quiet"
 
#define PARAM_OUT_FILTER   "ofilter"
 
#define PARAM_RESULTS_FILTER   "report"
 
#define PARAM_SUSPEND   "suspend"
 
#define PARAM_KILL   "kill"
 
#define PARAM_UNIQUE_DIR   "uniqd"
 
#define PARAM_DIR   "dir"
 
#define PARAM_PATTERN   "pattern"
 
#define PARAM_MINIDUMP   "minidmp"
 
#define PARAM_LOG   "log"
 
#define PARAM_JSON   "json"
 
#define PARAM_JSON_LVL   "jlvl"
 

Functions

std::string version_to_str (DWORD version)
 
void print_version (const std::string &version, WORD info_color=HILIGHTED_COLOR)
 
std::wstring to_wstring (const std::string &stringToConvert)
 
std::string cache_mode_to_id (const t_cache_mode mode)
 
std::string translate_cache_mode (const t_cache_mode mode)
 

Macro Definition Documentation

◆ HH_URL

#define HH_URL   "https://github.com/hasherezade/hollows_hunter"

Definition at line 15 of file params.h.

◆ PARAM_CACHE

#define PARAM_CACHE   "cache"

Definition at line 31 of file params.h.

◆ PARAM_DATA

#define PARAM_DATA   "data"

Definition at line 23 of file params.h.

◆ PARAM_DIR

#define PARAM_DIR   "dir"

Definition at line 47 of file params.h.

◆ PARAM_DOTNET_POLICY

#define PARAM_DOTNET_POLICY   "dnet"

Definition at line 32 of file params.h.

◆ PARAM_DUMP_MODE

#define PARAM_DUMP_MODE   "dmode"

Definition at line 37 of file params.h.

◆ PARAM_ETW

#define PARAM_ETW   "etw"

Definition at line 29 of file params.h.

◆ PARAM_HOOKS

#define PARAM_HOOKS   "hooks"

Definition at line 19 of file params.h.

◆ PARAM_IAT

#define PARAM_IAT   "iat"

Definition at line 18 of file params.h.

◆ PARAM_IMP_REC

#define PARAM_IMP_REC   "imp"

Definition at line 36 of file params.h.

◆ PARAM_JSON

#define PARAM_JSON   "json"

Definition at line 51 of file params.h.

◆ PARAM_JSON_LVL

#define PARAM_JSON_LVL   "jlvl"

Definition at line 52 of file params.h.

◆ PARAM_KILL

#define PARAM_KILL   "kill"

Definition at line 45 of file params.h.

◆ PARAM_LOG

#define PARAM_LOG   "log"

Definition at line 50 of file params.h.

◆ PARAM_LOOP

#define PARAM_LOOP   "loop"

Definition at line 28 of file params.h.

◆ PARAM_MINIDUMP

#define PARAM_MINIDUMP   "minidmp"

Definition at line 49 of file params.h.

◆ PARAM_MODULES_IGNORE

#define PARAM_MODULES_IGNORE   "mignore"

Definition at line 24 of file params.h.

◆ PARAM_OBFUSCATED

#define PARAM_OBFUSCATED   "obfusc"

Definition at line 21 of file params.h.

◆ PARAM_OUT_FILTER

#define PARAM_OUT_FILTER   "ofilter"

Definition at line 42 of file params.h.

◆ PARAM_PATTERN

#define PARAM_PATTERN   "pattern"

Definition at line 48 of file params.h.

◆ PARAM_PID

#define PARAM_PID   "pid"

Definition at line 27 of file params.h.

◆ PARAM_PNAME

#define PARAM_PNAME   "pname"

Definition at line 26 of file params.h.

◆ PARAM_PROCESSES_IGNORE

#define PARAM_PROCESSES_IGNORE   "pignore"

Definition at line 25 of file params.h.

◆ PARAM_PTIMES

#define PARAM_PTIMES   "ptimes"

Definition at line 33 of file params.h.

◆ PARAM_QUIET

#define PARAM_QUIET   "quiet"

Definition at line 41 of file params.h.

◆ PARAM_REBASE

#define PARAM_REBASE   "rebase"

Definition at line 38 of file params.h.

◆ PARAM_REFLECTION

#define PARAM_REFLECTION   "refl"

Definition at line 30 of file params.h.

◆ PARAM_RESULTS_FILTER

#define PARAM_RESULTS_FILTER   "report"

Definition at line 43 of file params.h.

◆ PARAM_SHELLCODE

#define PARAM_SHELLCODE   "shellc"

Definition at line 20 of file params.h.

◆ PARAM_SUSPEND

#define PARAM_SUSPEND   "suspend"

Definition at line 44 of file params.h.

◆ PARAM_THREADS

#define PARAM_THREADS   "threads"

Definition at line 22 of file params.h.

◆ PARAM_UNIQUE_DIR

#define PARAM_UNIQUE_DIR   "uniqd"

Definition at line 46 of file params.h.

Function Documentation

◆ cache_mode_to_id()

std::string cache_mode_to_id ( const t_cache_mode mode)

Definition at line 91 of file params.h.

◆ print_version()

void print_version ( const std::string & version,
WORD info_color = HILIGHTED_COLOR )

Definition at line 68 of file params.h.

Here is the call graph for this function:

◆ to_wstring()

std::wstring to_wstring ( const std::string & stringToConvert)

Definition at line 84 of file params.h.

◆ translate_cache_mode()

std::string translate_cache_mode ( const t_cache_mode mode)

Definition at line 104 of file params.h.

◆ version_to_str()

std::string version_to_str ( DWORD version)

Definition at line 55 of file params.h.