![]() |
HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include <sstream>#include <codecvt>#include <locale>#include <pe_sieve_types.h>#include <paramkit.h>#include "pe_sieve_params_info.h"#include "../term_util.h"Go to the source code of this file.
Classes | |
| class | HHParams |
Macros | |
| #define | HH_URL "https://github.com/hasherezade/hollows_hunter" |
| #define | PARAM_IAT "iat" |
| #define | PARAM_HOOKS "hooks" |
| #define | PARAM_SHELLCODE "shellc" |
| #define | PARAM_OBFUSCATED "obfusc" |
| #define | PARAM_THREADS "threads" |
| #define | PARAM_DATA "data" |
| #define | PARAM_MODULES_IGNORE "mignore" |
| #define | PARAM_PROCESSES_IGNORE "pignore" |
| #define | PARAM_PNAME "pname" |
| #define | PARAM_PID "pid" |
| #define | PARAM_LOOP "loop" |
| #define | PARAM_ETW "etw" |
| #define | PARAM_REFLECTION "refl" |
| #define | PARAM_CACHE "cache" |
| #define | PARAM_DOTNET_POLICY "dnet" |
| #define | PARAM_SYMBOLS "sym" |
| #define | PARAM_PTIMES "ptimes" |
| #define | PARAM_ARCH "arch" |
| #define | PARAM_IMP_REC "imp" |
| #define | PARAM_DUMP_MODE "dmode" |
| #define | PARAM_REBASE "rebase" |
| #define | PARAM_QUIET "quiet" |
| #define | PARAM_OUT_FILTER "ofilter" |
| #define | PARAM_RESULTS_FILTER "report" |
| #define | PARAM_SUSPEND "suspend" |
| #define | PARAM_KILL "kill" |
| #define | PARAM_UNIQUE_DIR "uniqd" |
| #define | PARAM_DIR "dir" |
| #define | PARAM_PATTERN "pattern" |
| #define | PARAM_MINIDUMP "minidmp" |
| #define | PARAM_LOG "log" |
| #define | PARAM_JSON "json" |
| #define | PARAM_JSON_LVL "jlvl" |
Functions | |
| std::string | version_to_str (DWORD version) |
| void | print_version (const std::string &version, WORD info_color=HILIGHTED_COLOR) |
| std::wstring | to_wstring (const std::string &stringToConvert) |
| std::string | cache_mode_to_id (const t_cache_mode mode) |
| std::string | translate_cache_mode (const t_cache_mode mode) |
| #define HH_URL "https://github.com/hasherezade/hollows_hunter" |
| std::string cache_mode_to_id | ( | const t_cache_mode | mode | ) |
| void print_version | ( | const std::string & | version, |
| WORD | info_color = HILIGHTED_COLOR ) |
| std::wstring to_wstring | ( | const std::string & | stringToConvert | ) |
| std::string translate_cache_mode | ( | const t_cache_mode | mode | ) |