HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
process_util.h File Reference
#include <windows.h>
#include <psapi.h>
#include <iostream>
#include "suspend.h"

Go to the source code of this file.

Namespaces

namespace  process_util
 

Functions

bool process_util::is_wow_64 (HANDLE process)
 
bool process_util::is_wow_64_by_pid (DWORD processID)
 
bool process_util::get_process_path (DWORD processID, WCHAR *szProcessName, size_t processNameSize)
 
size_t process_util::suspend_suspicious (std::vector< DWORD > &suspicious_pids)
 
size_t process_util::kill_suspicious (std::vector< DWORD > &suspicious_pids)