artefact_scanner.cpp File Reference

#include "artefact_scanner.h"
#include "../utils/artefacts_util.h"
#include "../utils/workingset_enum.h"
#include <peconv.h>

Go to the source code of this file.

Namespaces
namespace	pesieve
namespace	pesieve::util

Functions
size_t	pesieve::util::calc_offset (MemPageData &memPage, LPVOID field)
size_t	pesieve::util::calc_sec_hdrs_offset (MemPageData &memPage, IMAGE_FILE_HEADER *nt_file_hdr)
size_t	pesieve::util::calc_nt_hdr_offset (MemPageData &memPage, IMAGE_SECTION_HEADER *first_sec, bool is64bit=true)
bool	pesieve::util::validate_hdrs_alignment (MemPageData &memPage, IMAGE_FILE_HEADER *nt_file_hdr, IMAGE_SECTION_HEADER *_sec_hdr)
size_t	pesieve::util::count_section_hdrs (BYTE *loadedData, size_t loadedSize, IMAGE_SECTION_HEADER *hdr_ptr)
IMAGE_SECTION_HEADER *	pesieve::util::get_first_section (BYTE *loadedData, size_t loadedSize, IMAGE_SECTION_HEADER *hdr_ptr)