PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Toggle main menu visibility
Loading...
Searching...
No Matches
utils
byte_buffer.h
Go to the documentation of this file.
1
#pragma once
2
#include <windows.h>
3
#include <peconv.h>
4
5
namespace
pesieve
{
6
7
namespace
util
{
8
9
struct
BasicBuffer
10
{
11
public
:
12
BasicBuffer
()
13
:
data
(nullptr),
data_size
(0),
14
real_start
(0),
real_end
(0),
padding
(0)
15
{
16
}
17
18
bool
isFilled
()
19
{
20
if
(
data
) {
21
return
true
;
// already filled
22
}
23
return
false
;
24
}
25
26
void
trim
()
27
{
28
if
(!
data
)
return
;
29
30
real_start
= 0;
31
real_end
= 0;
32
padding
= 0;
33
for
(
size_t
i = 0; i <
data_size
; i++,
padding
++) {
34
if
(
data
[i] != 0) {
35
real_start
= i;
36
break
;
37
}
38
}
39
40
for
(
size_t
i =
data_size
; i != 0; i--,
padding
++) {
41
if
(
data
[i - 1] != 0) {
42
real_end
= i;
43
break
;
44
}
45
}
46
}
47
48
size_t
getStartOffset
(
bool
trimmed)
const
49
{
50
if
(!trimmed)
return
0;
51
if
(!
data
||
real_start
>=
data_size
)
return
0;
52
return
real_start
;
53
}
54
55
size_t
getDataSize
(
bool
trimmed =
false
)
const
56
{
57
if
(!
data
|| !
data_size
)
return
0;
58
59
if
(trimmed && (
padding
<
data_size
)) {
60
return
data_size
-
padding
;
61
}
62
return
data_size
;
63
}
64
65
const
BYTE*
getData
(
bool
trimmed =
false
)
const
66
{
67
if
(!
data
|| !
data_size
)
return
nullptr
;
68
69
if
(trimmed && (
padding
<
data_size
)) {
70
return
(
data
+
real_start
);
71
}
72
return
data
;
73
}
74
75
BYTE*
data
;
76
77
protected
:
78
79
size_t
real_start
;
80
size_t
real_end
;
81
size_t
padding
;
82
83
size_t
data_size
;
84
};
85
86
//---
87
88
struct
ByteBuffer
:
public
BasicBuffer
89
{
90
ByteBuffer
()
91
:
BasicBuffer
()
92
{
93
}
94
95
// Copy constructor
96
ByteBuffer
(
const
ByteBuffer
& p1)
97
:
BasicBuffer
()
98
{
99
copy
(p1);
100
}
101
102
~ByteBuffer
()
103
{
104
freeBuffer
();
105
}
106
107
virtual
ByteBuffer
&
operator=
(
const
ByteBuffer
&p1) {
108
this->
copy
(p1);
109
return
*
this
;
110
}
111
112
bool
isValidPtr
(BYTE * field_bgn,
size_t
field_size)
113
{
114
return
peconv::validate_ptr(this->
data
, this->
data_size
, field_bgn, field_size);
115
}
116
117
bool
isDataContained
(
const
BYTE* rawData,
size_t
r_size)
118
{
119
size_t
smaller_size =
data_size
> r_size ? r_size :
data_size
;
120
if
(::memcmp(
data
, rawData, smaller_size) == 0) {
121
return
true
;
122
}
123
return
false
;
124
}
125
126
bool
allocBuffer
(
size_t
size)
127
{
128
freeBuffer
();
129
data
= peconv::alloc_aligned(size, PAGE_READWRITE);
130
if
(
data
==
nullptr
) {
131
return
false
;
132
}
133
data_size
= size;
134
padding
= 0;
135
return
true
;
136
}
137
138
void
freeBuffer
()
139
{
140
if
(!
data
) {
141
data_size
= 0;
142
padding
= 0;
143
return
;
144
}
145
peconv::free_aligned(
data
,
data_size
);
146
data
=
nullptr
;
147
data_size
= 0;
148
padding
= 0;
149
}
150
151
protected
:
152
153
bool
copy
(
const
ByteBuffer
& p1)
154
{
155
if
(!
allocBuffer
(p1.
data_size
)) {
156
return
false
;
157
}
158
::memcpy(this->
data
, p1.
data
, this->data_size);
159
this->
real_start
= p1.
real_start
;
160
this->
real_end
= p1.
real_end
;
161
this->
padding
= p1.
padding
;
162
return
true
;
163
}
164
165
};
166
167
};
// namespace util
168
169
};
// namespace pesieve
170
pesieve::util
Definition
artefact_scanner.cpp:12
pesieve
Definition
pesieve.py:1
pesieve::util::BasicBuffer::trim
void trim()
Definition
byte_buffer.h:26
pesieve::util::BasicBuffer::BasicBuffer
BasicBuffer()
Definition
byte_buffer.h:12
pesieve::util::BasicBuffer::getDataSize
size_t getDataSize(bool trimmed=false) const
Definition
byte_buffer.h:55
pesieve::util::BasicBuffer::isFilled
bool isFilled()
Definition
byte_buffer.h:18
pesieve::util::BasicBuffer::getData
const BYTE * getData(bool trimmed=false) const
Definition
byte_buffer.h:65
pesieve::util::BasicBuffer::data_size
size_t data_size
Definition
byte_buffer.h:83
pesieve::util::BasicBuffer::data
BYTE * data
Definition
byte_buffer.h:75
pesieve::util::BasicBuffer::real_start
size_t real_start
Definition
byte_buffer.h:79
pesieve::util::BasicBuffer::padding
size_t padding
Definition
byte_buffer.h:81
pesieve::util::BasicBuffer::getStartOffset
size_t getStartOffset(bool trimmed) const
Definition
byte_buffer.h:48
pesieve::util::BasicBuffer::real_end
size_t real_end
Definition
byte_buffer.h:80
pesieve::util::ByteBuffer::ByteBuffer
ByteBuffer(const ByteBuffer &p1)
Definition
byte_buffer.h:96
pesieve::util::ByteBuffer::ByteBuffer
ByteBuffer()
Definition
byte_buffer.h:90
pesieve::util::ByteBuffer::allocBuffer
bool allocBuffer(size_t size)
Definition
byte_buffer.h:126
pesieve::util::ByteBuffer::copy
bool copy(const ByteBuffer &p1)
Definition
byte_buffer.h:153
pesieve::util::ByteBuffer::isValidPtr
bool isValidPtr(BYTE *field_bgn, size_t field_size)
Definition
byte_buffer.h:112
pesieve::util::ByteBuffer::~ByteBuffer
~ByteBuffer()
Definition
byte_buffer.h:102
pesieve::util::ByteBuffer::freeBuffer
void freeBuffer()
Definition
byte_buffer.h:138
pesieve::util::ByteBuffer::operator=
virtual ByteBuffer & operator=(const ByteBuffer &p1)
Definition
byte_buffer.h:107
pesieve::util::ByteBuffer::isDataContained
bool isDataContained(const BYTE *rawData, size_t r_size)
Definition
byte_buffer.h:117
Generated by
1.17.0