PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
byte_buffer.h
Go to the documentation of this file.
1#pragma once
2#include <windows.h>
3#include <peconv.h>
4
5namespace pesieve {
6
7 namespace util {
8
10 {
11 public:
13 : data(nullptr), data_size(0),
14 real_start(0), real_end(0), padding(0)
15 {
16 }
17
18 bool isFilled()
19 {
20 if (data) {
21 return true; // already filled
22 }
23 return false;
24 }
25
26 void trim()
27 {
28 if (!data) return;
29
30 real_start = 0;
31 real_end = 0;
32 padding = 0;
33 for (size_t i = 0; i < data_size; i++, padding++) {
34 if (data[i] != 0) {
35 real_start = i;
36 break;
37 }
38 }
39
40 for (size_t i = data_size; i != 0; i--, padding++) {
41 if (data[i - 1] != 0) {
42 real_end = i;
43 break;
44 }
45 }
46 }
47
48 size_t getStartOffset(bool trimmed) const
49 {
50 if (!trimmed) return 0;
51 if (!data || real_start >= data_size) return 0;
52 return real_start;
53 }
54
55 size_t getDataSize(bool trimmed = false) const
56 {
57 if (!data || !data_size) return 0;
58
59 if (trimmed && (padding < data_size)) {
60 return data_size - padding;
61 }
62 return data_size;
63 }
64
65 const BYTE* getData(bool trimmed = false) const
66 {
67 if (!data || !data_size) return nullptr;
68
69 if (trimmed && (padding < data_size)) {
70 return (data + real_start);
71 }
72 return data;
73 }
74
75 BYTE* data;
76
77 protected:
78
79 size_t real_start;
80 size_t real_end;
81 size_t padding;
82
83 size_t data_size;
84 };
85
86 //---
87
88 struct ByteBuffer : public BasicBuffer
89 {
91 : BasicBuffer()
92 {
93 }
94
95 // Copy constructor
97 : BasicBuffer()
98 {
99 copy(p1);
100 }
101
103 {
104 freeBuffer();
105 }
106
107 virtual ByteBuffer& operator=(const ByteBuffer&p1) {
108 this->copy(p1);
109 return *this;
110 }
111
112 bool isValidPtr(BYTE * field_bgn, size_t field_size)
113 {
114 return peconv::validate_ptr(this->data, this->data_size, field_bgn, field_size);
115 }
116
117 bool isDataContained(const BYTE* rawData, size_t r_size)
118 {
119 size_t smaller_size = data_size > r_size ? r_size : data_size;
120 if (::memcmp(data, rawData, smaller_size) == 0) {
121 return true;
122 }
123 return false;
124 }
125
126 bool allocBuffer(size_t size)
127 {
128 freeBuffer();
129 data = peconv::alloc_aligned(size, PAGE_READWRITE);
130 if (data == nullptr) {
131 return false;
132 }
133 data_size = size;
134 padding = 0;
135 return true;
136 }
137
139 {
140 if (!data) {
141 data_size = 0;
142 padding = 0;
143 return;
144 }
145 peconv::free_aligned(data, data_size);
146 data = nullptr;
147 data_size = 0;
148 padding = 0;
149 }
150
151 protected:
152
153 bool copy(const ByteBuffer& p1)
154 {
155 if (!allocBuffer(p1.data_size)) {
156 return false;
157 }
158 ::memcpy(this->data, p1.data, this->data_size);
159 this->real_start = p1.real_start;
160 this->real_end = p1.real_end;
161 this->padding = p1.padding;
162 return true;
163 }
164
165 };
166
167 }; // namespace util
168
169}; // namespace pesieve
170
size_t getDataSize(bool trimmed=false) const
Definition byte_buffer.h:55
const BYTE * getData(bool trimmed=false) const
Definition byte_buffer.h:65
size_t getStartOffset(bool trimmed) const
Definition byte_buffer.h:48
ByteBuffer(const ByteBuffer &p1)
Definition byte_buffer.h:96
bool allocBuffer(size_t size)
bool copy(const ByteBuffer &p1)
bool isValidPtr(BYTE *field_bgn, size_t field_size)
virtual ByteBuffer & operator=(const ByteBuffer &p1)
bool isDataContained(const BYTE *rawData, size_t r_size)