 |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
Loading...
Searching...
No Matches
|
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
This is the complete list of members for ProcessSymbolsManager, including all inherited members.
| BuildSymbolPath(bool enableAutoDownload) | ProcessSymbolsManager | inlinestatic |
| BuildSymOptions() | ProcessSymbolsManager | inlinestatic |
| dumpSymbolInfo(ULONG_PTR va) | ProcessSymbolsManager | inline |
| FilterSymbolPath(const std::string &input, bool allowDownload) | ProcessSymbolsManager | inlinestatic |
| FreeSymbols() | ProcessSymbolsManager | inlineprotected |
| funcNameFromAddr(ULONG_PTR addr, size_t *displacement=NULL) | ProcessSymbolsManager | inline |
| hProcess | ProcessSymbolsManager | protected |
| InitSymbols(HANDLE process, bool enableAutoDownload, bool lazy) | ProcessSymbolsManager | inline |
| isInit | ProcessSymbolsManager | protected |
| IsInitialized() const | ProcessSymbolsManager | inline |
| NormalizeNtZwPrefix(std::string &funcName) | ProcessSymbolsManager | inline |
| operator=(const ProcessSymbolsManager &)=delete | ProcessSymbolsManager | |
| ProcessSymbolsManager() | ProcessSymbolsManager | inline |
| ProcessSymbolsManager(const ProcessSymbolsManager &)=delete | ProcessSymbolsManager | |
| RefreshModules() | ProcessSymbolsManager | inline |
| RunStackWalk64(_In_ DWORD MachineType, _In_ HANDLE hThread, _Inout_ LPSTACKFRAME64 StackFrame, _Inout_ PVOID ContextRecord, _In_opt_ PREAD_PROCESS_MEMORY_ROUTINE64 ReadMemoryRoutine, _In_opt_ PFUNCTION_TABLE_ACCESS_ROUTINE64 FunctionTableAccessRoutine, _In_opt_ PGET_MODULE_BASE_ROUTINE64 GetModuleBaseRoutine, _In_opt_ PTRANSLATE_ADDRESS_ROUTINE64 TranslateAddress) | ProcessSymbolsManager | inline |
| ~ProcessSymbolsManager() | ProcessSymbolsManager | inline |
1.17.0