![]() |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include <process_symbols.h>
Public Member Functions | |
| ProcessSymbolsManager () | |
| ~ProcessSymbolsManager () | |
| ProcessSymbolsManager (const ProcessSymbolsManager &)=delete | |
| ProcessSymbolsManager & | operator= (const ProcessSymbolsManager &)=delete |
| bool | InitSymbols (HANDLE process, bool enableAutoDownload, bool lazy) |
| bool | RefreshModules () |
| bool | RunStackWalk64 (_In_ DWORD MachineType, _In_ HANDLE hThread, _Inout_ LPSTACKFRAME64 StackFrame, _Inout_ PVOID ContextRecord, _In_opt_ PREAD_PROCESS_MEMORY_ROUTINE64 ReadMemoryRoutine, _In_opt_ PFUNCTION_TABLE_ACCESS_ROUTINE64 FunctionTableAccessRoutine, _In_opt_ PGET_MODULE_BASE_ROUTINE64 GetModuleBaseRoutine, _In_opt_ PTRANSLATE_ADDRESS_ROUTINE64 TranslateAddress) |
| bool | IsInitialized () const |
| void | NormalizeNtZwPrefix (std::string &funcName) |
| std::string | funcNameFromAddr (ULONG_PTR addr, size_t *displacement=NULL) |
| bool | dumpSymbolInfo (ULONG_PTR va) |
Static Public Member Functions | |
| static DWORD | BuildSymOptions () |
| static std::string | FilterSymbolPath (const std::string &input, bool allowDownload) |
| static std::string | BuildSymbolPath (bool enableAutoDownload) |
Protected Member Functions | |
| bool | FreeSymbols () |
Protected Attributes | |
| HANDLE | hProcess |
| bool | isInit |
Definition at line 16 of file process_symbols.h.
|
inline |
Definition at line 20 of file process_symbols.h.
|
inline |
|
delete |

|
inlinestatic |
|
inlinestatic |
Definition at line 49 of file process_symbols.h.
|
inline |
|
inlinestatic |
Definition at line 64 of file process_symbols.h.
|
inlineprotected |
|
inline |
|
inline |
Definition at line 232 of file process_symbols.h.
|
inline |
Definition at line 237 of file process_symbols.h.
|
delete |

|
inline |
|
inline |
|
protected |
Definition at line 321 of file process_symbols.h.
|
protected |
Definition at line 322 of file process_symbols.h.