PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include <entropy_stats.h>
Public Member Functions | |
AreaEntropyStats () | |
AreaEntropyStats (const AreaEntropyStats &p1) | |
void | _appendVal (BYTE val) |
virtual void | summarize () |
Public Member Functions inherited from pesieve::AreaStats | |
AreaStats () | |
void | setStartOffset (size_t _area_start) |
void | appendVal (BYTE val) |
bool | isFilled () const |
virtual bool | fillSettings (StatsSettings *_settings) |
virtual const bool | toJSON (std::stringstream &outs, size_t level) |
Public Attributes | |
double | entropy |
Protected Member Functions | |
virtual const void | fieldsToJSON (std::stringstream &outs, size_t level) |
Protected Member Functions inherited from pesieve::AreaStats |
Protected Attributes | |
std::map< BYTE, size_t > | histogram |
Protected Attributes inherited from pesieve::AreaStats | |
size_t | area_size |
size_t | area_start |
Friends | |
class | AreaStatsCalculator |
Definition at line 9 of file entropy_stats.h.
|
inline |
Definition at line 11 of file entropy_stats.h.
|
inline |
Definition at line 18 of file entropy_stats.h.
|
inlinevirtual |
Implements pesieve::AreaStats.
Definition at line 25 of file entropy_stats.h.
|
inlineprotectedvirtual |
Implements pesieve::AreaStats.
Definition at line 38 of file entropy_stats.h.
|
inlinevirtual |
Implements pesieve::AreaStats.
Definition at line 30 of file entropy_stats.h.
|
friend |
Definition at line 52 of file entropy_stats.h.
double pesieve::AreaEntropyStats::entropy |
Definition at line 35 of file entropy_stats.h.
|
protected |
Definition at line 50 of file entropy_stats.h.