![]() |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include <entropy_stats.h>

Public Member Functions | |
| AreaEntropyStats () | |
| AreaEntropyStats (const AreaEntropyStats &p1) | |
| void | _appendVal (BYTE val) |
| virtual void | summarize () |
| Public Member Functions inherited from pesieve::AreaStats | |
| AreaStats () | |
| void | setStartOffset (size_t _area_start) |
| void | appendVal (BYTE val) |
| bool | isFilled () const |
| virtual bool | fillSettings (StatsSettings *_settings) |
| virtual bool | toJSON (std::stringstream &outs, size_t level) const |
Public Attributes | |
| double | entropy |
Protected Member Functions | |
| virtual void | fieldsToJSON (std::stringstream &outs, size_t level) const |
Protected Attributes | |
| std::map< BYTE, size_t > | histogram |
| Protected Attributes inherited from pesieve::AreaStats | |
| size_t | area_size |
| size_t | area_start |
Friends | |
| class | AreaStatsCalculator |
Definition at line 9 of file entropy_stats.h.
|
inline |
|
inline |
|
inlinevirtual |
Implements pesieve::AreaStats.
Definition at line 25 of file entropy_stats.h.
|
inlineprotectedvirtual |
Implements pesieve::AreaStats.
Definition at line 38 of file entropy_stats.h.
|
inlinevirtual |
Implements pesieve::AreaStats.
Definition at line 30 of file entropy_stats.h.

|
friend |
Definition at line 52 of file entropy_stats.h.
| double pesieve::AreaEntropyStats::entropy |
Definition at line 35 of file entropy_stats.h.
|
protected |
Definition at line 50 of file entropy_stats.h.