PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
Base class for the statistics from analyzed buffer. More...
#include <stats.h>
Public Member Functions | |
AreaStats () | |
void | setStartOffset (size_t _area_start) |
void | appendVal (BYTE val) |
virtual const void | fieldsToJSON (std::stringstream &outs, size_t level)=0 |
bool | isFilled () const |
virtual void | summarize ()=0 |
virtual bool | fillSettings (StatsSettings *_settings) |
virtual const bool | toJSON (std::stringstream &outs, size_t level) |
Protected Member Functions | |
virtual void | _appendVal (BYTE val)=0 |
Protected Attributes | |
size_t | area_size |
size_t | area_start |
Friends | |
class | AreaStatsCalculator |
|
protectedpure virtual |
Implemented in pesieve::AreaEntropyStats, and pesieve::AreaMultiStats.
|
inline |
|
pure virtual |
Implemented in pesieve::AreaEntropyStats, and pesieve::AreaMultiStats.
|
inlinevirtual |
Reimplemented in pesieve::AreaMultiStats.
|
inline |
|
pure virtual |
Implemented in pesieve::AreaEntropyStats, and pesieve::AreaMultiStats.
|
inlinevirtual |
|
friend |