PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
Public Member Functions | List of all members
pesieve::CodeScanner Class Reference

A scanner for detection of patches in the code. More...

#include <code_scanner.h>

Inheritance diagram for pesieve::CodeScanner:
Inheritance graph
[legend]

Public Member Functions

 CodeScanner (HANDLE hProc, ModuleData &moduleData, RemoteModuleData &remoteModData)
 
virtual CodeScanReportscanRemote ()
 
void setScanData (bool enable)
 
void setScanInaccessible (bool enable)
 
- Public Member Functions inherited from pesieve::ModuleScanner
 ModuleScanner (HANDLE _procHndl, ModuleData &_moduleData, RemoteModuleData &_remoteModData)
 
virtual ~ModuleScanner ()
 
- Public Member Functions inherited from pesieve::ProcessFeatureScanner
 ProcessFeatureScanner (HANDLE _processHandle)
 
virtual ~ProcessFeatureScanner ()
 

Additional Inherited Members

- Protected Attributes inherited from pesieve::ModuleScanner
ModuleDatamoduleData
 
RemoteModuleDataremoteModData
 
- Protected Attributes inherited from pesieve::ProcessFeatureScanner
HANDLE processHandle
 

Detailed Description

A scanner for detection of patches in the code.

Definition at line 108 of file code_scanner.h.

Constructor & Destructor Documentation

◆ CodeScanner()

pesieve::CodeScanner::CodeScanner ( HANDLE hProc,
ModuleData & moduleData,
RemoteModuleData & remoteModData )
inline

Definition at line 111 of file code_scanner.h.

Member Function Documentation

◆ scanRemote()

pesieve::CodeScanReport * pesieve::CodeScanner::scanRemote ( )
virtual

Perform the scan on the remote process

Returns
a pointer to an object of the class inherited from ModuleScanReport

Implements pesieve::ModuleScanner.

Definition at line 338 of file code_scanner.cpp.

Here is the call graph for this function:

◆ setScanData()

void pesieve::CodeScanner::setScanData ( bool enable)
inline

Definition at line 119 of file code_scanner.h.

Here is the call graph for this function:

◆ setScanInaccessible()

void pesieve::CodeScanner::setScanInaccessible ( bool enable)
inline

Definition at line 120 of file code_scanner.h.

Here is the call graph for this function:

The documentation for this class was generated from the following files: