![]() |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
A scanner for detection of patches in the code. More...
#include <code_scanner.h>

Public Member Functions | |
| CodeScanner (HANDLE hProc, ModuleData &moduleData, RemoteModuleData &remoteModData) | |
| virtual CodeScanReport * | scanRemote () |
| void | setScanData (bool enable) |
| void | setScanInaccessible (bool enable) |
Public Member Functions inherited from pesieve::ModuleScanner | |
| ModuleScanner (HANDLE _procHndl, ModuleData &_moduleData, RemoteModuleData &_remoteModData) | |
| virtual | ~ModuleScanner () |
Public Member Functions inherited from pesieve::ProcessFeatureScanner | |
| ProcessFeatureScanner (HANDLE _processHandle) | |
| virtual | ~ProcessFeatureScanner () |
Additional Inherited Members | |
Protected Attributes inherited from pesieve::ModuleScanner | |
| ModuleData & | moduleData |
| RemoteModuleData & | remoteModData |
Protected Attributes inherited from pesieve::ProcessFeatureScanner | |
| HANDLE | processHandle |
A scanner for detection of patches in the code.
Definition at line 107 of file code_scanner.h.
|
inline |
|
virtual |
Perform the scan on the remote process
Implements pesieve::ModuleScanner.
Definition at line 339 of file code_scanner.cpp.

|
inline |
Definition at line 118 of file code_scanner.h.
|
inline |
Definition at line 119 of file code_scanner.h.