PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
Public Member Functions | Protected Attributes | List of all members
pesieve::HookTargetResolver Class Reference

Processes the list of the collected patches (preprocessed by PatchAnalyzer), and for those of them that were detected as hooks, it resolves information about to which modules do they lead to. More...

#include <hook_targets_resolver.h>

Public Member Functions

 HookTargetResolver (IN ProcessScanReport &process_report)
 
size_t resolveAllHooks (IN OUT std::set< ModuleScanReport * > &code_reports)
 Resolves all the hooks collected within the given set of reports.
 
bool resolveTarget (IN OUT PatchList::Patch *currPatch)
 Resolves the information about the target of the provided hook, and fills it back into the object.
 

Protected Attributes

ProcessScanReportprocessReport
 

Detailed Description

Processes the list of the collected patches (preprocessed by PatchAnalyzer), and for those of them that were detected as hooks, it resolves information about to which modules do they lead to.

Definition at line 9 of file hook_targets_resolver.h.

Constructor & Destructor Documentation

◆ HookTargetResolver()

pesieve::HookTargetResolver::HookTargetResolver ( IN ProcessScanReport & process_report)
inline

Definition at line 12 of file hook_targets_resolver.h.

Member Function Documentation

◆ resolveAllHooks()

size_t pesieve::HookTargetResolver::resolveAllHooks ( IN OUT std::set< ModuleScanReport * > & code_reports)

Resolves all the hooks collected within the given set of reports.

Definition at line 29 of file hook_targets_resolver.cpp.

Here is the call graph for this function:

◆ resolveTarget()

bool pesieve::HookTargetResolver::resolveTarget ( IN OUT PatchList::Patch * currPatch)

Resolves the information about the target of the provided hook, and fills it back into the object.

Definition at line 9 of file hook_targets_resolver.cpp.

Here is the call graph for this function:

Member Data Documentation

◆ processReport

ProcessScanReport& pesieve::HookTargetResolver::processReport
protected

Definition at line 24 of file hook_targets_resolver.h.


The documentation for this class was generated from the following files: