pesieve::IATScanReport Class Reference

A report from an IAT scan, generated by IATScanner. More...

#include <iat_scanner.h>

Inheritance diagram for pesieve::IATScanReport:

Public Member Functions
	IATScanReport (HMODULE _module, size_t _moduleSize, std::string _moduleFile)
virtual const bool	toJSON (std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails)
bool	generateList (IN const std::string &fileName, IN HANDLE hProcess, IN const ModulesInfo &modulesInfo, IN const peconv::ExportsMapper *exportsMap)
const bool	hooksToJSON (std::stringstream &outs, size_t level)
size_t	countHooked ()
Public Member Functions inherited from pesieve::ModuleScanReport
	ModuleScanReport (HMODULE _module, size_t _moduleSize, t_scan_status _status=SCAN_NOT_SUSPICIOUS)
virtual	~ModuleScanReport ()
virtual ULONGLONG	getRelocBase ()
Public Member Functions inherited from pesieve::ElementScanReport
	ElementScanReport (t_scan_status _status=SCAN_NOT_SUSPICIOUS)

Static Public Member Functions
static bool	saveNotRecovered (IN const std::string &fileName, IN HANDLE hProcess, IN peconv::ImportsCollection *storedFunc, IN peconv::ImpsNotCovered &notCovered, IN const ModulesInfo &modulesInfo, IN const peconv::ExportsMapper *exportsMap)
Static Public Member Functions inherited from pesieve::ElementScanReport
static t_scan_status	get_scan_status (const ElementScanReport *report)

Public Attributes
peconv::ImportsCollection	storedFunc
peconv::ImpsNotCovered	notCovered
Public Attributes inherited from pesieve::ModuleScanReport
HMODULE	module
size_t	moduleSize
bool	isDotNetModule
std::string	moduleFile
ULONGLONG	origBase
ULONGLONG	relocBase
Public Attributes inherited from pesieve::ElementScanReport
t_scan_status	status

Static Protected Member Functions
static std::string	formatHookedFuncName (IN peconv::ImportsCollection *storedFunc, DWORD thunk_rva)
static std::string	formatTargetName (IN const peconv::ExportsMapper *exportsMap, IN const ModulesInfo &modulesInfo, IN const ULONGLONG module_start, IN ULONGLONG addr)

Additional Inherited Members
Static Public Attributes inherited from pesieve::ElementScanReport
static const size_t	JSON_LEVEL = 1
Protected Member Functions inherited from pesieve::ModuleScanReport
virtual const bool	_toJSON (std::stringstream &outs, size_t level=JSON_LEVEL, const pesieve::t_json_level &jdetails=JSON_BASIC)

Detailed Description

A report from an IAT scan, generated by IATScanner.

Definition at line 11 of file iat_scanner.h.

Constructor & Destructor Documentation

IATScanReport()

pesieve::IATScanReport::IATScanReport ( HMODULE _module, size_t _moduleSize, std::string _moduleFile )

inline

Definition at line 22 of file iat_scanner.h.

Here is the call graph for this function:

Member Function Documentation

countHooked()

size_t pesieve::IATScanReport::countHooked ( )

inline

Definition at line 49 of file iat_scanner.h.

formatHookedFuncName()

std::string IATScanReport::formatHookedFuncName ( IN peconv::ImportsCollection * storedFunc, DWORD thunk_rva )

staticprotected

Definition at line 75 of file iat_scanner.cpp.

formatTargetName()

std::string IATScanReport::formatTargetName ( IN const peconv::ExportsMapper * exportsMap, IN const ModulesInfo & modulesInfo, IN const ULONGLONG module_start, IN ULONGLONG addr )

staticprotected

Definition at line 50 of file iat_scanner.cpp.

Here is the call graph for this function:

generateList()

bool IATScanReport::generateList	(	IN const std::string &	fileName,
		IN HANDLE	hProcess,
		IN const ModulesInfo &	modulesInfo,
		IN const peconv::ExportsMapper *	exportsMap )

Definition at line 143 of file iat_scanner.cpp.

Here is the call graph for this function:

hooksToJSON()

const bool IATScanReport::hooksToJSON	(	std::stringstream &	outs,
		size_t	level )

Definition at line 11 of file iat_scanner.cpp.

saveNotRecovered()

bool IATScanReport::saveNotRecovered ( IN const std::string & fileName, IN HANDLE hProcess, IN peconv::ImportsCollection * storedFunc, IN peconv::ImpsNotCovered & notCovered, IN const ModulesInfo & modulesInfo, IN const peconv::ExportsMapper * exportsMap )

static

Definition at line 92 of file iat_scanner.cpp.

Here is the call graph for this function:

toJSON()

virtual const bool pesieve::IATScanReport::toJSON ( std::stringstream & outs, size_t level, const pesieve::t_json_level & jdetails )

inlinevirtual

Implements pesieve::ModuleScanReport.

Definition at line 28 of file iat_scanner.h.

Here is the call graph for this function:

Member Data Documentation

notCovered

peconv::ImpsNotCovered pesieve::IATScanReport::notCovered

Definition at line 52 of file iat_scanner.h.

storedFunc

peconv::ImportsCollection pesieve::IATScanReport::storedFunc

Definition at line 51 of file iat_scanner.h.

---

The documentation for this class was generated from the following files:

• scanners/iat_scanner.h
• scanners/iat_scanner.cpp