![]() |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include <iat_block.h>
Public Member Functions | |
| IATThunksSeries (DWORD start_offset) | |
| ~IATThunksSeries () | |
| bool | operator< (const IATThunksSeries &other) const |
| bool | insert (DWORD rva, ULONGLONG funcAddr) |
| bool | makeCoverage (IN const peconv::ExportsMapper *exportsMap) |
| bool | isCovered () |
| size_t | funcCount () |
| std::string | getDllName () |
| size_t | sizeOfNamesSpace (bool is64b) |
| bool | fillNamesSpace (const BYTE *buf_start, size_t buf_size, DWORD bufRVA, bool is64b) |
| std::map< DWORD, ULONGLONG > | getRvaToFuncMap () |
Public Attributes | |
| DWORD | startOffset |
| DWORD | endOffset |
Definition at line 11 of file iat_block.h.
|
inline |
Definition at line 14 of file iat_block.h.
|
inline |
Definition at line 19 of file iat_block.h.
|
inline |
Definition at line 46 of file iat_block.h.
| std::string pesieve::IATThunksSeries::getDllName | ( | ) |
Definition at line 101 of file iat_block.cpp.
|
inline |
Definition at line 59 of file iat_block.h.
|
inline |
Definition at line 29 of file iat_block.h.
|
inline |
Definition at line 41 of file iat_block.h.
| bool pesieve::IATThunksSeries::makeCoverage | ( | IN const peconv::ExportsMapper * | exportsMap | ) |
Definition at line 25 of file iat_block.cpp.
|
inline |
| size_t pesieve::IATThunksSeries::sizeOfNamesSpace | ( | bool | is64b | ) |
| DWORD pesieve::IATThunksSeries::endOffset |
Definition at line 65 of file iat_block.h.
| DWORD pesieve::IATThunksSeries::startOffset |
Definition at line 64 of file iat_block.h.