PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include <imp_reconstructor.h>
Public Types | |
enum | imprec_filter { IMP_REC0 , IMP_REC1 , IMP_REC2 , IMP_REC_COUNT } |
enum | imprec_res { IMP_NOT_FOUND = -3 , IMP_RECOVERY_ERROR = -2 , IMP_RECOVERY_NOT_APPLICABLE = -1 , IMP_RECOVERY_SKIPPED = 0 , IMP_ALREADY_OK = 1 , IMP_DIR_FIXED = 2 , IMP_FIXED = 3 , IMP_RECREATED_FILTER0 = 4 , IMP_RECREATED_FILTER1 = 5 , IMP_RECREATED_FILTER2 = 6 } |
typedef enum pesieve::ImpReconstructor::imprec_filter | t_imprec_filter |
typedef enum pesieve::ImpReconstructor::imprec_res | t_imprec_res |
Public Member Functions | |
ImpReconstructor (PeBuffer &_peBuffer) | |
~ImpReconstructor () | |
t_imprec_res | rebuildImportTable (const IN peconv::ExportsMapper *exportsMap, IN const pesieve::t_imprec_mode &imprec_mode) |
bool | printFoundIATs (const std::string &reportPath) |
Definition at line 156 of file imp_reconstructor.h.
Enumerator | |
---|---|
IMP_REC0 | |
IMP_REC1 | |
IMP_REC2 | |
IMP_REC_COUNT |
Definition at line 179 of file imp_reconstructor.h.
Enumerator | |
---|---|
IMP_NOT_FOUND | |
IMP_RECOVERY_ERROR | |
IMP_RECOVERY_NOT_APPLICABLE | |
IMP_RECOVERY_SKIPPED | |
IMP_ALREADY_OK | |
IMP_DIR_FIXED | |
IMP_FIXED | |
IMP_RECREATED_FILTER0 | |
IMP_RECREATED_FILTER1 | |
IMP_RECREATED_FILTER2 |
Definition at line 186 of file imp_reconstructor.h.
|
inline |
|
inline |
Definition at line 174 of file imp_reconstructor.h.
bool pesieve::ImpReconstructor::printFoundIATs | ( | const std::string & | reportPath | ) |
Definition at line 201 of file imp_reconstructor.cpp.
pesieve::ImpReconstructor::t_imprec_res pesieve::ImpReconstructor::rebuildImportTable | ( | const IN peconv::ExportsMapper * | exportsMap, |
IN const pesieve::t_imprec_mode & | imprec_mode ) |
Definition at line 152 of file imp_reconstructor.cpp.