![]() |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include <imp_reconstructor.h>
Public Member Functions | |
| ImportTableBuffer (DWORD _descriptorsRVA) | |
| ~ImportTableBuffer () | |
| bool | allocDesciptors (size_t descriptors_count) |
| bool | allocNamesSpace (DWORD names_rva, size_t names_size) |
| bool | allocDllsSpace (DWORD dlls_rva, size_t dlls_area_size) |
| size_t | getDescriptosCount () |
| size_t | getDescriptorsSize () |
| size_t | getNamesSize () |
| size_t | getDllNamesSize () |
| DWORD | getRVA () |
| bool | setTableInPe (BYTE *vBuf, size_t vBufSize) |
Protected Member Functions | |
| BYTE * | getNamesSpaceAt (const DWORD rva, size_t required_size) |
| BYTE * | getDllSpaceAt (const DWORD rva, size_t required_size) |
Protected Attributes | |
| IMAGE_IMPORT_DESCRIPTOR * | descriptors |
Friends | |
| class | ImpReconstructor |
Definition at line 15 of file imp_reconstructor.h.
|
inline |
Definition at line 19 of file imp_reconstructor.h.
|
inline |
Definition at line 27 of file imp_reconstructor.h.
|
inline |
Definition at line 34 of file imp_reconstructor.h.
|
inline |
Definition at line 61 of file imp_reconstructor.h.
|
inline |
Definition at line 47 of file imp_reconstructor.h.
|
inline |
Definition at line 80 of file imp_reconstructor.h.
|
inline |
Definition at line 75 of file imp_reconstructor.h.
|
inline |
Definition at line 93 of file imp_reconstructor.h.
|
protected |
|
inline |
Definition at line 87 of file imp_reconstructor.h.
|
protected |
|
inline |
Definition at line 98 of file imp_reconstructor.h.
|
inline |
|
friend |
Definition at line 140 of file imp_reconstructor.h.
|
protected |
Definition at line 139 of file imp_reconstructor.h.