PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
pesieve::MalformedHeaderReport Class Reference

#include <module_scan_report.h>

Inheritance diagram for pesieve::MalformedHeaderReport:

Public Member Functions

 MalformedHeaderReport (HMODULE _module, size_t _moduleSize, std::string _moduleFile)
 
virtual const bool toJSON (std::stringstream &outs, size_t level=JSON_LEVEL, const pesieve::t_json_level &jdetails=JSON_BASIC)
 
- Public Member Functions inherited from pesieve::ModuleScanReport
 ModuleScanReport (HMODULE _module, size_t _moduleSize, t_scan_status _status=SCAN_NOT_SUSPICIOUS)
 
virtual ~ModuleScanReport ()
 
virtual ULONGLONG getRelocBase ()
 

Additional Inherited Members

- Static Public Member Functions inherited from pesieve::ModuleScanReport
static t_scan_status get_scan_status (const ModuleScanReport *report)
 
- Public Attributes inherited from pesieve::ModuleScanReport
HMODULE module
 
size_t moduleSize
 
bool isDotNetModule
 
std::string moduleFile
 
ULONGLONG origBase
 
ULONGLONG relocBase
 
t_scan_status status
 
- Static Public Attributes inherited from pesieve::ModuleScanReport
static const size_t JSON_LEVEL = 1
 
- Protected Member Functions inherited from pesieve::ModuleScanReport
virtual const bool _toJSON (std::stringstream &outs, size_t level=JSON_LEVEL, const pesieve::t_json_level &jdetails=JSON_BASIC)
 

Detailed Description

Definition at line 140 of file module_scan_report.h.

Constructor & Destructor Documentation

◆ MalformedHeaderReport()

pesieve::MalformedHeaderReport::MalformedHeaderReport ( HMODULE _module,
size_t _moduleSize,
std::string _moduleFile )
inline

Definition at line 143 of file module_scan_report.h.

Member Function Documentation

◆ toJSON()

virtual const bool pesieve::MalformedHeaderReport::toJSON ( std::stringstream & outs,
size_t level = JSON_LEVEL,
const pesieve::t_json_level & jdetails = JSON_BASIC )
inlinevirtual

Implements pesieve::ModuleScanReport.

Definition at line 149 of file module_scan_report.h.

Here is the call graph for this function:

The documentation for this class was generated from the following file: