![]() |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include <mapping_scanner.h>

Public Member Functions | |
| MappingScanReport (HMODULE _module, size_t _moduleSize) | |
| virtual const void | fieldsToJSON (std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails) |
| virtual const bool | toJSON (std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails) |
Public Member Functions inherited from pesieve::ModuleScanReport | |
| ModuleScanReport (HMODULE _module, size_t _moduleSize, t_scan_status _status=SCAN_NOT_SUSPICIOUS) | |
| virtual | ~ModuleScanReport () |
| virtual ULONGLONG | getRelocBase () |
Public Member Functions inherited from pesieve::ElementScanReport | |
| ElementScanReport (t_scan_status _status=SCAN_NOT_SUSPICIOUS) | |
Public Attributes | |
| std::string | mappedFile |
Public Attributes inherited from pesieve::ModuleScanReport | |
| HMODULE | module |
| size_t | moduleSize |
| bool | isDotNetModule |
| std::string | moduleFile |
| ULONGLONG | origBase |
| ULONGLONG | relocBase |
Public Attributes inherited from pesieve::ElementScanReport | |
| t_scan_status | status |
Additional Inherited Members | |
Static Public Member Functions inherited from pesieve::ElementScanReport | |
| static t_scan_status | get_scan_status (const ElementScanReport *report) |
Static Public Attributes inherited from pesieve::ElementScanReport | |
| static const size_t | JSON_LEVEL = 1 |
Protected Member Functions inherited from pesieve::ModuleScanReport | |
| virtual const bool | _toJSON (std::stringstream &outs, size_t level=JSON_LEVEL, const pesieve::t_json_level &jdetails=JSON_BASIC) |
Definition at line 12 of file mapping_scanner.h.
|
inline |
|
inlinevirtual |
|
inlinevirtual |
Implements pesieve::ModuleScanReport.
Definition at line 34 of file mapping_scanner.h.

| std::string pesieve::MappingScanReport::mappedFile |
Definition at line 44 of file mapping_scanner.h.