PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
A scanner for detection of inconsistencies in mapping. Checks if the mapped file name is different than the module file name. More...
#include <mapping_scanner.h>
Public Member Functions | |
MappingScanner (HANDLE hProc, ModuleData &moduleData) | |
virtual MappingScanReport * | scanRemote () |
Public Member Functions inherited from pesieve::ProcessFeatureScanner | |
ProcessFeatureScanner (HANDLE _processHandle) | |
virtual | ~ProcessFeatureScanner () |
Public Attributes | |
ModuleData & | moduleData |
Additional Inherited Members | |
Protected Attributes inherited from pesieve::ProcessFeatureScanner | |
HANDLE | processHandle |
A scanner for detection of inconsistencies in mapping. Checks if the mapped file name is different than the module file name.
Definition at line 49 of file mapping_scanner.h.
|
inline |
Definition at line 51 of file mapping_scanner.h.
|
virtual |
Perform the scan on the remote process
Implements pesieve::ProcessFeatureScanner.
Definition at line 8 of file mapping_scanner.cpp.
ModuleData& pesieve::MappingScanner::moduleData |
Definition at line 58 of file mapping_scanner.h.