PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
Public Member Functions | Public Attributes | Protected Member Functions | Protected Attributes | Friends | List of all members
pesieve::ModuleData Class Reference

Loads a module from the disk, corresponding to the module in the scanned process' memory. More...

#include <module_data.h>

Public Member Functions

 ModuleData (HANDLE _processHandle, HMODULE _module, bool _isPEBConnected, bool _useCache, const char *_moduleName=nullptr)
 
 ~ModuleData ()
 
bool is64bit ()
 
bool isDotNet ()
 
ULONGLONG rvaToVa (DWORD rva, ULONGLONG module_base=0)
 
DWORD vaToRva (ULONGLONG va, ULONGLONG module_base=0)
 
bool isModuleInPEBList ()
 
bool isInitialized ()
 
ULONGLONG getHdrImageBase ()
 
bool loadOriginal ()
 
bool switchToMappedPath ()
 
bool switchToWow64Path ()
 
bool reloadWow64 ()
 
bool relocateToBase (ULONGLONG new_base)
 
bool loadRelocatedFields (std::set< DWORD > &fields_rvas)
 
bool loadImportThunks (std::set< DWORD > &fields_rvas)
 
bool loadImportsList (peconv::ImportsCollection &collection)
 

Public Attributes

HANDLE processHandle
 
HMODULE moduleHandle
 
char szModName [MAX_PATH]
 
bool is_module_named
 
PBYTE original_module
 
size_t original_size
 

Protected Member Functions

bool _loadOriginal (bool disableFSredir)
 
bool loadModuleName ()
 
bool autoswichIfWow64Mapping ()
 
bool isDotNetManagedCode ()
 

Protected Attributes

bool is_dot_net
 
bool isPEBConnected
 
bool useCache
 

Friends

class PeSection
 

Detailed Description

Loads a module from the disk, corresponding to the module in the scanned process' memory.

Definition at line 15 of file module_data.h.

Constructor & Destructor Documentation

◆ ModuleData()

pesieve::ModuleData::ModuleData ( HANDLE _processHandle,
HMODULE _module,
bool _isPEBConnected,
bool _useCache,
const char * _moduleName = nullptr )
inline

Definition at line 18 of file module_data.h.

Here is the call graph for this function:

◆ ~ModuleData()

pesieve::ModuleData::~ModuleData ( )
inline

Definition at line 35 of file module_data.h.

Member Function Documentation

◆ _loadOriginal()

bool pesieve::ModuleData::_loadOriginal ( bool disableFSredir)
protected

Definition at line 41 of file module_data.cpp.

Here is the call graph for this function:

◆ autoswichIfWow64Mapping()

bool pesieve::ModuleData::autoswichIfWow64Mapping ( )
protected

Definition at line 169 of file module_data.cpp.

Here is the call graph for this function:

◆ getHdrImageBase()

ULONGLONG pesieve::ModuleData::getHdrImageBase ( )
inline

Definition at line 83 of file module_data.h.

◆ is64bit()

bool pesieve::ModuleData::is64bit ( )
inline

Definition at line 40 of file module_data.h.

◆ isDotNet()

bool pesieve::ModuleData::isDotNet ( )
inline

Definition at line 48 of file module_data.h.

◆ isDotNetManagedCode()

bool pesieve::ModuleData::isDotNetManagedCode ( )
protected

Definition at line 235 of file module_data.cpp.

◆ isInitialized()

bool pesieve::ModuleData::isInitialized ( )
inline

Definition at line 78 of file module_data.h.

◆ isModuleInPEBList()

bool pesieve::ModuleData::isModuleInPEBList ( )
inline

Definition at line 73 of file module_data.h.

◆ loadImportsList()

bool pesieve::ModuleData::loadImportsList ( peconv::ImportsCollection & collection)

Definition at line 132 of file module_data.cpp.

◆ loadImportThunks()

bool pesieve::ModuleData::loadImportThunks ( std::set< DWORD > & fields_rvas)

Definition at line 113 of file module_data.cpp.

◆ loadModuleName()

bool pesieve::ModuleData::loadModuleName ( )
protected

Definition at line 16 of file module_data.cpp.

Here is the call graph for this function:

◆ loadOriginal()

bool pesieve::ModuleData::loadOriginal ( )

Definition at line 30 of file module_data.cpp.

◆ loadRelocatedFields()

bool pesieve::ModuleData::loadRelocatedFields ( std::set< DWORD > & fields_rvas)

Definition at line 73 of file module_data.cpp.

Here is the call graph for this function:

◆ reloadWow64()

bool pesieve::ModuleData::reloadWow64 ( )

Definition at line 215 of file module_data.cpp.

Here is the call graph for this function:

◆ relocateToBase()

bool pesieve::ModuleData::relocateToBase ( ULONGLONG new_base)

Definition at line 148 of file module_data.cpp.

◆ rvaToVa()

ULONGLONG pesieve::ModuleData::rvaToVa ( DWORD rva,
ULONGLONG module_base = 0 )
inline

Definition at line 50 of file module_data.h.

◆ switchToMappedPath()

bool pesieve::ModuleData::switchToMappedPath ( )

Definition at line 203 of file module_data.cpp.

Here is the call graph for this function:

◆ switchToWow64Path()

bool pesieve::ModuleData::switchToWow64Path ( )

Definition at line 190 of file module_data.cpp.

Here is the call graph for this function:

◆ vaToRva()

DWORD pesieve::ModuleData::vaToRva ( ULONGLONG va,
ULONGLONG module_base = 0 )
inline

Definition at line 58 of file module_data.h.

Friends And Related Symbol Documentation

◆ PeSection

friend class PeSection
friend

Definition at line 116 of file module_data.h.

Member Data Documentation

◆ is_dot_net

bool pesieve::ModuleData::is_dot_net
protected

Definition at line 112 of file module_data.h.

◆ is_module_named

bool pesieve::ModuleData::is_module_named

Definition at line 101 of file module_data.h.

◆ isPEBConnected

bool pesieve::ModuleData::isPEBConnected
protected

Definition at line 113 of file module_data.h.

◆ moduleHandle

HMODULE pesieve::ModuleData::moduleHandle

Definition at line 99 of file module_data.h.

◆ original_module

PBYTE pesieve::ModuleData::original_module

Definition at line 103 of file module_data.h.

◆ original_size

size_t pesieve::ModuleData::original_size

Definition at line 104 of file module_data.h.

◆ processHandle

HANDLE pesieve::ModuleData::processHandle

Definition at line 98 of file module_data.h.

◆ szModName

char pesieve::ModuleData::szModName[MAX_PATH]

Definition at line 100 of file module_data.h.

◆ useCache

bool pesieve::ModuleData::useCache
protected

Definition at line 114 of file module_data.h.

The documentation for this class was generated from the following files:
Generated by doxygen 1.12.0