PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
Public Member Functions | Static Public Member Functions | Public Attributes | Static Public Attributes | Protected Member Functions | List of all members
pesieve::ModuleScanReport Class Referenceabstract

A base class of all the reports detailing on the output of the performed module's scan. More...

#include <module_scan_report.h>

Inheritance diagram for pesieve::ModuleScanReport:
Inheritance graph
[legend]

Public Member Functions

 ModuleScanReport (HMODULE _module, size_t _moduleSize, t_scan_status _status)
 
 ModuleScanReport (HMODULE _module, size_t _moduleSize)
 
virtual ~ModuleScanReport ()
 
virtual ULONGLONG getRelocBase ()
 
virtual const bool toJSON (std::stringstream &outs, size_t level=JSON_LEVEL, const pesieve::t_json_level &jdetails=JSON_BASIC)=0
 

Static Public Member Functions

static t_scan_status get_scan_status (const ModuleScanReport *report)
 

Public Attributes

HMODULE size_t moduleSize
 
bool isDotNetModule
 
std::string moduleFile
 
t_scan_status status
 

Static Public Attributes

static const size_t JSON_LEVEL = 1
 

Protected Member Functions

virtual const bool _toJSON (std::stringstream &outs, size_t level=JSON_LEVEL, const pesieve::t_json_level &jdetails=JSON_BASIC)
 

Detailed Description

A base class of all the reports detailing on the output of the performed module's scan.

Definition at line 25 of file module_scan_report.h.

Constructor & Destructor Documentation

◆ ModuleScanReport() [1/2]

pesieve::ModuleScanReport::ModuleScanReport ( HMODULE _module,
size_t _moduleSize,
t_scan_status _status )
inline

Definition at line 38 of file module_scan_report.h.

Here is the call graph for this function:

◆ ModuleScanReport() [2/2]

pesieve::ModuleScanReport::ModuleScanReport ( HMODULE _module,
size_t _moduleSize )
inline

Definition at line 46 of file module_scan_report.h.

Here is the call graph for this function:

◆ ~ModuleScanReport()

virtual pesieve::ModuleScanReport::~ModuleScanReport ( )
inlinevirtual

Definition at line 54 of file module_scan_report.h.

Member Function Documentation

◆ _toJSON()

virtual const bool pesieve::ModuleScanReport::_toJSON ( std::stringstream & outs,
size_t level = JSON_LEVEL,
const pesieve::t_json_level & jdetails = JSON_BASIC )
inlineprotectedvirtual

Definition at line 70 of file module_scan_report.h.

Here is the call graph for this function:

◆ get_scan_status()

static t_scan_status pesieve::ModuleScanReport::get_scan_status ( const ModuleScanReport * report)
inlinestatic

Definition at line 30 of file module_scan_report.h.

◆ getRelocBase()

virtual ULONGLONG pesieve::ModuleScanReport::getRelocBase ( )
inlinevirtual

Reimplemented in pesieve::CodeScanReport.

Definition at line 56 of file module_scan_report.h.

Here is the call graph for this function:

◆ toJSON()

virtual const bool pesieve::ModuleScanReport::toJSON ( std::stringstream & outs,
size_t level = JSON_LEVEL,
const pesieve::t_json_level & jdetails = JSON_BASIC )
pure virtual

Member Data Documentation

◆ isDotNetModule

bool pesieve::ModuleScanReport::isDotNetModule

Definition at line 65 of file module_scan_report.h.

◆ JSON_LEVEL

const size_t pesieve::ModuleScanReport::JSON_LEVEL = 1
static

Definition at line 28 of file module_scan_report.h.

◆ moduleFile

std::string pesieve::ModuleScanReport::moduleFile

Definition at line 66 of file module_scan_report.h.

◆ moduleSize

HMODULE size_t pesieve::ModuleScanReport::moduleSize

Definition at line 64 of file module_scan_report.h.

◆ status

t_scan_status pesieve::ModuleScanReport::status

Definition at line 67 of file module_scan_report.h.


The documentation for this class was generated from the following file: