PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
pesieve::ModuleScanner Class Referenceabstract

A base class for all the scanners operating on module data. More...

#include <module_scanner.h>

Inheritance diagram for pesieve::ModuleScanner:

Public Member Functions

 ModuleScanner (HANDLE _procHndl, ModuleData &_moduleData, RemoteModuleData &_remoteModData)
virtual ~ModuleScanner ()
virtual ModuleScanReportscanRemote ()=0
Public Member Functions inherited from pesieve::ProcessFeatureScanner
 ProcessFeatureScanner (HANDLE _processHandle)
virtual ~ProcessFeatureScanner ()

Protected Attributes

ModuleDatamoduleData
RemoteModuleDataremoteModData
Protected Attributes inherited from pesieve::ProcessFeatureScanner
HANDLE processHandle

Detailed Description

A base class for all the scanners operating on module data.

Definition at line 17 of file module_scanner.h.

Constructor & Destructor Documentation

◆ ModuleScanner()

pesieve::ModuleScanner::ModuleScanner ( HANDLE _procHndl,
ModuleData & _moduleData,
RemoteModuleData & _remoteModData )
inline

Definition at line 19 of file module_scanner.h.

Here is the call graph for this function:

◆ ~ModuleScanner()

virtual pesieve::ModuleScanner::~ModuleScanner ( )
inlinevirtual

Definition at line 25 of file module_scanner.h.

Member Function Documentation

◆ scanRemote()

virtual ModuleScanReport * pesieve::ModuleScanner::scanRemote ( )
pure virtual

Perform the scan on the remote process

Returns
a pointer to an object of the class inherited from ModuleScanReport

Implements pesieve::ProcessFeatureScanner.

Implemented in pesieve::CodeScanner, pesieve::HeadersScanner, and pesieve::IATScanner.

Member Data Documentation

◆ moduleData

ModuleData& pesieve::ModuleScanner::moduleData
protected

Definition at line 30 of file module_scanner.h.

◆ remoteModData

RemoteModuleData& pesieve::ModuleScanner::remoteModData
protected

Definition at line 31 of file module_scanner.h.


The documentation for this class was generated from the following file: