PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
A base class for all the scanners operating on module data. More...
#include <module_scanner.h>
Public Member Functions | |
ModuleScanner (HANDLE _procHndl, ModuleData &_moduleData, RemoteModuleData &_remoteModData) | |
virtual | ~ModuleScanner () |
virtual ModuleScanReport * | scanRemote ()=0 |
Public Member Functions inherited from pesieve::ProcessFeatureScanner | |
ProcessFeatureScanner (HANDLE _processHandle) | |
virtual | ~ProcessFeatureScanner () |
Protected Attributes | |
ModuleData & | moduleData |
RemoteModuleData & | remoteModData |
Protected Attributes inherited from pesieve::ProcessFeatureScanner | |
HANDLE | processHandle |
A base class for all the scanners operating on module data.
Definition at line 17 of file module_scanner.h.
|
inline |
Definition at line 19 of file module_scanner.h.
|
inlinevirtual |
Definition at line 25 of file module_scanner.h.
|
pure virtual |
Perform the scan on the remote process
Implements pesieve::ProcessFeatureScanner.
Implemented in pesieve::CodeScanner, pesieve::HeadersScanner, and pesieve::IATScanner.
|
protected |
Definition at line 30 of file module_scanner.h.
|
protected |
Definition at line 31 of file module_scanner.h.