![]() |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
A base class for all the scanners operating on module data. More...
#include <module_scanner.h>

Public Member Functions | |
| ModuleScanner (HANDLE _procHndl, ModuleData &_moduleData, RemoteModuleData &_remoteModData) | |
| virtual | ~ModuleScanner () |
| virtual ModuleScanReport * | scanRemote ()=0 |
Public Member Functions inherited from pesieve::ProcessFeatureScanner | |
| ProcessFeatureScanner (HANDLE _processHandle) | |
| virtual | ~ProcessFeatureScanner () |
Protected Attributes | |
| ModuleData & | moduleData |
| RemoteModuleData & | remoteModData |
Protected Attributes inherited from pesieve::ProcessFeatureScanner | |
| HANDLE | processHandle |
A base class for all the scanners operating on module data.
Definition at line 17 of file module_scanner.h.
|
inline |
|
inlinevirtual |
Definition at line 25 of file module_scanner.h.
|
pure virtual |
Perform the scan on the remote process
Implements pesieve::ProcessFeatureScanner.
Implemented in pesieve::CodeScanner, pesieve::HeadersScanner, and pesieve::IATScanner.
|
protected |
Definition at line 30 of file module_scanner.h.
|
protected |
Definition at line 31 of file module_scanner.h.