PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
Public Member Functions | Protected Attributes | List of all members
pesieve::ModuleScanner Class Referenceabstract

A base class for all the scanners operating on module data. More...

#include <module_scanner.h>

Inheritance diagram for pesieve::ModuleScanner:
Inheritance graph
[legend]

Public Member Functions

 ModuleScanner (HANDLE _procHndl, ModuleData &_moduleData, RemoteModuleData &_remoteModData)
 
virtual ~ModuleScanner ()
 
virtual ModuleScanReportscanRemote ()=0
 
- Public Member Functions inherited from pesieve::ProcessFeatureScanner
 ProcessFeatureScanner (HANDLE _processHandle)
 
virtual ~ProcessFeatureScanner ()
 

Protected Attributes

ModuleDatamoduleData
 
RemoteModuleDataremoteModData
 
- Protected Attributes inherited from pesieve::ProcessFeatureScanner
HANDLE processHandle
 

Detailed Description

A base class for all the scanners operating on module data.

Definition at line 17 of file module_scanner.h.

Constructor & Destructor Documentation

◆ ModuleScanner()

pesieve::ModuleScanner::ModuleScanner ( HANDLE _procHndl,
ModuleData & _moduleData,
RemoteModuleData & _remoteModData )
inline

Definition at line 19 of file module_scanner.h.

◆ ~ModuleScanner()

virtual pesieve::ModuleScanner::~ModuleScanner ( )
inlinevirtual

Definition at line 25 of file module_scanner.h.

Member Function Documentation

◆ scanRemote()

virtual ModuleScanReport * pesieve::ModuleScanner::scanRemote ( )
pure virtual

Perform the scan on the remote process

Returns
a pointer to an object of the class inherited from ModuleScanReport

Implements pesieve::ProcessFeatureScanner.

Implemented in pesieve::CodeScanner, pesieve::HeadersScanner, and pesieve::IATScanner.

Member Data Documentation

◆ moduleData

ModuleData& pesieve::ModuleScanner::moduleData
protected

Definition at line 30 of file module_scanner.h.

◆ remoteModData

RemoteModuleData& pesieve::ModuleScanner::remoteModData
protected

Definition at line 31 of file module_scanner.h.


The documentation for this class was generated from the following file: