![]() |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include <module_cache.h>
Public Member Functions | |
| ModulesCache () | |
| ~ModulesCache () | |
| BYTE * | loadCached (LPSTR szModName, size_t &original_size) |
Static Public Attributes | |
| static const size_t | MinUsageCntr = 2 |
| how many times loading of the module must be requested before the module is added to cache | |
Protected Member Functions | |
| BYTE * | getMappedCached (const std::string &modName, size_t &mappedSize) |
| bool | isCacheAvailable (const size_t neededSize) |
| bool | prepareCacheSpace (const size_t neededSize, bool force_free) |
| bool | _deleteLeastRecent () |
| void | deleteCache () |
Protected Attributes | |
| std::map< std::string, size_t > | usageBeforeCounter |
| how many times loading of the same module was requested before it was cached | |
| std::map< std::string, CachedModule * > | cachedModules |
| the list of all the cached modules | |
| util::Mutex | cacheMutex |
Definition at line 52 of file module_cache.h.
|
inline |
Definition at line 58 of file module_cache.h.
|
inline |
|
inlineprotected |
Definition at line 104 of file module_cache.h.
|
inlineprotected |
Definition at line 139 of file module_cache.h.
|
inlineprotected |
|
protected |
| BYTE * pesieve::ModulesCache::loadCached | ( | LPSTR | szModName, |
| size_t & | original_size ) |
|
protected |
the list of all the cached modules
Definition at line 163 of file module_cache.h.
|
protected |
Definition at line 165 of file module_cache.h.
|
static |
how many times loading of the module must be requested before the module is added to cache
Definition at line 56 of file module_cache.h.
|
protected |
how many times loading of the same module was requested before it was cached
Definition at line 161 of file module_cache.h.