PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
pesieve::PatchAnalyzer Member List

This is the complete list of members for pesieve::PatchAnalyzer, including all inherited members.

_analyze(PatchList::Patch &patch, PBYTE patch_ptr, ULONGLONG patch_va)pesieve::PatchAnalyzerprotected
_analyzeRelocated(PatchList::Patch &patch, BYTE *patch_ptr)pesieve::PatchAnalyzerprotected
analyze(PatchList::Patch &patch)pesieve::PatchAnalyzer
codeSizepesieve::PatchAnalyzerprotected
getJmpDestAddr(ULONGLONG currVA, int instrLen, DELTA_T lVal)pesieve::PatchAnalyzerprotected
is64Modifier(BYTE op)pesieve::PatchAnalyzerprotected
isLongModifier(BYTE op)pesieve::PatchAnalyzerprotected
isModule64bitpesieve::PatchAnalyzerprotected
moduleDatapesieve::PatchAnalyzerprotected
OP_CALL_DWORD enum valuepesieve::PatchAnalyzer
OP_JMP enum valuepesieve::PatchAnalyzer
OP_JMP_VIA_ADDR_B1 enum valuepesieve::PatchAnalyzer
OP_JMP_VIA_ADDR_B2 enum valuepesieve::PatchAnalyzer
OP_PUSH_DWORD enum valuepesieve::PatchAnalyzer
OP_SHORTJMP enum valuepesieve::PatchAnalyzer
parseJmp(PatchList::Patch &patch, PBYTE patch_ptr, ULONGLONG patch_va)pesieve::PatchAnalyzerprotected
parseJmpViaAddr(PatchList::Patch &patch, PBYTE patch_ptr, ULONGLONG patch_va)pesieve::PatchAnalyzerprotected
parseMovJmp(PatchList::Patch &patch, PBYTE patch_ptr, bool is_long)pesieve::PatchAnalyzerprotected
parsePushRet(PatchList::Patch &patch, PBYTE patch_ptr)pesieve::PatchAnalyzerprotected
parseShortJmp(PatchList::Patch &patch, PBYTE patch_ptr, ULONGLONG patch_va)pesieve::PatchAnalyzerprotected
PatchAnalyzer(ModuleData &_moduleData, DWORD _sectionRVA, PBYTE patched_code, size_t code_size)pesieve::PatchAnalyzerinline
patchedCodepesieve::PatchAnalyzerprotected
relocspesieve::PatchAnalyzerprotected
sectionRVApesieve::PatchAnalyzerprotected
t_hook_opcode enum namepesieve::PatchAnalyzer