![]() |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include <patch_list.h>
Classes | |
| class | Patch |
Public Member Functions | |
| PatchList & | operator= (const PatchList &other) |
| PatchList () | |
| virtual | ~PatchList () |
| void | insert (Patch *p) |
| size_t | size () |
| const size_t | toTAGs (std::ofstream &patch_report, const char delimiter) |
| const bool | toJSON (std::stringstream &outs, size_t level, bool short_info) |
| size_t | checkForHookedExports (peconv::ExportsMapper &expMap) |
| void | deletePatches () |
Public Attributes | |
| std::vector< Patch * > | patches |
Definition at line 20 of file patch_list.h.
|
inline |
Definition at line 120 of file patch_list.h.
|
inlinevirtual |
| size_t pesieve::PatchList::checkForHookedExports | ( | peconv::ExportsMapper & | expMap | ) |
| void pesieve::PatchList::deletePatches | ( | ) |
Definition at line 180 of file patch_list.cpp.
|
inline |
Definition at line 127 of file patch_list.h.
|
inline |
Definition at line 132 of file patch_list.h.
| const size_t pesieve::PatchList::toTAGs | ( | std::ofstream & | patch_report, |
| const char | delimiter ) |
| std::vector<Patch*> pesieve::PatchList::patches |
Definition at line 147 of file patch_list.h.