![]() |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include <patch_list.h>
Public Member Functions | |
| Patch (HMODULE module_base, size_t patch_id, DWORD start_rva) | |
| Patch (const Patch &other) | |
| void | setEnd (DWORD end_rva) |
| void | setHookTarget (ULONGLONG target_va, bool is_direct=true, t_patch_type hook_type=pesieve::HOOK_INLINE) |
| ULONGLONG | getHookTargetVA () |
| bool | setHookTargetInfo (ULONGLONG targetModuleBase, bool isSuspicious, std::string targetModuleName) |
| const bool | toTAG (std::ofstream &patch_report, const char delimiter) |
| const bool | toJSON (std::stringstream &outs, size_t level, bool short_info) |
Protected Member Functions | |
| bool | resolveHookedExport (peconv::ExportsMapper &expMap) |
| std::string | getFormattedName () |
Protected Attributes | |
| size_t | id |
| DWORD | startRva |
| DWORD | endRva |
| HMODULE | moduleBase |
| t_patch_type | type |
| bool | isDirect |
| ULONGLONG | hookTargetVA |
| BYTE | paddingVal |
| std::string | hooked_func |
| ULONGLONG | hookTargetModule |
| bool | isTargetSuspicious |
| std::string | hookTargetModName |
Friends | |
| class | PatchList |
| class | PatchAnalyzer |
Definition at line 22 of file patch_list.h.
|
inline |
Definition at line 25 of file patch_list.h.
|
inline |
|
protected |
Definition at line 8 of file patch_list.cpp.
|
inline |
Definition at line 64 of file patch_list.h.
|
protected |
Definition at line 124 of file patch_list.cpp.
|
inline |
Definition at line 52 of file patch_list.h.
|
inline |
Definition at line 57 of file patch_list.h.
|
inline |
Definition at line 69 of file patch_list.h.
| const bool pesieve::PatchList::Patch::toTAG | ( | std::ofstream & | patch_report, |
| const char | delimiter ) |
|
friend |
Definition at line 104 of file patch_list.h.
|
friend |
Definition at line 103 of file patch_list.h.
|
protected |
Definition at line 90 of file patch_list.h.
|
protected |
Definition at line 97 of file patch_list.h.
|
protected |
Definition at line 101 of file patch_list.h.
|
protected |
Definition at line 99 of file patch_list.h.
|
protected |
Definition at line 95 of file patch_list.h.
|
protected |
Definition at line 88 of file patch_list.h.
|
protected |
Definition at line 94 of file patch_list.h.
|
protected |
Definition at line 100 of file patch_list.h.
|
protected |
Definition at line 91 of file patch_list.h.
|
protected |
Definition at line 96 of file patch_list.h.
|
protected |
Definition at line 89 of file patch_list.h.
|
protected |
Definition at line 93 of file patch_list.h.