![]() |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
This is the complete list of members for pesieve::ResultsDumper, including all inherited members.
| baseDir | pesieve::ResultsDumper | protected |
| dumpDetectedModules(HANDLE hProcess, bool isRefl, ProcessScanReport &process_report, const pesieve::t_dump_mode dump_mode, const t_imprec_mode imprec_mode, const bool rebase) | pesieve::ResultsDumper | |
| dumpDir | pesieve::ResultsDumper | protected |
| dumpJsonReport(ProcessScanReport &process_report, const t_results_filter &filter, const pesieve::t_json_level &jdetails) | pesieve::ResultsDumper | |
| dumpJsonReport(ProcessDumpReport &process_report) | pesieve::ResultsDumper | |
| dumpJsonReport(ErrorReport &error_report, const t_results_filter &filter) | pesieve::ResultsDumper | |
| dumpModule(IN HANDLE processHandle, IN bool isRefl, IN const ModulesInfo &modulesInfo, IN ModuleScanReport *modReport, IN const peconv::ExportsMapper *exportsMap, IN const pesieve::t_dump_mode dump_mode, IN const pesieve::t_imprec_mode imprec_mode, IN bool rebase, OUT ProcessDumpReport &dumpReport) | pesieve::ResultsDumper | protected |
| fillModuleCopy(IN ModuleScanReport *mod, IN OUT PeBuffer &module_buf) | pesieve::ResultsDumper | protected |
| getOutputDir() | pesieve::ResultsDumper | inline |
| makeAndJoinDirectories(std::stringstream &name_stream) | pesieve::ResultsDumper | protected |
| makeDirName(const DWORD process_id) | pesieve::ResultsDumper | protected |
| makeModuleDumpPath(ULONGLONG modBaseAddr, const std::string &fname, const std::string &defaultExtension) | pesieve::ResultsDumper | protected |
| makeOutPath(const std::string &fname, const std::string &defaultExtension="") | pesieve::ResultsDumper | |
| quiet | pesieve::ResultsDumper | protected |
| ResultsDumper(std::string _baseDir, bool _quiet) | pesieve::ResultsDumper | inline |