PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
This is the complete list of members for pesieve::ResultsDumper, including all inherited members.
baseDir | pesieve::ResultsDumper | protected |
dumpDetectedModules(HANDLE hProcess, bool isRefl, ProcessScanReport &process_report, const pesieve::t_dump_mode dump_mode, const t_imprec_mode imprec_mode, const bool rebase) | pesieve::ResultsDumper | |
dumpDir | pesieve::ResultsDumper | protected |
dumpJsonReport(ProcessScanReport &process_report, const t_results_filter &filter, const pesieve::t_json_level &jdetails) | pesieve::ResultsDumper | |
dumpJsonReport(ProcessDumpReport &process_report) | pesieve::ResultsDumper | |
dumpJsonReport(ErrorReport &error_report, const t_results_filter &filter) | pesieve::ResultsDumper | |
dumpModule(IN HANDLE processHandle, IN bool isRefl, IN const ModulesInfo &modulesInfo, IN ModuleScanReport *modReport, IN const peconv::ExportsMapper *exportsMap, IN const pesieve::t_dump_mode dump_mode, IN const pesieve::t_imprec_mode imprec_mode, IN bool rebase, OUT ProcessDumpReport &dumpReport) | pesieve::ResultsDumper | protected |
fillModuleCopy(IN ModuleScanReport *mod, IN OUT PeBuffer &module_buf) | pesieve::ResultsDumper | protected |
getOutputDir() | pesieve::ResultsDumper | inline |
makeAndJoinDirectories(std::stringstream &name_stream) | pesieve::ResultsDumper | protected |
makeDirName(const DWORD process_id) | pesieve::ResultsDumper | protected |
makeModuleDumpPath(ULONGLONG modBaseAddr, const std::string &fname, const std::string &defaultExtension) | pesieve::ResultsDumper | protected |
makeOutPath(const std::string &fname, const std::string &defaultExtension="") | pesieve::ResultsDumper | |
quiet | pesieve::ResultsDumper | protected |
ResultsDumper(std::string _baseDir, bool _quiet) | pesieve::ResultsDumper | inline |