PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include <stats_analyzer.h>
Public Types | |
enum | RuleType { RULE_NONE = 0 , RULE_CODE = 1 , RULE_TEXT = 2 , RULE_OBFUSCATED = 4 , RULE_ENCRYPTED = 8 } |
Public Member Functions | |
RuleMatcher (std::string _name) | |
bool | isMatching (IN const AreaMultiStats &stats) |
bool | isMatched () |
Public Attributes | |
std::string | name |
Protected Member Functions | |
virtual bool | _isMatching (IN const AreaMultiStats &stats)=0 |
Protected Attributes | |
bool | matched |
Definition at line 29 of file stats_analyzer.h.
Enumerator | |
---|---|
RULE_NONE | |
RULE_CODE | |
RULE_TEXT | |
RULE_OBFUSCATED | |
RULE_ENCRYPTED |
Definition at line 33 of file stats_analyzer.h.
|
inline |
Definition at line 42 of file stats_analyzer.h.
|
protectedpure virtual |
Implemented in pesieve::CodeMatcher, pesieve::EncryptedMatcher, pesieve::ObfuscatedMatcher, and pesieve::TextMatcher.
|
inline |
Definition at line 53 of file stats_analyzer.h.
|
inline |
|
protected |
Definition at line 64 of file stats_analyzer.h.
std::string pesieve::RuleMatcher::name |
Definition at line 58 of file stats_analyzer.h.