PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
Public Types | Public Member Functions | Public Attributes | Protected Member Functions | Protected Attributes | List of all members
pesieve::RuleMatcher Class Referenceabstract

#include <stats_analyzer.h>

Inheritance diagram for pesieve::RuleMatcher:
Inheritance graph
[legend]

Public Types

enum  RuleType {
  RULE_NONE = 0 , RULE_CODE = 1 , RULE_TEXT = 2 , RULE_OBFUSCATED = 4 ,
  RULE_ENCRYPTED = 8
}
 

Public Member Functions

 RuleMatcher (std::string _name)
 
bool isMatching (IN const AreaMultiStats &stats)
 
bool isMatched ()
 

Public Attributes

std::string name
 

Protected Member Functions

virtual bool _isMatching (IN const AreaMultiStats &stats)=0
 

Protected Attributes

bool matched
 

Detailed Description

Definition at line 29 of file stats_analyzer.h.

Member Enumeration Documentation

◆ RuleType

Enumerator
RULE_NONE 
RULE_CODE 
RULE_TEXT 
RULE_OBFUSCATED 
RULE_ENCRYPTED 

Definition at line 33 of file stats_analyzer.h.

Constructor & Destructor Documentation

◆ RuleMatcher()

pesieve::RuleMatcher::RuleMatcher ( std::string _name)
inline

Definition at line 42 of file stats_analyzer.h.

Member Function Documentation

◆ _isMatching()

virtual bool pesieve::RuleMatcher::_isMatching ( IN const AreaMultiStats & stats)
protectedpure virtual

◆ isMatched()

bool pesieve::RuleMatcher::isMatched ( )
inline

Definition at line 53 of file stats_analyzer.h.

◆ isMatching()

bool pesieve::RuleMatcher::isMatching ( IN const AreaMultiStats & stats)
inline

Definition at line 47 of file stats_analyzer.h.

Here is the call graph for this function:

Member Data Documentation

◆ matched

bool pesieve::RuleMatcher::matched
protected

Definition at line 64 of file stats_analyzer.h.

◆ name

std::string pesieve::RuleMatcher::name

Definition at line 58 of file stats_analyzer.h.


The documentation for this class was generated from the following file: