![]() |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include <thread_scanner.h>
Public Member Functions | |
| SuspAddrReport (ULONGLONG _module=0, size_t _moduleSize=0, DWORD _allocProtection=0) | |
| void | print () |
| const bool | toJSON (std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails) const |
| void | addSuspAddr (ULONGLONG addr) |
| bool | addressesToJSON (std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails) const |
| bool | moduleInfoToJSON (std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails) const |
Public Attributes | |
| ULONG_PTR | module |
| size_t | moduleSize |
| std::set< ULONGLONG > | suspAddresses |
| DWORD | alloc_protection |
| DWORD | curr_protection |
| AreaEntropyStats | stats |
| bool | is_code |
Definition at line 73 of file thread_scanner.h.
|
inline |
Definition at line 75 of file thread_scanner.h.
|
inline |
Definition at line 111 of file thread_scanner.h.
|
inline |
Definition at line 106 of file thread_scanner.h.
|
inline |
Definition at line 140 of file thread_scanner.h.
|
inline |
Definition at line 82 of file thread_scanner.h.
|
inline |
| DWORD pesieve::SuspAddrReport::alloc_protection |
Definition at line 178 of file thread_scanner.h.
| DWORD pesieve::SuspAddrReport::curr_protection |
Definition at line 179 of file thread_scanner.h.
| bool pesieve::SuspAddrReport::is_code |
Definition at line 181 of file thread_scanner.h.
| ULONG_PTR pesieve::SuspAddrReport::module |
Definition at line 175 of file thread_scanner.h.
| size_t pesieve::SuspAddrReport::moduleSize |
Definition at line 176 of file thread_scanner.h.
| AreaEntropyStats pesieve::SuspAddrReport::stats |
Definition at line 180 of file thread_scanner.h.
| std::set<ULONGLONG> pesieve::SuspAddrReport::suspAddresses |
Definition at line 177 of file thread_scanner.h.