PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
A class containing callbacks for functions: find_iat, fill_iat. More...
#include <iat_finder.h>
Public Member Functions | |
ThunkFoundCallback () | |
virtual bool | shouldProcessVA (ULONGLONG va)=0 |
the callback that will be called for each candidate for the imported function VA | |
virtual bool | shouldAcceptExport (ULONGLONG va, const peconv::ExportedFunc &exp)=0 |
the callback that will be called validly resolved import | |
A class containing callbacks for functions: find_iat, fill_iat.
Definition at line 15 of file iat_finder.h.
|
inline |
Definition at line 18 of file iat_finder.h.
|
pure virtual |
the callback that will be called validly resolved import
|
pure virtual |
the callback that will be called for each candidate for the imported function VA