![]() |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|

Static Public Attributes | |
| int | PE_IMPREC_NONE = 0 |
| int | PE_IMPREC_AUTO = 1 |
| int | PE_IMPREC_UNERASE = 2 |
| int | PE_IMPREC_REBUILD0 = 3 |
| int | PE_IMPREC_REBUILD1 = 4 |
| int | PE_IMPREC_REBUILD2 = 5 |
| int | PE_IMPREC_MODES_COUNT = 6 |
Definition at line 43 of file pesieve.py.
|
static |
Definition at line 45 of file pesieve.py.
|
static |
Definition at line 50 of file pesieve.py.
|
static |
Definition at line 44 of file pesieve.py.
|
static |
Definition at line 47 of file pesieve.py.
|
static |
Definition at line 48 of file pesieve.py.
|
static |
Definition at line 49 of file pesieve.py.
|
static |
Definition at line 46 of file pesieve.py.