PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
pesieve.t_report Class Reference
Inheritance diagram for pesieve.t_report:

Static Protected Attributes

list _fields_
 

Detailed Description

Definition at line 123 of file pesieve.py.

Member Data Documentation

◆ _fields_

list pesieve.t_report._fields_
staticprotected
Initial value:
= [
('pid', ctypes.c_ulong),
('is_managed', ctypes.c_bool),
('is_64bit', ctypes.c_bool),
('is_reflection', ctypes.c_bool),
('scanned', ctypes.c_ulong),
('suspicious', ctypes.c_ulong),
('replaced', ctypes.c_ulong),
('hdr_mod', ctypes.c_ulong),
('unreachable_file', ctypes.c_ulong),
('patched', ctypes.c_ulong),
('iat_hooked', ctypes.c_ulong),
('implanted', ctypes.c_ulong),
('implanted_pe', ctypes.c_ulong),
('implanted_shc', ctypes.c_ulong),
('other', ctypes.c_ulong),
('skipped', ctypes.c_ulong),
('errors', ctypes.c_ulong)
]

Definition at line 124 of file pesieve.py.


The documentation for this class was generated from the following file: