PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Toggle main menu visibility
Main Page
Namespaces
Namespace List
Namespace Members
All
_
b
c
d
e
f
g
h
i
j
l
m
n
o
p
q
r
s
t
u
v
w
Functions
_
b
c
d
e
f
g
h
i
l
m
n
o
p
q
r
s
t
v
w
Variables
b
c
d
e
f
g
h
i
j
l
m
n
o
p
q
r
s
t
u
w
Typedefs
Enumerations
Enumerator
c
h
i
p
s
t
Classes
Class List
Class Index
Class Hierarchy
Class Members
All
_
a
b
c
d
e
f
g
h
i
j
l
m
n
o
p
q
r
s
t
u
v
w
~
Functions
_
a
b
c
d
e
f
g
h
i
l
m
n
o
p
r
s
t
u
v
w
~
Variables
_
a
b
c
d
e
f
h
i
j
l
m
n
o
p
q
r
s
t
u
v
w
Typedefs
Enumerations
Enumerator
i
o
r
s
Related Symbols
Files
File List
File Members
All
a
b
c
d
e
f
g
h
i
j
l
m
o
p
r
s
t
u
Functions
Variables
Typedefs
Enumerations
Enumerator
j
o
p
r
s
Macros
c
d
e
g
h
i
l
m
o
p
r
u
•
All
Classes
Namespaces
Files
Functions
Variables
Typedefs
Enumerations
Enumerator
Friends
Macros
Pages
Loading...
Searching...
No Matches
dll_main.cpp
Go to the documentation of this file.
1
5
6
#include <windows.h>
7
#include <string>
8
#include <iostream>
9
10
#define PESIEVE_EXPORTS
11
#include <
pe_sieve_api.h
>
12
13
BOOL WINAPI
DllMain
(HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
14
{
15
switch
(fdwReason)
16
{
17
case
DLL_PROCESS_ATTACH:
18
case
DLL_THREAD_ATTACH:
19
case
DLL_THREAD_DETACH:
20
case
DLL_PROCESS_DETACH:
21
break
;
22
}
23
return
TRUE;
24
}
13
BOOL WINAPI
DllMain
(HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
…
}
25
DllMain
BOOL WINAPI DllMain(HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
Definition
dll_main.cpp:13
pe_sieve_api.h
The API: definitions of the exported elements that are accessible from PE-sieve DLL.
Generated by
1.13.2