Class Hierarchy

Go to the graphical class hierarchy

This inheritance list is sorted roughly, but not completely, alphabetically:

[detail level 123]

Cpesieve::_ctx_details	A custom structure keeping a fragment of a thread context
Cpesieve::util::_mem_region_info
C_PARAM_STRING	A wrapper for a dynamically allocated string
Cpesieve::_process_details
Cpesieve::_t_pattern
C_t_stack_enum_params
Cpesieve::util::_thread_info
Cpesieve::util::_thread_info_ext
Cpesieve::util::_THREAD_LAST_SYSCALL_INFORMATION
Cpesieve::AreaInfo
►Cpesieve::AreaStats	Base class for the statistics from analyzed buffer
Cpesieve::AreaEntropyStats
Cpesieve::AreaMultiStats
Cpesieve::AreaStatsCalculator	A class responsible for filling in the statistics with the data from the particular buffer
Cpesieve::ArtefactScanner::ArtefactsMapping
Cpesieve::util::AutoBuffer
►Cpesieve::util::BasicBuffer
Cpesieve::util::ByteBuffer
►Cctypes.c_int
Cpesieve.t_data_scan_mode
Cpesieve.t_dotnet_policy
Cpesieve.t_dump_mode
Cpesieve.t_iat_scan_mode
Cpesieve.t_imprec_mode
Cpesieve.t_json_level
Cpesieve.t_obfusc_mode
Cpesieve.t_output_filter
Cpesieve.t_report_type
Cpesieve.t_results_filter
Cpesieve.t_shellc_mode
Cpesieve::CachedModule
Cpesieve::ChunkStats	Statistics from a block of data
Cpesieve::ErrorReport
Cpesieve::HookTargetResolver	Processes the list of the collected patches (preprocessed by PatchAnalyzer), and for those of them that were detected as hooks, it resolves information about to which modules do they lead to
Cpesieve::IATBlock
Cpesieve::IATThunksSeries
Cpesieve::IATThunksSeriesPtrCompare
Cpesieve::ImportTableBuffer
Cpesieve::ImpReconstructor
Cpesieve::MemPageData
Cpesieve::ModuleData	Loads a module from the disk, corresponding to the module in the scanned process' memory
Cpesieve::ModuleDumpReport
Cpesieve::ModulesCache
►Cpesieve::ModuleScanReport	A base class of all the reports detailing on the output of the performed module's scan
Cpesieve::CodeScanReport	A report from the code scan, generated by CodeScanner
Cpesieve::HeadersScanReport	A report from the headers scan, generated by HeadersScanner
Cpesieve::IATScanReport	A report from an IAT scan, generated by IATScanner
Cpesieve::MalformedHeaderReport
Cpesieve::MappingScanReport
Cpesieve::SkippedModuleReport
Cpesieve::ThreadScanReport	A report from the thread scan, generated by ThreadScanner
Cpesieve::UnreachableModuleReport
►Cpesieve::WorkingSetScanReport	A report from the working set scan, generated by WorkingSetScanner
Cpesieve::ArtefactScanReport	A report from the artefacts scan, generated by ArtefactScanner
Cpesieve::ModulesInfo	A container of all the process modules that were scanned
Cpesieve::util::Mutex
Cpesieve::util::MutexLocker
►CParams
CPEsieveParams
Cparams	Input parameters for PE-sieve, defining the configuration
Cpesieve::PatchList::Patch
Cpesieve::PatchAnalyzer	A postprocessor of the detected code patches. Detects if the patch is a hook, and if so, tries to indentify the address where it leads to
Cpesieve::PatchList
Cpesieve::PatternMatcher
Cpesieve::PeArtefacts	A report about the PE artefact detected in the workingset
Cpesieve::PeBuffer
Cpesieve::PeReconstructor
Cpesieve::PeSection	Buffers the defined PE section belonging to the module loaded in the scanned process into the local memory
Cpesieve::ProcessDumpReport	The report aggregating the results of the performed dumps
►Cpesieve::ProcessFeatureScanner	A base class for all the scanners checking appropriate process' features
Cpesieve::ArtefactScanner	A scanner for detection of artefacts related to PE implants in the process workingset
Cpesieve::MappingScanner	A scanner for detection of inconsistencies in mapping. Checks if the mapped file name is different than the module file name
►Cpesieve::ModuleScanner	A base class for all the scanners operating on module data
Cpesieve::CodeScanner	A scanner for detection of patches in the code
Cpesieve::HeadersScanner	A scanner for detection of PE header's modifications
Cpesieve::IATScanner	A scanner for detection of IAT hooking
Cpesieve::ThreadScanner
Cpesieve::WorkingSetScanner	A scanner for detection of code implants in the process workingset
Cpesieve::ProcessScanner	The root scanner, responsible for enumerating all the elements to be scanned within a given process, and performing apropriate scans on them
Cpesieve::ProcessScanReport	The report aggregating the results of the performed scan
CProcessSymbolsManager
Cpesieve::util::PSS_VA_CLONE_INFORMATION
Cpesieve::RemoteModuleData	Buffers the data from the module loaded in the scanned process into the local memory
Creport	Final summary about the scanned process
Cpesieve::ReportEx	The final report about the actions performed on the process: scanning and dumping
Cpesieve::ResultsDumper
►Cpesieve::RuleMatcher
Cpesieve::CodeMatcher
Cpesieve::EncryptedMatcher
Cpesieve::ObfuscatedMatcher
Cpesieve::TextMatcher
Cpesieve::RuleMatchersSet
Cpesieve::ScannedModule	Represents a basic info about the scanned module, such as its base offset, size, and the status
►Cpesieve::StatsSettings	Base class for settings defining what type of stats should be collected
Cpesieve::MultiStatsSettings	Settings defining what type of stats should be collected
Cpesieve::stats::StdDeviationCalc
►Cctypes.Structure
Cpesieve.PARAM_STRING
Cpesieve.t_params
Cpesieve.t_report
Cpesieve::SyscallTable
Cpesieve::util::T_CLIENT_ID
Cpesieve::util::t_refl_args
Cpesieve::util::T_RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION
Cpesieve::ThunkFoundCallback	A class containing callbacks for functions: find_iat, fill_iat