PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
hook_targets_resolver.h
Go to the documentation of this file.
1#pragma once
2
3#include "scan_report.h"
4#include "code_scanner.h"
5
6namespace pesieve {
7
10 {
11 public:
16
18 size_t resolveAllHooks(IN OUT std::set<ModuleScanReport*> &code_reports);
19
22
23 protected:
25 };
26
27}; //namespace pesieve
28
29
Processes the list of the collected patches (preprocessed by PatchAnalyzer), and for those of them th...
size_t resolveAllHooks(IN OUT std::set< ModuleScanReport * > &code_reports)
Resolves all the hooks collected within the given set of reports.
bool resolveTarget(IN OUT PatchList::Patch *currPatch)
Resolves the information about the target of the provided hook, and fills it back into the object.
HookTargetResolver(IN ProcessScanReport &process_report)
The report aggregating the results of the performed scan.
Definition scan_report.h:19
size_t fill_iat(BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN OUT IATBlock &iat, IN ThunkFoundCallback *callback)
Definition iat_finder.h:31