PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
iat_finder.h File Reference
#include <windows.h>
#include <peconv.h>
#include "iat_block.h"

Go to the source code of this file.

Classes

class  pesieve::ThunkFoundCallback
 A class containing callbacks for functions: find_iat, fill_iat. More...
 

Namespaces

namespace  pesieve
 

Macros

#define MASK_TO_DWORD(val)
 

Functions

template<typename FIELD_T >
size_t pesieve::fill_iat (BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN OUT IATBlock &iat, IN ThunkFoundCallback *callback)
 
template<typename FIELD_T >
IATBlockpesieve::find_iat (BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN size_t search_offset, IN ThunkFoundCallback *callback)
 

Macro Definition Documentation

◆ MASK_TO_DWORD

#define MASK_TO_DWORD ( val)
Value:
(val & 0xffffffff)

Definition at line 9 of file iat_finder.h.