20 IN const peconv::ExportsMapper *exportsMap);
83 bool scanByOriginalTable(peconv::ImpsNotCovered &
not_covered);
86 void initExcludedPaths();
87 bool isInSystemDir(
const std::string &moduleName);
92 bool listAllImports(peconv::ImportsCollection &
collection);
94 const peconv::ExportsMapper &exportsMap;
100 std::string m_sysWow64Path_str;
101 std::string m_system32Path_str;
A report from an IAT scan, generated by IATScanner.
IATScanReport(HMODULE _module, size_t _moduleSize, std::string _moduleFile)
const bool hooksToJSON(std::stringstream &outs, size_t level)
static std::string formatHookedFuncName(IN peconv::ImportsCollection *storedFunc, DWORD thunk_rva)
static bool saveNotRecovered(IN std::string fileName, IN HANDLE hProcess, IN peconv::ImportsCollection *storedFunc, IN peconv::ImpsNotCovered ¬Covered, IN const ModulesInfo &modulesInfo, IN const peconv::ExportsMapper *exportsMap)
bool generateList(IN const std::string &fileName, IN HANDLE hProcess, IN const ModulesInfo &modulesInfo, IN const peconv::ExportsMapper *exportsMap)
peconv::ImportsCollection storedFunc
static std::string formatTargetName(IN const peconv::ExportsMapper *exportsMap, IN const ModulesInfo &modulesInfo, IN const ULONGLONG module_start, IN ULONGLONG addr)
peconv::ImpsNotCovered notCovered
virtual const bool toJSON(std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails)
A scanner for detection of IAT hooking.
IATScanner(HANDLE hProc, ModuleData &moduleData, RemoteModuleData &remoteModData, const peconv::ExportsMapper &_exportsMap, IN const ModulesInfo &_modulesInfo, t_iat_scan_mode _hooksFilter)
virtual IATScanReport * scanRemote()
Loads a module from the disk, corresponding to the module in the scanned process' memory.
A base class of all the reports detailing on the output of the performed module's scan.
virtual const bool _toJSON(std::stringstream &outs, size_t level=JSON_LEVEL, const pesieve::t_json_level &jdetails=JSON_BASIC)
A base class for all the scanners operating on module data.
RemoteModuleData & remoteModData
A container of all the process modules that were scanned.
Buffers the data from the module loaded in the scanned process into the local memory.
size_t fill_iat(BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN OUT IATBlock &iat, IN ThunkFoundCallback *callback)
@ JSON_DETAILS
include the basic list patches in the main JSON report
Final summary about the scanned process.