PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
imp_reconstructor.cpp File Reference
#include "imp_reconstructor.h"
#include "iat_finder.h"
#include "import_table_finder.h"
#include <fstream>

Go to the source code of this file.

Namespaces

namespace  pesieve
 

Macros

#define MIN_THUNKS_COUNT   2
 

Functions

BYTE * pesieve::get_buffer_space_at (IN BYTE *buffer, IN const size_t buffer_size, IN const DWORD buffer_rva, IN const DWORD required_rva, IN const size_t required_size)
 

Macro Definition Documentation

◆ MIN_THUNKS_COUNT

#define MIN_THUNKS_COUNT   2

Definition at line 10 of file imp_reconstructor.cpp.