PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include "imp_reconstructor.h"
#include "iat_finder.h"
#include "import_table_finder.h"
#include <fstream>
Go to the source code of this file.
Namespaces | |
namespace | pesieve |
Macros | |
#define | MIN_THUNKS_COUNT 2 |
Functions | |
BYTE * | pesieve::get_buffer_space_at (IN BYTE *buffer, IN const size_t buffer_size, IN const DWORD buffer_rva, IN const DWORD required_rva, IN const size_t required_size) |
#define MIN_THUNKS_COUNT 2 |
Definition at line 10 of file imp_reconstructor.cpp.