mapping_scanner.h

Go to the documentation of this file.

 
#pragma once
 
#include <windows.h>
 
#include "module_scanner.h"
#include "../utils/path_util.h"
#include "process_feature_scanner.h"
 
namespace pesieve {
 
    class MappingScanReport : public ModuleScanReport
    {
    public:
        MappingScanReport(HMODULE _module, size_t _moduleSize)
            : ModuleScanReport(_module, _moduleSize)
        {
        }
        MappingScanReport(HMODULE _module, size_t _moduleSize) {…}
 
        const virtual void fieldsToJSON(std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails)
        {
            OUT_PADDED(outs, level, "\"module\" : ");
            outs << "\"" << std::hex << (ULONGLONG)module << "\"" << ",\n";
 
            OUT_PADDED(outs, level, "\"module_file\" : \"" << pesieve::util::escape_path_separators(this->moduleFile) << "\"");
            outs << ",\n";
            OUT_PADDED(outs, level, "\"mapped_file\" : \"" << pesieve::util::escape_path_separators(this->mappedFile) << "\"");
 
            outs << ",\n";
            OUT_PADDED(outs, level, "\"status\" : ");
            outs << std::dec << status;
        }
        const virtual void fieldsToJSON(std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails) {…}
 
        const virtual bool toJSON(std::stringstream& outs, size_t level, const pesieve::t_json_level &jdetails)
        {
            OUT_PADDED(outs, level, "\"mapping_scan\" : ");
            outs << "{\n";
            fieldsToJSON(outs, level + 1, jdetails);
            outs << "\n";
            OUT_PADDED(outs, level, "}");
            return true;
        }
        const virtual bool toJSON(std::stringstream& outs, size_t level, const pesieve::t_json_level &jdetails) {…}
 
        std::string mappedFile;
    };
    class MappingScanReport : public ModuleScanReport {…};
 

    class MappingScanner : public ProcessFeatureScanner {
    public:
        MappingScanner(HANDLE hProc, ModuleData &moduleData)
            : ProcessFeatureScanner(hProc), moduleData(moduleData)
        {
        }
        MappingScanner(HANDLE hProc, ModuleData &moduleData) {…}
 
        virtual MappingScanReport* scanRemote();
 
        ModuleData &moduleData;
    };
    class MappingScanner : public ProcessFeatureScanner {…};
 
}; //namespace pesieve