PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
module_cache.cpp
Go to the documentation of this file.
1#include "module_cache.h"
2
3BYTE* pesieve::ModulesCache::loadCached(LPSTR szModName, size_t& module_size)
4{
6 if (mapped_pe) {
7 return mapped_pe; // retrieved from cache
8 }
9 size_t raw_size = 0;
10 BYTE* raw_buf = peconv::load_file(szModName, raw_size);
11 if (!raw_buf) {
12 return nullptr; // failed to load the file
13 }
14
15 bool force_free_cache = false;
16 // Add to cache if needed...
17 {
19 size_t currCntr = usageBeforeCounter[szModName]++;
20 const size_t cachedModulesCntr = cachedModules.size();
23 bool is_cached = false;
24 CachedModule* mod_cache = new(std::nothrow) CachedModule(raw_buf, raw_size);
25 if (mod_cache) {
26 if (mod_cache->moduleData) {
27 cachedModules[szModName] = mod_cache;
28 is_cached = true;
29#ifdef _DEBUG
30 std::cout << "Added to cache: " << szModName << " Total cached: " << cachedModulesCntr << "\n";
31#endif
32 }
33 }
34 if (!is_cached) {
35 delete mod_cache;
36 // possibly running out of memory, make sure to free some cache:
37 force_free_cache = true;
38 }
39 }
40 }
41
42 // after adding file to the cache, wipe out the old ones:
44
45 // return the mapped module:
46 mapped_pe = peconv::load_pe_module(raw_buf, raw_size, module_size, false, false);
47 peconv::free_file(raw_buf);
48 return mapped_pe;
49}
BYTE * getMappedCached(const std::string &modName, size_t &mappedSize)
bool prepareCacheSpace(bool force_free=false)
BYTE * loadCached(LPSTR szModName, size_t &original_size)
std::map< std::string, CachedModule * > cachedModules
the list of all the cached modules
static const size_t MaxCachedModules
how many modules can be stored in the cache at the time
static const size_t MinUsageCntr
how many times loading of the module must be requested before the module is added to cache
std::map< std::string, size_t > usageBeforeCounter
how many times loading of the same module was requested before it was cached
size_t fill_iat(BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN OUT IATBlock &iat, IN ThunkFoundCallback *callback)
Definition iat_finder.h:31