PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Toggle main menu visibility
Main Page
Namespaces
Namespace List
Namespace Members
All
_
b
c
d
e
f
g
h
i
j
l
m
n
o
p
q
r
s
t
u
v
w
Functions
_
b
c
d
e
f
g
h
i
l
m
n
o
p
q
r
s
t
v
w
Variables
b
c
d
e
f
g
h
i
j
l
m
n
o
p
q
r
s
t
u
w
Typedefs
Enumerations
Enumerator
c
h
i
p
s
t
Classes
Class List
Class Index
Class Hierarchy
Class Members
All
_
a
b
c
d
e
f
g
h
i
j
l
m
n
o
p
q
r
s
t
u
v
w
~
Functions
_
a
b
c
d
e
f
g
h
i
l
m
n
o
p
r
s
t
u
v
w
~
Variables
_
a
b
c
d
e
f
h
i
j
l
m
n
o
p
q
r
s
t
u
v
w
Typedefs
Enumerations
Enumerator
i
o
r
s
Related Symbols
Files
File List
File Members
All
a
b
c
d
e
f
g
h
i
j
l
m
o
p
r
s
t
u
Functions
Variables
Typedefs
Enumerations
Enumerator
j
o
p
r
s
Macros
c
d
e
g
h
i
l
m
o
p
r
u
•
All
Classes
Namespaces
Files
Functions
Variables
Typedefs
Enumerations
Enumerator
Friends
Macros
Pages
Loading...
Searching...
No Matches
scanners
module_scanner.h
Go to the documentation of this file.
1
#pragma once
2
3
#include <windows.h>
4
#include <psapi.h>
5
#include <map>
6
7
#include <peconv.h>
8
#include "
module_scan_report.h
"
9
#include "
module_data.h
"
10
11
#include "
../utils/format_util.h
"
12
#include "
process_feature_scanner.h
"
13
14
namespace
pesieve
{
15
17
class
ModuleScanner
:
public
ProcessFeatureScanner
{
18
public
:
19
ModuleScanner
(HANDLE _procHndl,
ModuleData
&_moduleData,
RemoteModuleData
&_remoteModData)
20
:
ProcessFeatureScanner
(_procHndl),
21
moduleData
(_moduleData),
remoteModData
(_remoteModData)
22
{
23
}
19
ModuleScanner
(HANDLE _procHndl,
ModuleData
&_moduleData,
RemoteModuleData
&_remoteModData) {
…
}
24
25
virtual
~ModuleScanner
() {}
26
27
virtual
ModuleScanReport
*
scanRemote
() = 0;
28
29
protected
:
30
ModuleData
&
moduleData
;
31
RemoteModuleData
&
remoteModData
;
32
};
17
class
ModuleScanner
:
public
ProcessFeatureScanner
{
…
};
33
34
};
//namespace pesieve
pesieve::ModuleData
Loads a module from the disk, corresponding to the module in the scanned process' memory.
Definition
module_data.h:15
pesieve::ModuleScanReport
A base class of all the reports detailing on the output of the performed module's scan.
Definition
module_scan_report.h:56
pesieve::ModuleScanner::scanRemote
virtual ModuleScanReport * scanRemote()=0
pesieve::ModuleScanner::remoteModData
RemoteModuleData & remoteModData
Definition
module_scanner.h:31
pesieve::ModuleScanner::ModuleScanner
ModuleScanner(HANDLE _procHndl, ModuleData &_moduleData, RemoteModuleData &_remoteModData)
Definition
module_scanner.h:19
pesieve::ModuleScanner::~ModuleScanner
virtual ~ModuleScanner()
Definition
module_scanner.h:25
pesieve::ModuleScanner::moduleData
ModuleData & moduleData
Definition
module_scanner.h:30
pesieve::ProcessFeatureScanner::ProcessFeatureScanner
ProcessFeatureScanner(HANDLE _processHandle)
Definition
process_feature_scanner.h:15
pesieve::RemoteModuleData
Buffers the data from the module loaded in the scanned process into the local memory.
Definition
module_data.h:121
format_util.h
module_data.h
module_scan_report.h
pesieve
Definition
pesieve.py:1
process_feature_scanner.h
Generated by
1.13.2