PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
module_scanner.h
Go to the documentation of this file.
1#pragma once
2
3#include <windows.h>
4#include <psapi.h>
5#include <map>
6
7#include <peconv.h>
9#include "module_data.h"
10
13
14namespace pesieve {
15
18 public:
19 ModuleScanner(HANDLE _procHndl, ModuleData &_moduleData, RemoteModuleData &_remoteModData)
20 : ProcessFeatureScanner(_procHndl),
21 moduleData(_moduleData), remoteModData(_remoteModData)
22 {
23 }
24
25 virtual ~ModuleScanner() {}
26
28
29 protected:
32 };
33
34}; //namespace pesieve
Loads a module from the disk, corresponding to the module in the scanned process' memory.
Definition module_data.h:15
A base class of all the reports detailing on the output of the performed module's scan.
A base class for all the scanners operating on module data.
virtual ModuleScanReport * scanRemote()=0
RemoteModuleData & remoteModData
ModuleScanner(HANDLE _procHndl, ModuleData &_moduleData, RemoteModuleData &_remoteModData)
A base class for all the scanners checking appropriate process' features.
Buffers the data from the module loaded in the scanned process into the local memory.