PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
module_scanner.h
Go to the documentation of this file.
1#pragma once
2
3#include <windows.h>
4#include <psapi.h>
5#include <map>
6
7#include <peconv.h>
9#include "module_data.h"
10
13
14namespace pesieve {
15
33
34}; //namespace pesieve
Loads a module from the disk, corresponding to the module in the scanned process' memory.
Definition module_data.h:15
A base class of all the reports detailing on the output of the performed module's scan.
A base class for all the scanners operating on module data.
virtual ModuleScanReport * scanRemote()=0
RemoteModuleData & remoteModData
ModuleScanner(HANDLE _procHndl, ModuleData &_moduleData, RemoteModuleData &_remoteModData)
A base class for all the scanners checking appropriate process' features.
Buffers the data from the module loaded in the scanned process into the local memory.
size_t fill_iat(BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN OUT IATBlock &iat, IN ThunkFoundCallback *callback)
Definition iat_finder.h:31