PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
Classes | |
class | StdDeviationCalc |
Functions | |
template<typename T > | |
size_t | generateHistogram (IN T buffer[], IN size_t bufferSize, OUT std::map< T, size_t > &counts) |
template<typename T > | |
double | calcShannonEntropy (std::map< T, size_t > &histogram, size_t totalSize) |
size_t | fillCodeStrings (OUT std::set< std::string > &codeStrings) |
size_t | fetchPeakValues (IN const ChunkStats &currArea, IN double stdDev, int devCount, OUT std::set< BYTE > &peaks) |
size_t | valuesNotBelowMean (IN const ChunkStats &currArea, double mean) |
double | getPrintableRatio (IN const AreaMultiStats &stats) |
template<typename T > | |
std::string | hexdumpValue (const BYTE *in_buf, const size_t max_size) |
template<typename T > | |
T | getMostFrequentValue (IN std::map< size_t, std::set< T > > frequencies) |
template<typename T > | |
size_t | getMostFrequentValues (IN std::map< size_t, std::set< T > > frequencies, OUT std::set< T > &values) |
template<typename T > | |
bool | isAllPrintable (IN std::map< T, size_t > &histogram) |
Definition at line 118 of file stats_analyzer.cpp.
double pesieve::stats::getPrintableRatio | ( | IN const AreaMultiStats & | stats | ) |
size_t pesieve::stats::valuesNotBelowMean | ( | IN const ChunkStats & | currArea, |
double | mean ) |