PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
params_dump.cpp
Go to the documentation of this file.
1#include "params_dump.h"
2
4
5void pesieve::params_fields_to_JSON(pesieve::t_params& params, std::stringstream& outs, size_t level)
6{
8 OUT_PADDED(outs, level, "\"modules_ignored\" : ");
9 outs << "\"" << params.modules_ignored.buffer << "\"" << ",\n";
10 }
11 if (params.data) {
12 OUT_PADDED(outs, level, "\"data\" : ");
13 outs << std::dec << params.data << ",\n";
14 }
16 OUT_PADDED(outs, level, "\"dotnet_policy\" : ");
17 outs << std::dec << params.dotnet_policy << ",\n";
18 }
19
21 OUT_PADDED(outs, level, "\"use_reflection\" : ");
22 outs << std::dec << params.make_reflection << ",\n";
23 }
24 if (params.use_cache) {
25 OUT_PADDED(outs, level, "\"use_cache\" : ");
26 outs << std::dec << params.use_cache << ",\n";
27 }
28 if (params.out_filter) {
29 OUT_PADDED(outs, level, "\"out_filter\" : ");
30 outs << std::dec << params.out_filter << ",\n";
31 }
32 if (params.imprec_mode) {
33 OUT_PADDED(outs, level, "\"imprec_mode\" : ");
34 outs << std::dec << params.imprec_mode << ",\n";
35 }
36
37 OUT_PADDED(outs, level, "\"hooks\" : ");
38 outs << std::dec << (params.no_hooks ? 0 : 1) << ",\n";
39
40 OUT_PADDED(outs, level, "\"iat\" : ");
41 outs << std::dec << params.iat << ",\n";
42
43 OUT_PADDED(outs, level, "\"threads\" : ");
44 outs << std::dec << params.threads << ",\n";
45
46 OUT_PADDED(outs, level, "\"shellcode\" : ");
47 outs << std::dec << params.shellcode << ",\n";
48
49 OUT_PADDED(outs, level, "\"obfuscated\" : ");
50 outs << std::dec << params.obfuscated << "\n";
51}
52
53
54void pesieve::params_to_JSON(pesieve::t_params& params, std::stringstream& stream, size_t level)
55{
56 OUT_PADDED(stream, level, "\"pesieve_params\" : {\n");
57 params_fields_to_JSON(params, stream, level + 1);
58 OUT_PADDED(stream, level, "}");
59}
#define OUT_PADDED(stream, field_size, str)
Definition format_util.h:12
void params_fields_to_JSON(pesieve::t_params &params, std::stringstream &outs, size_t level)
void params_to_JSON(pesieve::t_params &params, std::stringstream &stream, size_t start_level)
Input parameters for PE-sieve, defining the configuration.
bool make_reflection
operate on a process reflection rather than on the live process (this allows i.e. to force-read inacc...
t_shellc_mode shellcode
detect shellcode implants
t_dotnet_policy dotnet_policy
policy for scanning .NET modules
bool no_hooks
don't scan for hooks
bool use_cache
enable cache for the scanned modules
PARAM_STRING modules_ignored
a list of modules that will not be scanned, separated by PARAM_LIST_SEPARATOR
t_imprec_mode imprec_mode
import recovery mode
t_obfusc_mode obfuscated
detect encrypted or obfuscated content (possible encrypted shellcodes)
t_iat_scan_mode iat
detect IAT hooking
bool threads
scan threads
t_output_filter out_filter
level of details of the created output material
t_data_scan_mode data
should scan non-executable pages?