![]() |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include "path_converter.h"#include <windows.h>#include "ntddk.h"#include <shlwapi.h>#include <iostream>#include <string>#include <locale>#include <codecvt>#include "path_util.h"Go to the source code of this file.
Namespaces | |
| namespace | pesieve |
| namespace | pesieve::util |
Macros | |
| #define | LONG_PATH_PREFIX "\\\\?\\" |
| #define | GLOBALROOT_NAME "GLOBALROOT" |
Functions | |
| void | pesieve::util::init_syspaths () |
| HANDLE | pesieve::util::nt_create_file (PCWSTR filePath) |
| std::string | pesieve::util::nt_retrieve_file_path (HANDLE hFile) |
| bool | pesieve::util::is_relative (const char *path, size_t path_len) |
| bool | pesieve::util::is_disk_relative (const char *path, size_t path_len) |
| std::string | pesieve::util::remap_to_drive_letter (const std::string &full_path) |
| std::string | pesieve::util::relative_to_absolute_path (std::string path) |
| std::string | pesieve::util::replace_char (std::string &str, char ch1, char ch2) |
| bool | is_device_path (const std::string &path) |
Variables | |
| char | g_System32Path [MAX_PATH] = { 0 } |
| char | g_Syswow64Path [MAX_PATH] = { 0 } |
| #define GLOBALROOT_NAME "GLOBALROOT" |
Definition at line 19 of file path_converter.cpp.
| #define LONG_PATH_PREFIX "\\\\?\\" |
Definition at line 18 of file path_converter.cpp.
| bool is_device_path | ( | const std::string & | path | ) |
Definition at line 240 of file path_converter.cpp.
| char g_System32Path[MAX_PATH] = { 0 } |
Definition at line 21 of file path_converter.cpp.
| char g_Syswow64Path[MAX_PATH] = { 0 } |
Definition at line 22 of file path_converter.cpp.