PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
pe_sieve.cpp File Reference
#include "pe_sieve.h"
#include <peconv.h>
#include <windows.h>
#include "scanners/scanner.h"
#include "utils/format_util.h"
#include "utils/process_util.h"
#include "utils/process_privilege.h"
#include "utils/process_minidump.h"
#include "utils/path_converter.h"
#include "postprocessors/results_dumper.h"
#include "utils/process_reflection.h"
#include "utils/console_color.h"
#include "color_scheme.h"
#include "utils/artefacts_util.h"
#include "utils/syscall_extractor.h"

Go to the source code of this file.

Namespaces

namespace  pesieve
 

Functions

void pesieve::check_access_denied (DWORD processID)
 
bool pesieve::is_scanner_compatible (IN HANDLE hProcess)
 
HANDLE pesieve::open_process (DWORD processID, bool reflection, bool quiet)
 
pesieve::ProcessDumpReportpesieve::make_dump (IN HANDLE hProcess, IN bool isRefl, IN const pesieve::t_params &args, IN ProcessScanReport &process_report)
 
bool pesieve::is_by_patterns (const t_shellc_mode &shellc_mode)
 

Variables

pesieve::PatternMatcher g_Matcher
 
pesieve::SyscallTable g_SyscallTable
 

Variable Documentation

◆ g_Matcher

Definition at line 23 of file pe_sieve.cpp.

◆ g_SyscallTable

pesieve::SyscallTable g_SyscallTable

Definition at line 24 of file pe_sieve.cpp.