PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include "pe_sieve.h"
#include <peconv.h>
#include <windows.h>
#include "scanners/scanner.h"
#include "utils/format_util.h"
#include "utils/process_util.h"
#include "utils/process_privilege.h"
#include "utils/process_minidump.h"
#include "utils/path_converter.h"
#include "postprocessors/results_dumper.h"
#include "utils/process_reflection.h"
#include "utils/console_color.h"
#include "color_scheme.h"
#include "utils/artefacts_util.h"
#include "utils/syscall_extractor.h"
Go to the source code of this file.
Namespaces | |
namespace | pesieve |
Functions | |
void | pesieve::check_access_denied (DWORD processID) |
bool | pesieve::is_scanner_compatible (IN HANDLE hProcess) |
HANDLE | pesieve::open_process (DWORD processID, bool reflection, bool quiet) |
pesieve::ProcessDumpReport * | pesieve::make_dump (IN HANDLE hProcess, IN bool isRefl, IN const pesieve::t_params &args, IN ProcessScanReport &process_report) |
bool | pesieve::is_by_patterns (const t_shellc_mode &shellc_mode) |
Variables | |
pesieve::PatternMatcher | g_Matcher |
pesieve::SyscallTable | g_SyscallTable |
pesieve::PatternMatcher g_Matcher |
Definition at line 23 of file pe_sieve.cpp.
pesieve::SyscallTable g_SyscallTable |
Definition at line 24 of file pe_sieve.cpp.