PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
The root of the PE-sieve scanner. More...
#include <windows.h>
#include <iostream>
#include <stdexcept>
#include <pe_sieve_types.h>
#include <pe_sieve_return_codes.h>
#include "pe_sieve_ver_short.h"
#include "pe_sieve_report.h"
#include "postprocessors/report_formatter.h"
Go to the source code of this file.
Namespaces | |
namespace | pesieve |
Functions | |
std::string | pesieve::info () |
The string with the basic information about the scanner. | |
ReportEx * | pesieve::scan_and_dump (IN const pesieve::t_params args) |
The main action performed by PE-sieve: scanning the process and dumping the detected material. | |
Variables | |
const char | pesieve::PESIEVE_URL [] = "https://github.com/hasherezade/pe-sieve" |
The root of the PE-sieve scanner.
Definition in file pe_sieve.h.