PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
pe_sieve.h
Go to the documentation of this file.
1
6#pragma once
7
8#include <windows.h>
9#include <iostream>
10#include <stdexcept>
11
12#include <pe_sieve_types.h>
14
15#include "pe_sieve_ver_short.h"
16#include "pe_sieve_report.h"
18
19namespace pesieve {
20
21 const char PESIEVE_URL[] = "https://github.com/hasherezade/pe-sieve";
22
24 std::string info();
25
27
32};
The final report about the actions performed on the process: scanning and dumping.
const char PESIEVE_URL[]
Definition pe_sieve.h:21
std::string info()
The string with the basic information about the scanner.
Definition pe_sieve.cpp:268
ReportEx * scan_and_dump(IN const pesieve::t_params args)
The main action performed by PE-sieve: scanning the process and dumping the detected material.
Definition pe_sieve.cpp:193
The final report produced by PE-sieve.
The codes returned by the PE-sieve EXE.
The types used by PE-sieve API.