PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
pe_sieve_api.cpp
Go to the documentation of this file.
1#include <windows.h>
2#include <string>
3#include <iostream>
4
5#include "pe_sieve.h"
6
7#define PESIEVE_EXPORTS
8#include <pe_sieve_api.h>
9
10#define LIB_NAME "PE-sieve"
11
12using namespace pesieve;
13
14size_t print_report(const pesieve::ReportEx& report, const pesieve::t_params args, const t_report_type rtype, char* json_buf, size_t json_buf_size)
15{
16 if (rtype == REPORT_NONE) return 0;
17
18 size_t level = 1;
19 std::string report_str = report_to_json(report, rtype, args.results_filter, args.json_lvl, level);
20 const size_t report_len = report_str.length();
21 if (!report_len) return 0;
22
23 const size_t report_size = report_len + 1;// including the '\0' terminator
24 if (json_buf && json_buf_size) {
25 ::memset(json_buf, 0, json_buf_size);
26 size_t max_len = report_len <= (json_buf_size - 1) ? report_len : (json_buf_size - 1);
27 ::memcpy(json_buf, report_str.c_str(), max_len);
28 }
29 return report_size;
30}
31
32PEsieve_report PESIEVE_API_FUNC PESieve_scan_ex(IN const PEsieve_params *args, IN const PEsieve_rtype rtype, OUT char* json_buf, IN size_t json_buf_size, OUT size_t* needed_size)
33{
34 if (!args || IsBadReadPtr((LPVOID)args, sizeof(PEsieve_params))) {
35 pesieve::t_report empty = { 0 };
36 empty.errors = 1;
37 return empty;
38 }
39 const PEsieve_params _args = *args;
41 pesieve::t_report summary = { 0 };
42 summary.pid = _args.pid;
43 summary.errors = pesieve::ERROR_SCAN_FAILURE;
44 if (!report) {
45 return summary;
46 }
47 if (report->scan_report) {
48 summary = report->scan_report->generateSummary();
49 }
50 //check the pointers:
51 if (json_buf) {
52 if (!json_buf_size || IsBadWritePtr(json_buf, json_buf_size)) {
53 json_buf = nullptr;
54 json_buf_size = 0;
55 }
56 }
57 if (needed_size && IsBadWritePtr(needed_size, sizeof(size_t))) {
58 needed_size = nullptr;
59 }
60
61 //print the report (only if any valid output buffer was passed)
62 if (json_buf || needed_size) {
63 const size_t report_size = print_report(*report, _args, rtype, json_buf, json_buf_size);
64 if (needed_size) {
65 *needed_size = report_size;
66 }
67 }
68 delete report;
69 return summary;
70}
71
73{
74 return PESieve_scan_ex(args, REPORT_NONE, nullptr, 0, nullptr);
75}
76
78{
79 std::string my_info = pesieve::info();
80
81 std::cout << my_info;
82 MessageBox(NULL, my_info.c_str(), LIB_NAME, MB_ICONINFORMATION);
83}
84
The final report about the actions performed on the process: scanning and dumping.
DWORD(__stdcall *_PssCaptureSnapshot)(HANDLE ProcessHandle
PESieve_help()
Definition pesieve.py:197
int ERROR_SCAN_FAILURE
Definition pesieve.py:10
std::string report_to_json(const ReportEx &report, const t_report_type rtype, t_results_filter filter, const pesieve::t_json_level &jdetails, size_t start_level=0)
PESieve_version
Definition pesieve.py:158
tuple[t_report, str, int] PESieve_scan_ex(t_params params, t_report_type rtype, int buf_size)
Definition pesieve.py:210
std::string info()
The string with the basic information about the scanner.
Definition pe_sieve.cpp:274
ReportEx * scan_and_dump(IN const pesieve::t_params args)
The main action performed by PE-sieve: scanning the process and dumping the detected material.
Definition pe_sieve.cpp:198
t_report PESieve_scan(t_params params)
Definition pesieve.py:202
The root of the PE-sieve scanner.
size_t print_report(const pesieve::ReportEx &report, const pesieve::t_params args, const t_report_type rtype, char *json_buf, size_t json_buf_size)
#define LIB_NAME
The API: definitions of the exported elements that are accessible from PE-sieve DLL.
t_report_type PEsieve_rtype
t_params PEsieve_params
t_report PEsieve_report
#define PESIEVE_API
#define PESIEVE_API_FUNC
@ REPORT_NONE
do not output a report
#define PESIEVE_PATCH_VERSION
#define PESIEVE_MINOR_VERSION
#define PESIEVE_MAJOR_VERSION
#define PESIEVE_MICRO_VERSION
DWORD pid
the PID of the process to be scanned
Final summary about the scanned process.