PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Toggle main menu visibility
Loading...
Searching...
No Matches
pe_sieve_api.cpp
Go to the documentation of this file.
1
#include <windows.h>
2
#include <string>
3
#include <iostream>
4
5
#include "
pe_sieve.h
"
6
7
#define PESIEVE_EXPORTS
8
#include <
pe_sieve_api.h
>
9
10
#define LIB_NAME "PE-sieve"
11
12
using namespace
pesieve
;
13
14
size_t
print_report
(
const
pesieve::ReportEx
&
report
,
const
pesieve::t_params
args,
const
t_report_type
rtype,
char
* json_buf,
size_t
json_buf_size)
15
{
16
if
(rtype ==
REPORT_NONE
)
return
0;
17
18
size_t
level = 1;
19
std::string report_str =
report_to_json
(
report
, rtype, args.results_filter, args.json_lvl, level);
20
const
size_t
report_len = report_str.length();
21
if
(!report_len)
return
0;
22
23
const
size_t
report_size = report_len + 1;
// including the '\0' terminator
24
if
(json_buf && json_buf_size) {
25
::memset(json_buf, 0, json_buf_size);
26
size_t
max_len = report_len <= (json_buf_size - 1) ? report_len : (json_buf_size - 1);
27
::memcpy(json_buf, report_str.c_str(), max_len);
28
}
29
return
report_size;
30
}
31
32
PEsieve_report
PESIEVE_API_FUNC
PESieve_scan_ex
(IN
const
PEsieve_params
*args, IN
const
PEsieve_rtype
rtype, OUT
char
* json_buf, IN
size_t
json_buf_size, OUT
size_t
* needed_size)
33
{
34
if
(!args || IsBadReadPtr((LPVOID)args,
sizeof
(
PEsieve_params
))) {
35
pesieve::t_report
empty = { 0 };
36
empty.errors = 1;
37
return
empty;
38
}
39
const
PEsieve_params
_args = *args;
40
const
pesieve::ReportEx
*
report
=
pesieve::scan_and_dump
(_args);
41
pesieve::t_report
summary = { 0 };
42
summary.pid = _args.
pid
;
43
summary.errors =
pesieve::ERROR_SCAN_FAILURE
;
44
if
(!
report
) {
45
return
summary;
46
}
47
if
(
report
->scan_report) {
48
summary =
report
->scan_report->generateSummary();
49
}
50
//check the pointers:
51
if
(json_buf) {
52
if
(!json_buf_size || IsBadWritePtr(json_buf, json_buf_size)) {
53
json_buf =
nullptr
;
54
json_buf_size = 0;
55
}
56
}
57
if
(needed_size && IsBadWritePtr(needed_size,
sizeof
(
size_t
))) {
58
needed_size =
nullptr
;
59
}
60
61
//print the report (only if any valid output buffer was passed)
62
if
(json_buf || needed_size) {
63
const
size_t
report_size =
print_report
(*
report
, _args, rtype, json_buf, json_buf_size);
64
if
(needed_size) {
65
*needed_size = report_size;
66
}
67
}
68
delete
report
;
69
return
summary;
70
}
71
72
PEsieve_report
PESIEVE_API_FUNC
PESieve_scan
(IN
const
PEsieve_params
*args)
73
{
74
return
PESieve_scan_ex
(args,
REPORT_NONE
,
nullptr
, 0,
nullptr
);
75
}
76
77
void
PESIEVE_API_FUNC
PESieve_help
(
void
)
78
{
79
std::string my_info =
pesieve::info
();
80
81
std::cout << my_info;
82
MessageBox(NULL, my_info.c_str(),
LIB_NAME
, MB_ICONINFORMATION);
83
}
84
85
extern
const
DWORD
PESIEVE_API
PESieve_version
= MAKELONG(MAKEWORD(
PESIEVE_PATCH_VERSION
,
PESIEVE_MICRO_VERSION
), MAKEWORD(
PESIEVE_MINOR_VERSION
,
PESIEVE_MAJOR_VERSION
));
pesieve::ReportEx
The final report about the actions performed on the process: scanning and dumping.
Definition
pe_sieve_report.h:29
pesieve.t_params
Definition
pesieve.py:110
pesieve.t_report_type
Definition
pesieve.py:98
pesieve.t_report
Definition
pesieve.py:136
pesieve::util::DWORD
DWORD(__stdcall *_PssCaptureSnapshot)(HANDLE ProcessHandle
pesieve
Definition
pesieve.py:1
pesieve.PESieve_help
PESieve_help()
Definition
pesieve.py:197
pesieve.ERROR_SCAN_FAILURE
int ERROR_SCAN_FAILURE
Definition
pesieve.py:10
pesieve.PESieve_scan_ex
tuple[t_report, str, int] PESieve_scan_ex(t_params params, t_report_type rtype, int buf_size)
Definition
pesieve.py:210
pesieve::report_to_json
std::string report_to_json(const ReportEx &report, const t_report_type rtype, t_results_filter filter, const pesieve::t_json_level &jdetails, size_t start_level=0)
Definition
report_formatter.cpp:106
pesieve.PESieve_version
PESieve_version
Definition
pesieve.py:158
pesieve.PESieve_scan
t_report PESieve_scan(t_params params)
Definition
pesieve.py:202
pesieve::info
std::string info()
The string with the basic information about the scanner.
Definition
pe_sieve.cpp:276
pesieve::scan_and_dump
ReportEx * scan_and_dump(IN const pesieve::t_params args)
The main action performed by PE-sieve: scanning the process and dumping the detected material.
Definition
pe_sieve.cpp:198
pe_sieve.h
The root of the PE-sieve scanner.
print_report
size_t print_report(const pesieve::ReportEx &report, const pesieve::t_params args, const t_report_type rtype, char *json_buf, size_t json_buf_size)
Definition
pe_sieve_api.cpp:14
LIB_NAME
#define LIB_NAME
Definition
pe_sieve_api.cpp:10
pe_sieve_api.h
The API: definitions of the exported elements that are accessible from PE-sieve DLL.
PEsieve_rtype
t_report_type PEsieve_rtype
Definition
pe_sieve_api.h:41
PEsieve_params
t_params PEsieve_params
Definition
pe_sieve_api.h:40
PEsieve_report
t_report PEsieve_report
Definition
pe_sieve_api.h:39
PESIEVE_API
#define PESIEVE_API
Definition
pe_sieve_api.h:13
PESIEVE_API_FUNC
#define PESIEVE_API_FUNC
Definition
pe_sieve_api.h:21
REPORT_NONE
@ REPORT_NONE
do not output a report
Definition
pe_sieve_types.h:111
PESIEVE_PATCH_VERSION
#define PESIEVE_PATCH_VERSION
Definition
pe_sieve_ver_short.h:6
PESIEVE_MINOR_VERSION
#define PESIEVE_MINOR_VERSION
Definition
pe_sieve_ver_short.h:4
PESIEVE_MAJOR_VERSION
#define PESIEVE_MAJOR_VERSION
Definition
pe_sieve_ver_short.h:3
PESIEVE_MICRO_VERSION
#define PESIEVE_MICRO_VERSION
Definition
pe_sieve_ver_short.h:5
params::pid
DWORD pid
the PID of the process to be scanned
Definition
pe_sieve_types.h:125
report
Final summary about the scanned process.
Definition
pe_sieve_types.h:151
Generated by
1.17.0