PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
pe_sieve_api.h
Go to the documentation of this file.
1
6#pragma once
7
8#include <windows.h>
9#include <pe_sieve_types.h>
10
11#ifndef PESIEVE_STATIC_LIB
12#ifdef PESIEVE_EXPORTS
13#define PESIEVE_API __declspec(dllexport)
14#else
15#define PESIEVE_API __declspec(dllimport)
16#endif
17#else
18#define PESIEVE_API
19#endif
20
21#define PESIEVE_API_FUNC PESIEVE_API __cdecl
22
23#ifdef __cplusplus
24extern "C" {
25#endif
26
27
29extern const DWORD PESIEVE_API PESieve_version;
30
33
34#ifdef __cplusplus
38#else
42#endif
43
46
48PEsieve_report PESIEVE_API_FUNC PESieve_scan_ex(IN const PEsieve_params &args, IN const PEsieve_rtype rtype, OUT char* json_buf, IN size_t json_buf_size, OUT size_t *buf_needed_size);
49
50#ifdef __cplusplus
51};
52#endif
PEsieve_report PESIEVE_API_FUNC PESieve_scan_ex(IN const PEsieve_params &args, IN const PEsieve_rtype rtype, OUT char *json_buf, IN size_t json_buf_size, OUT size_t *buf_needed_size)
Performs a PE-sieve scan with a supplied set of parameters (defined as a structure t_params)....
t_report_type PEsieve_rtype
const DWORD PESIEVE_API PESieve_version
PE-sieve version in a DWORD form.
t_params PEsieve_params
PEsieve_report PESIEVE_API_FUNC PESieve_scan(IN const PEsieve_params &args)
Performs a PE-sieve scan with a supplied set of parameters (defined as a structure t_params)....
void PESIEVE_API_FUNC PESieve_help(void)
Shows a MessageBox with the informations about PE-sieve.
t_report PEsieve_report
#define PESIEVE_API
#define PESIEVE_API_FUNC
The types used by PE-sieve API.
t_report_type
Input parameters for PE-sieve, defining the configuration.
Final summary about the scanned process.