pe_sieve_types.h

Go to the documentation of this file.

 
#pragma once
 
#include <windows.h>
 
#define PARAM_LIST_SEPARATOR ';'
 
#ifndef __cplusplus
typedef char bool;
#endif
 
#ifdef __cplusplus
namespace pesieve {
#endif
 
    const DWORD ERROR_SCAN_FAILURE = (-1);
 
    typedef enum {
        OUT_FULL = 0, 
        OUT_NO_DUMPS, 
        OUT_NO_DIR, 
        OUT_FILTERS_COUNT
    } t_output_filter;
 
    typedef enum {
        SHOW_NONE = 0,              
        SHOW_ERRORS = 1,            
        SHOW_NOT_SUSPICIOUS = 2,    
        SHOW_SUSPICIOUS = 4,        
        SHOW_SUSPICIOUS_AND_ERRORS = SHOW_ERRORS | SHOW_SUSPICIOUS,
        SHOW_SUCCESSFUL_ONLY = SHOW_NOT_SUSPICIOUS | SHOW_SUSPICIOUS,
        SHOW_ALL = SHOW_ERRORS | SHOW_NOT_SUSPICIOUS | SHOW_SUSPICIOUS,
    } t_results_filter;
 
    typedef enum {
        SHELLC_NONE = 0,           
        SHELLC_PATTERNS,           
        SHELLC_STATS,              
        SHELLC_PATTERNS_OR_STATS, 
        SHELLC_PATTERNS_AND_STATS, 
        SHELLC_COUNT
    } t_shellc_mode;
 
    typedef enum {
        OBFUSC_NONE = 0,            
        OBFUSC_STRONG_ENC,          
        OBFUSC_WEAK_ENC,            
        OBFUSC_ANY,                 
        OBFUSC_COUNT
    } t_obfusc_mode;
 
    typedef enum {
        PE_IMPREC_NONE = 0,  
        PE_IMPREC_AUTO,      
        PE_IMPREC_UNERASE,   
        PE_IMPREC_REBUILD0,  
        PE_IMPREC_REBUILD1,  
        PE_IMPREC_REBUILD2,  
        PE_IMPREC_MODES_COUNT
    } t_imprec_mode;
 
    typedef enum {
        PE_DUMP_AUTO = 0,   
        PE_DUMP_VIRTUAL,    
        PE_DUMP_UNMAP,      
        PE_DUMP_REALIGN,    
        PE_DUMP_MODES_COUNT
    } t_dump_mode;
 
    typedef enum {
        PE_IATS_NONE = 0,           
        PE_IATS_CLEAN_SYS_FILTERED, 
        PE_IATS_ALL_SYS_FILTERED,   
        PE_IATS_UNFILTERED,         
        PE_IATS_MODES_COUNT
    } t_iat_scan_mode;
 
    typedef enum {
        PE_DNET_NONE = 0,           
        PE_DNET_SKIP_MAPPING = 1,   
        PE_DNET_SKIP_SHC,           
        PE_DNET_SKIP_HOOKS,         
        PE_DNET_SKIP_ALL,           
        PE_DNET_COUNT
    } t_dotnet_policy;
 
    typedef enum {
        PE_DATA_NO_SCAN = 0,        
        PE_DATA_SCAN_DOTNET,        
        PE_DATA_SCAN_NO_DEP,        
        PE_DATA_SCAN_ALWAYS,        
        PE_DATA_SCAN_INACCESSIBLE,      
        PE_DATA_SCAN_INACCESSIBLE_ONLY, 
        PE_DATA_COUNT
    } t_data_scan_mode;
 
    typedef enum {
        JSON_BASIC = 0,     
        JSON_DETAILS = 1,   
        JSON_DETAILS2,      
        JSON_LVL_COUNT
    } t_json_level;
 
    typedef enum {
        REPORT_NONE = 0,     
        REPORT_SCANNED,      
        REPORT_DUMPED,       
        REPORT_ALL           
    } t_report_type;
 
    typedef struct _PARAM_STRING {
        ULONG length;
        char* buffer;
    } PARAM_STRING;
 
    typedef struct params {
        DWORD pid;                 
        t_dotnet_policy dotnet_policy; 
        t_imprec_mode imprec_mode;  
        bool quiet;                 
        t_output_filter out_filter; 
        bool no_hooks;            
        t_shellc_mode shellcode;  
        t_obfusc_mode obfuscated;        
        bool threads;           
        t_iat_scan_mode iat;    
        t_data_scan_mode data;  
        bool minidump;          
        bool rebase;            
        t_dump_mode dump_mode;  
        bool json_output;       
        bool make_reflection;   
        bool use_cache;      
        t_json_level json_lvl;  
        t_results_filter results_filter; 
        char output_dir[MAX_PATH + 1];  
        PARAM_STRING modules_ignored; 
        PARAM_STRING pattern_file; 
    } t_params;
 
    typedef struct report {
        DWORD pid;              
        bool is_managed;        
        bool is_64bit;          
        bool is_reflection;     
        DWORD scanned;          
        DWORD suspicious;       
        DWORD replaced;         
        DWORD hdr_mod;          
        DWORD unreachable_file; 
        DWORD patched;          
        DWORD iat_hooked;       
        DWORD implanted;        
        DWORD implanted_pe;     
        DWORD implanted_shc;    
        DWORD other;            
        DWORD skipped;          
        DWORD errors;           
    } t_report;
 
#ifdef __cplusplus
};
#endif