PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
process_feature_scanner.h
Go to the documentation of this file.
1#pragma once
2
3#include <windows.h>
4#include <map>
5
6#include <peconv.h>
7#include "scan_report.h"
8
9namespace pesieve {
10
31
32}; //namespace pesieve
A base class of all the reports detailing on the output of the performed module's scan.
A base class for all the scanners checking appropriate process' features.
virtual ModuleScanReport * scanRemote()=0
ProcessFeatureScanner(HANDLE _processHandle)
size_t fill_iat(BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN OUT IATBlock &iat, IN ThunkFoundCallback *callback)
Definition iat_finder.h:31