PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
process_feature_scanner.h
Go to the documentation of this file.
1#pragma once
2
3#include <windows.h>
4#include <map>
5
6#include <peconv.h>
7#include "scan_report.h"
8
9namespace pesieve {
10
13
14 public:
15 ProcessFeatureScanner(HANDLE _processHandle)
16 : processHandle(_processHandle)
17 {
18 }
19
21
27
28 protected:
30 };
31
32}; //namespace pesieve
A base class of all the reports detailing on the output of the performed module's scan.
A base class for all the scanners checking appropriate process' features.
virtual ModuleScanReport * scanRemote()=0
ProcessFeatureScanner(HANDLE _processHandle)