PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
Go to the source code of this file.
Namespaces | |
namespace | pesieve |
namespace | pesieve::util |
Functions | |
pesieve::util::BOOL (CALLBACK *_MiniDumpWriteDump)(HANDLE hProcess | |
bool | pesieve::util::load_MiniDumpWriteDump () |
Variables | |
DWORD | pesieve::util::ProcessId |
DWORD HANDLE | pesieve::util::hFile |
DWORD HANDLE MINIDUMP_TYPE | pesieve::util::DumpType |
DWORD HANDLE MINIDUMP_TYPE PMINIDUMP_EXCEPTION_INFORMATION | pesieve::util::ExceptionParam |
DWORD HANDLE MINIDUMP_TYPE PMINIDUMP_EXCEPTION_INFORMATION PMINIDUMP_USER_STREAM_INFORMATION | pesieve::util::UserStreamParam |
DWORD HANDLE MINIDUMP_TYPE PMINIDUMP_EXCEPTION_INFORMATION PMINIDUMP_USER_STREAM_INFORMATION PMINIDUMP_CALLBACK_INFORMATION | pesieve::util::CallbackParam = NULL |