PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
process_privilege.h
Go to the documentation of this file.
1#pragma once
2
3#include <windows.h>
4
5namespace pesieve {
6 namespace util {
7
15
17
19
20 bool is_DEP_enabled(HANDLE hProcess);
21 };
22};
process_integrity_t get_integrity_level(HANDLE hProcess)
bool is_DEP_enabled(HANDLE hProcess)
size_t fill_iat(BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN OUT IATBlock &iat, IN ThunkFoundCallback *callback)
Definition iat_finder.h:31