15#define DIR_SEPARATOR "\\"
34 case peconv::PE_DUMP_VIRTUAL:
36 case peconv::PE_DUMP_UNMAP:
38 case peconv::PE_DUMP_REALIGN:
48 return "IMP_NOT_FOUND";
50 return "IMP_RECOVERY_ERROR";
52 return "IMP_RECOVERY_NOT_APPLICABLE";
56 return "IMP_ALREADY_OK";
58 return "IMP_DIR_FIXED";
62 return "IMP_RECREATED_FILTER0";
64 return "IMP_RECREATED_FILTER1";
66 return "IMP_RECREATED_FILTER2";
74 case pesieve::PE_DUMP_AUTO:
75 return peconv::PE_DUMP_AUTO;
77 case pesieve::PE_DUMP_VIRTUAL:
78 return peconv::PE_DUMP_VIRTUAL;
80 case pesieve::PE_DUMP_UNMAP:
81 return peconv::PE_DUMP_UNMAP;
83 case pesieve::PE_DUMP_REALIGN:
84 return peconv::PE_DUMP_REALIGN;
86 return peconv::PE_DUMP_AUTO;
99 if (
mod.moduleFile.length() > 0) {
100 return peconv::get_file_name(
mod.moduleFile);
108 modulePath = peconv::get_file_name(szModName);
164 std::string
report_path = makeOutPath(
"dump_report.json");
184 if (processHandle ==
nullptr) {
190 std::vector<ModuleScanReport*>::iterator
itr;
199 dumpModule(processHandle,
214 if (!
mod)
return false;
234 IN const peconv::ExportsMapper *exportsMap,
240 if (!
mod)
return false;
251 bool is_corrupt_pe =
false;
262 if (!
peRec.reconstruct()) {
263 is_corrupt_pe =
true;
266 std::cout <<
"[-] Reconstructing PE at: " << std::hex << (
ULONGLONG)
found_pe_base <<
" failed." << std::endl;
288 peconv::ImpsNotCovered notCovered;
299 if (imprec_mode == pesieve::PE_IMPREC_NONE) {
346 if (mode_info.length() > 0) mode_info =
" as " + mode_info;
347 std::cout <<
"[*] Dumped module to: " +
modDumpReport->dumpFileName + mode_info <<
"\n";
352 std::cerr <<
"[-] Failed dumping module!" << std::endl;
396 if (baseDir.length() > 0) {
402 if (baseDir.length() > 0) {
406 if (this->dumpDir.length() > 0) {
415 makeAndJoinDirectories(
stream);
416 stream << std::hex << modBaseAddr;
417 if (
fname.length() > 0) {
429 makeAndJoinDirectories(
stream);
431 if (
fname.length() > 0) {
A report from the artefacts scan, generated by ArtefactScanner.
A report from the code scan, generated by CodeScanner.
A report from an IAT scan, generated by IATScanner.
static bool saveNotRecovered(IN std::string fileName, IN HANDLE hProcess, IN peconv::ImportsCollection *storedFunc, IN peconv::ImpsNotCovered ¬Covered, IN const ModulesInfo &modulesInfo, IN const peconv::ExportsMapper *exportsMap)
enum pesieve::ImpReconstructor::imprec_res t_imprec_res
@ IMP_RECOVERY_NOT_APPLICABLE
A base class of all the reports detailing on the output of the performed module's scan.
A container of all the process modules that were scanned.
The report aggregating the results of the performed dumps.
The report aggregating the results of the performed scan.
std::string makeModuleDumpPath(ULONGLONG modBaseAddr, const std::string &fname, const std::string &defaultExtension)
std::string makeDirName(const DWORD process_id)
bool fillModuleCopy(IN ModuleScanReport *mod, IN OUT PeBuffer &module_buf)
void makeAndJoinDirectories(std::stringstream &name_stream)
std::string makeOutPath(const std::string &fname, const std::string &defaultExtension="")
ProcessDumpReport * dumpDetectedModules(HANDLE hProcess, bool isRefl, ProcessScanReport &process_report, const pesieve::t_dump_mode dump_mode, const pesieve::t_imprec_mode imprec_mode)
bool dumpModule(IN HANDLE processHandle, IN bool isRefl, IN const ModulesInfo &modulesInfo, IN ModuleScanReport *modReport, IN const peconv::ExportsMapper *exportsMap, IN const pesieve::t_dump_mode dump_mode, IN const pesieve::t_imprec_mode imprec_mode, OUT ProcessDumpReport &dumpReport)
bool dumpJsonReport(ProcessScanReport &process_report, const ProcessScanReport::t_report_filter &filter, const pesieve::t_json_level &jdetails)
A report from the working set scan, generated by WorkingSetScanner.
bool create_dir_recursively(const std::string &path)
std::string get_imprec_res_name(const ImpReconstructor::t_imprec_res &res)
std::string get_payload_ext(const ArtefactScanReport &artefactRepot)
size_t fill_iat(BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN OUT IATBlock &iat, IN ThunkFoundCallback *callback)
peconv::t_pe_dump_mode convert_to_peconv_dump_mode(const pesieve::t_dump_mode dump_mode)
std::string get_module_file_name(HANDLE processHandle, const ModuleScanReport &mod)
bool make_dump_dir(const std::string &directory)
std::string get_dump_mode_name(peconv::t_pe_dump_mode dump_mode)