PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include "scanner.h"
#include <sstream>
#include <fstream>
#include <string>
#include <locale>
#include <codecvt>
#include <tlhelp32.h>
#include "../utils/format_util.h"
#include "../utils/path_converter.h"
#include "../utils/workingset_enum.h"
#include "../utils/modules_enum.h"
#include "../utils/process_privilege.h"
#include "../utils/process_util.h"
#include "headers_scanner.h"
#include "code_scanner.h"
#include "iat_scanner.h"
#include "workingset_scanner.h"
#include "mapping_scanner.h"
#include "hook_targets_resolver.h"
#include "thread_scanner.h"
Go to the source code of this file.
Namespaces | |
namespace | pesieve |
namespace | pesieve::util |
Functions | |
bool | pesieve::validate_param_str (PARAM_STRING &strparam) |
void | pesieve::util::print_scantime (std::stringstream &stream, size_t timeInMs) |
void | pesieve::print_scan_time (const char *scanned_element, size_t total_time) |
bool | pesieve::is_running (HANDLE processHandle) |
bool | set_non_suspicious (const std::set< ModuleScanReport * > &scan_reports, bool dnet_modules_only) |
|
inline |
Definition at line 172 of file scanner.cpp.