scanner.h

Go to the documentation of this file.

#pragma once
 
#include <windows.h>
#include <string>
#include <map>
 
#include <peconv.h>
#include "scan_report.h"
#include "module_data.h"
#include "../utils/process_symbols.h"
 
namespace pesieve {

    class ProcessScanner {
    public:

        ProcessScanner(HANDLE procHndl, bool is_reflection, pesieve::t_params _args);
 
        ~ProcessScanner()
        {
        }


        ProcessScanReport* scanRemote(); //throws exceptions
 
        static t_scan_status scanForHollows(HANDLE hProcess, ModuleData& modData, RemoteModuleData &remoteModData, ProcessScanReport& process_report);
        static t_scan_status scanForHooks(HANDLE hProcess, ModuleData& modData, RemoteModuleData &remoteModData, ProcessScanReport& process_report, bool scan_data, bool scan_inaccessible);
        static t_scan_status scanForIATHooks(HANDLE hProcess, ModuleData& modData, RemoteModuleData &remoteModData, ProcessScanReport& process_report, t_iat_scan_mode filter);
 
    protected:
        size_t scanModules(ProcessScanReport &pReport); //throws exceptions
        size_t scanModulesIATs(ProcessScanReport &pReport); //throws exceptions
        size_t scanThreads(ProcessScanReport& pReport); //throws exceptions
        size_t scanWorkingSet(ProcessScanReport &pReport); //throws exceptions
 
        ModuleScanReport* scanForMappingMismatch(ModuleData& modData, ProcessScanReport& process_report);
 
        bool resolveHooksTargets(ProcessScanReport& process_report);
        bool filterDotNetReport(ProcessScanReport& process_report);
 
        HANDLE processHandle;
        bool isDEP;
        const bool isReflection;
        ProcessSymbolsManager symbols;
        pesieve::t_params args;
 
        std::set<std::string> ignoredModules;
    };
 
}; //namespace pesieve