PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
stats.h
Go to the documentation of this file.
1#pragma once
2
3#include <windows.h>
4#include <sstream>
5
6#include "entropy.h"
9
10namespace pesieve {
11
14 public:
16 virtual bool isFilled() = 0;
17 };
18
20 class AreaStats {
21 public:
23 : area_start(0), area_size(0)
24 {
25 }
26
27 void setStartOffset(size_t _area_start)
28 {
29 area_start = _area_start;
30 }
31
32 void appendVal(BYTE val)
33 {
34 _appendVal(val);
35 area_size++;
36 }
37
38 const virtual void fieldsToJSON(std::stringstream& outs, size_t level) = 0;
39
40 bool isFilled() const
41 {
42 return area_size > 0 ? true : false;
43 }
44
45 virtual void summarize() = 0;
46
47 virtual bool fillSettings(StatsSettings* _settings) { return false; }
48
49 const virtual bool toJSON(std::stringstream& outs, size_t level)
50 {
51 if (!isFilled()) {
52 return false;
53 }
54 OUT_PADDED(outs, level, "\"stats\" : {\n");
55 fieldsToJSON(outs, level + 1);
56 outs << "\n";
57 OUT_PADDED(outs, level, "}");
58 return true;
59 }
60
61 protected:
62 virtual void _appendVal(BYTE val) = 0;
63
64 size_t area_size;
65 size_t area_start;
66
67 friend class AreaStatsCalculator;
68
69 }; // AreaStats
70
71
74 public:
76 : buffer(_buffer)
77 {
78 }
79
80 bool fill(AreaStats& stats, StatsSettings* settings)
81 {
82 const bool skipPadding = true;
83 const size_t data_size = buffer.getDataSize(skipPadding);
84 const BYTE* data_buf = buffer.getData(skipPadding);
85 if (!data_size || !data_buf) {
86 return false;
87 }
88 if (settings && !stats.fillSettings(settings)) {
89 std::cerr << "Settings initialization failed!\n";
90 }
91 stats.setStartOffset(buffer.getStartOffset(skipPadding));
92 BYTE lastVal = 0;
93 for (size_t i = 0; i < data_size; ++i) {
94 const BYTE val = data_buf[i];
95 stats.appendVal(val);
96 }
97 stats.summarize();
98 return true;
99 }
100
101 private:
102 const util::ByteBuffer& buffer;
103 };
104
105}; //pesieve
A class responsible for filling in the statistics with the data from the particular buffer.
Definition stats.h:73
bool fill(AreaStats &stats, StatsSettings *settings)
Definition stats.h:80
AreaStatsCalculator(const util::ByteBuffer &_buffer)
Definition stats.h:75
Base class for the statistics from analyzed buffer.
Definition stats.h:20
bool isFilled() const
Definition stats.h:40
virtual void _appendVal(BYTE val)=0
virtual const bool toJSON(std::stringstream &outs, size_t level)
Definition stats.h:49
virtual void summarize()=0
void setStartOffset(size_t _area_start)
Definition stats.h:27
virtual bool fillSettings(StatsSettings *_settings)
Definition stats.h:47
size_t area_size
Definition stats.h:64
size_t area_start
Definition stats.h:65
void appendVal(BYTE val)
Definition stats.h:32
virtual const void fieldsToJSON(std::stringstream &outs, size_t level)=0
#define OUT_PADDED(stream, field_size, str)
Definition format_util.h:12
Base class for settings defining what type of stats should be collected.
Definition stats.h:13
virtual bool isFilled()=0
size_t getDataSize(bool trimmed=false) const
Definition byte_buffer.h:55
const BYTE * getData(bool trimmed=false) const
Definition byte_buffer.h:65
size_t getStartOffset(bool trimmed) const
Definition byte_buffer.h:48