PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
stats_util.h
Go to the documentation of this file.
1#pragma once
2
3#include <windows.h>
4#include <iostream>
5#include <string>
6
7namespace pesieve {
8 namespace stats {
9
10 template <typename T>
11 std::string hexdumpValue(const BYTE* in_buf, const size_t max_size)
12 {
13 std::stringstream ss;
14 for (size_t i = 0; i < max_size; i++) {
15 ss << "\\x" << std::setfill('0') << std::setw(2) << std::hex << (unsigned int)in_buf[i];
16 }
17 return ss.str();
18 }
19
20 // return the most frequent value
21 template <typename T>
22 T getMostFrequentValue(IN std::map<size_t, std::set< T >> frequencies)
23 {
24 auto itr = frequencies.rbegin();
25 if (itr == frequencies.rend()) {
26 return 0;
27 }
28 auto setItr = itr->second.begin();
29 T mVal = *setItr;
30 return mVal;
31 }
32
33 // return the number of occurrencies
34 template <typename T>
35 size_t getMostFrequentValues(IN std::map<size_t, std::set< T >> frequencies, OUT std::set<T>& values)
36 {
37 auto itr = frequencies.rbegin();
38 if (itr == frequencies.rend()) {
39 return 0;
40 }
41
42 // find the highest frequency:
43 size_t mFreq = itr->first;
44 values.insert(itr->second.begin(), itr->second.end());
45 return mFreq;
46 }
47
48 template <typename T>
49 bool isAllPrintable(IN std::map<T, size_t>& histogram)
50 {
51 if (!histogram.size()) return false;
52
53 bool is_printable = true;
54 for (auto itr = histogram.begin(); itr != histogram.end(); ++itr) {
55 T val = itr->first;
56 if (val && !IS_PRINTABLE(val)) {
57 is_printable = false;
58 break;
59 }
60 }
61 return is_printable;
62 }
63
64 }; // namespace stats
65}; //namespace pesieve
bool isAllPrintable(IN std::map< T, size_t > &histogram)
Definition stats_util.h:49
std::string hexdumpValue(const BYTE *in_buf, const size_t max_size)
Definition stats_util.h:11
size_t getMostFrequentValues(IN std::map< size_t, std::set< T > > frequencies, OUT std::set< T > &values)
Definition stats_util.h:35
T getMostFrequentValue(IN std::map< size_t, std::set< T > > frequencies)
Definition stats_util.h:22
size_t fill_iat(BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN OUT IATBlock &iat, IN ThunkFoundCallback *callback)
Definition iat_finder.h:31
#define IS_PRINTABLE(c)
Definition strings_util.h:8