PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
Public Member Functions | |
_t_stack_enum_params (IN HANDLE _hProcess=NULL, IN HANDLE _hThread=NULL, IN LPVOID _ctx=NULL, IN const pesieve::ctx_details *_cDetails=NULL) | |
Public Attributes | |
bool | is_ok |
HANDLE | hProcess |
HANDLE | hThread |
LPVOID | ctx |
const pesieve::ctx_details * | cDetails |
std::vector< ULONGLONG > | callStack |
Definition at line 21 of file thread_scanner.cpp.
|
inline |
Definition at line 29 of file thread_scanner.cpp.
std::vector<ULONGLONG> _t_stack_enum_params::callStack |
Definition at line 27 of file thread_scanner.cpp.
const pesieve::ctx_details* _t_stack_enum_params::cDetails |
Definition at line 26 of file thread_scanner.cpp.
LPVOID _t_stack_enum_params::ctx |
Definition at line 25 of file thread_scanner.cpp.
HANDLE _t_stack_enum_params::hProcess |
Definition at line 23 of file thread_scanner.cpp.
HANDLE _t_stack_enum_params::hThread |
Definition at line 24 of file thread_scanner.cpp.
bool _t_stack_enum_params::is_ok |
Definition at line 22 of file thread_scanner.cpp.