Input parameters for PE-sieve, defining the configuration. More...

#include <pe_sieve_types.h>

Public Attributes
DWORD	pid
	the PID of the process to be scanned

t_dotnet_policy	dotnet_policy
	policy for scanning .NET modules

t_imprec_mode	imprec_mode
	import recovery mode

bool	quiet
	do not print log on the stdout

t_output_filter	out_filter
	level of details of the created output material

bool	no_hooks
	don't scan for hooks

t_shellc_mode	shellcode
	detect shellcode implants

t_obfusc_mode	obfuscated
	detect encrypted or obfuscated content (possible encrypted shellcodes)

bool	threads
	scan threads

t_iat_scan_mode	iat
	detect IAT hooking

t_data_scan_mode	data
	should scan non-executable pages?

bool	minidump
	make minidump of full process

bool	rebase
	rebase the module to its original base (if known)

t_dump_mode	dump_mode
	in which mode the detected PE implants should be dumped

bool	json_output
	display the final summary as the JSON report

bool	make_reflection
	operate on a process reflection rather than on the live process (this allows i.e. to force-read inaccessible pages)

bool	use_cache
	enable cache for the scanned modules

t_json_level	json_lvl
	level of the details of the JSON report

t_results_filter	results_filter
	what type of results should be included in the report

char	output_dir [MAX_PATH+1]
	the root directory where the output should be saved (default: current directory)

PARAM_STRING	modules_ignored
	a list of modules that will not be scanned, separated by PARAM_LIST_SEPARATOR

PARAM_STRING	pattern_file
	a file with additional patterns for code recognition

Detailed Description

Input parameters for PE-sieve, defining the configuration.

Definition at line 124 of file pe_sieve_types.h.

Member Data Documentation

◆ data

t_data_scan_mode params::data

should scan non-executable pages?

Definition at line 135 of file pe_sieve_types.h.

◆ dotnet_policy

t_dotnet_policy params::dotnet_policy

policy for scanning .NET modules

Definition at line 126 of file pe_sieve_types.h.

◆ dump_mode

t_dump_mode params::dump_mode

in which mode the detected PE implants should be dumped

Definition at line 138 of file pe_sieve_types.h.

◆ iat

t_iat_scan_mode params::iat

detect IAT hooking

Definition at line 134 of file pe_sieve_types.h.

◆ imprec_mode

t_imprec_mode params::imprec_mode

import recovery mode

Definition at line 127 of file pe_sieve_types.h.

◆ json_lvl

t_json_level params::json_lvl

level of the details of the JSON report

Definition at line 142 of file pe_sieve_types.h.

◆ json_output

bool params::json_output

display the final summary as the JSON report

Definition at line 139 of file pe_sieve_types.h.

◆ make_reflection

bool params::make_reflection

operate on a process reflection rather than on the live process (this allows i.e. to force-read inaccessible pages)

Definition at line 140 of file pe_sieve_types.h.

◆ minidump

bool params::minidump

make minidump of full process

Definition at line 136 of file pe_sieve_types.h.

◆ modules_ignored

PARAM_STRING params::modules_ignored

a list of modules that will not be scanned, separated by PARAM_LIST_SEPARATOR

Definition at line 145 of file pe_sieve_types.h.

◆ no_hooks

bool params::no_hooks

don't scan for hooks

Definition at line 130 of file pe_sieve_types.h.

◆ obfuscated

t_obfusc_mode params::obfuscated

detect encrypted or obfuscated content (possible encrypted shellcodes)

Definition at line 132 of file pe_sieve_types.h.

◆ out_filter

t_output_filter params::out_filter

level of details of the created output material

Definition at line 129 of file pe_sieve_types.h.

◆ output_dir

char params::output_dir[MAX_PATH+1]

the root directory where the output should be saved (default: current directory)

Definition at line 144 of file pe_sieve_types.h.

◆ pattern_file

PARAM_STRING params::pattern_file

a file with additional patterns for code recognition

Definition at line 146 of file pe_sieve_types.h.

◆ pid

DWORD params::pid

the PID of the process to be scanned

Definition at line 125 of file pe_sieve_types.h.

◆ quiet

bool params::quiet

do not print log on the stdout

Definition at line 128 of file pe_sieve_types.h.

◆ rebase

bool params::rebase

rebase the module to its original base (if known)

Definition at line 137 of file pe_sieve_types.h.

◆ results_filter

t_results_filter params::results_filter

what type of results should be included in the report

Definition at line 143 of file pe_sieve_types.h.

◆ shellcode

t_shellc_mode params::shellcode

detect shellcode implants

Definition at line 131 of file pe_sieve_types.h.

◆ threads

bool params::threads

scan threads

Definition at line 133 of file pe_sieve_types.h.

◆ use_cache

bool params::use_cache

enable cache for the scanned modules

Definition at line 141 of file pe_sieve_types.h.

The documentation for this struct was generated from the following file:

include/pe_sieve_types.h

Public Attributes