![]() |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
A custom structure keeping a fragment of a thread context. More...
#include <thread_scanner.h>
Public Member Functions | |
_ctx_details (bool _is64b=false, ULONGLONG _rip=0, ULONGLONG _rsp=0, ULONGLONG _rbp=0, ULONGLONG _ret_addr=0) | |
void | init (bool _is64b=false, ULONGLONG _rip=0, ULONGLONG _rsp=0, ULONGLONG _rbp=0, ULONGLONG _ret_addr=0) |
Public Attributes | |
bool | is64b |
ULONGLONG | rip |
ULONGLONG | rsp |
ULONGLONG | rbp |
ULONGLONG | last_ret |
ULONGLONG | ret_on_stack |
bool | is_ret_as_syscall |
bool | is_ret_in_frame |
bool | is_managed |
std::vector< ULONGLONG > | callStack |
A custom structure keeping a fragment of a thread context.
Definition at line 40 of file thread_scanner.h.
|
inline |
Definition at line 52 of file thread_scanner.h.
|
inline |
Definition at line 58 of file thread_scanner.h.
std::vector<ULONGLONG> pesieve::_ctx_details::callStack |
Definition at line 50 of file thread_scanner.h.
bool pesieve::_ctx_details::is64b |
Definition at line 41 of file thread_scanner.h.
bool pesieve::_ctx_details::is_managed |
Definition at line 49 of file thread_scanner.h.
bool pesieve::_ctx_details::is_ret_as_syscall |
Definition at line 47 of file thread_scanner.h.
bool pesieve::_ctx_details::is_ret_in_frame |
Definition at line 48 of file thread_scanner.h.
ULONGLONG pesieve::_ctx_details::last_ret |
Definition at line 45 of file thread_scanner.h.
ULONGLONG pesieve::_ctx_details::rbp |
Definition at line 44 of file thread_scanner.h.
ULONGLONG pesieve::_ctx_details::ret_on_stack |
Definition at line 46 of file thread_scanner.h.
ULONGLONG pesieve::_ctx_details::rip |
Definition at line 42 of file thread_scanner.h.
ULONGLONG pesieve::_ctx_details::rsp |
Definition at line 43 of file thread_scanner.h.