![]() |
PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include <module_cache.h>
Public Member Functions | |
| CachedModule () | |
| CachedModule (BYTE *_moduleData, size_t _moduleSize) | |
| BYTE * | mapFromCached (size_t &mappedSize) const |
| ~CachedModule () | |
Public Attributes | |
| BYTE * | moduleData |
| size_t | moduleSize |
| DWORD | lastUsage |
Definition at line 10 of file module_cache.h.
|
inline |
Definition at line 12 of file module_cache.h.
|
inline |
Definition at line 17 of file module_cache.h.
|
inline |
Definition at line 36 of file module_cache.h.
|
inline |
Definition at line 28 of file module_cache.h.
| DWORD pesieve::CachedModule::lastUsage |
Definition at line 48 of file module_cache.h.
| BYTE* pesieve::CachedModule::moduleData |
Definition at line 46 of file module_cache.h.
| size_t pesieve::CachedModule::moduleSize |
Definition at line 47 of file module_cache.h.