PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
All Classes Namespaces Files Functions Variables Typedefs Enumerations Enumerator Friends Macros Pages
pesieve::SyscallTable Struct Reference

#include <syscall_extractor.h>

Public Member Functions

 SyscallTable ()
 
bool isReady ()
 
std::string getSyscallName (DWORD id)
 

Static Public Member Functions

static bool isSyscallDll (const std::string &libName)
 
static bool isSyscallFunc (const std::string &funcName, bool NtOnly=false)
 
static bool isSameSyscallFunc (const std::string &func1, const std::string &func2)
 

Public Attributes

std::map< DWORD, std::string > syscallToName
 

Detailed Description

Definition at line 13 of file syscall_extractor.h.

Constructor & Destructor Documentation

◆ SyscallTable()

pesieve::SyscallTable::SyscallTable ( )
inline

Definition at line 81 of file syscall_extractor.h.

Here is the call graph for this function:

Member Function Documentation

◆ getSyscallName()

std::string pesieve::SyscallTable::getSyscallName ( DWORD id)
inline

Definition at line 94 of file syscall_extractor.h.

◆ isReady()

bool pesieve::SyscallTable::isReady ( )
inline

Definition at line 89 of file syscall_extractor.h.

◆ isSameSyscallFunc()

static bool pesieve::SyscallTable::isSameSyscallFunc ( const std::string & func1,
const std::string & func2 )
inlinestatic

Definition at line 51 of file syscall_extractor.h.

◆ isSyscallDll()

static bool pesieve::SyscallTable::isSyscallDll ( const std::string & libName)
inlinestatic

Definition at line 15 of file syscall_extractor.h.

◆ isSyscallFunc()

static bool pesieve::SyscallTable::isSyscallFunc ( const std::string & funcName,
bool NtOnly = false )
inlinestatic

Definition at line 26 of file syscall_extractor.h.

Member Data Documentation

◆ syscallToName

std::map<DWORD, std::string> pesieve::SyscallTable::syscallToName

Definition at line 103 of file syscall_extractor.h.


The documentation for this struct was generated from the following file: