PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
threads_util.h
Go to the documentation of this file.
1#pragma once
2
3#include <windows.h>
4#include <vector>
5
6namespace pesieve {
7 namespace util {
8
9 typedef struct _thread_info_ext
10 {
15
17 {
18 this->start_addr = 0;
19 this->state = 0;
20 this->wait_reason = 0;
21 this->wait_time = 0;
22 }
23
25 {
26 this->start_addr = other.start_addr;
27 this->state = other.state;
28 this->wait_reason = other.wait_reason;
29 this->wait_time = other.wait_time;
30 }
31
33
34 typedef struct _thread_info
35 {
39
41 {
42 this->tid = 0;
43 this->is_extended = false;
44 }
45
47 {
48 this->tid = other.tid;
49 this->is_extended = other.is_extended;
50 this->ext = other.ext;
51 }
52
54
55 bool fetch_threads_info(DWORD pid, std::vector<thread_info>& threads_info);
56
57 bool fetch_threads_by_snapshot(DWORD pid, std::vector<thread_info>& threads_info);
58
59 }; // namespace util
60}; // namespace pesieve
bool fetch_threads_info(DWORD pid, std::vector< thread_info > &threads_info)
struct pesieve::util::_thread_info_ext thread_info_ext
DWORD(__stdcall *_PssCaptureSnapshot)(HANDLE ProcessHandle
bool fetch_threads_by_snapshot(DWORD pid, std::vector< thread_info > &threads_info)
struct pesieve::util::_thread_info thread_info
size_t fill_iat(BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN OUT IATBlock &iat, IN ThunkFoundCallback *callback)
Definition iat_finder.h:31
_thread_info_ext(const _thread_info_ext &other)
_thread_info(const _thread_info &other)