PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
threads_util.h
Go to the documentation of this file.
1#pragma once
2
3#include <windows.h>
4#include <map>
5
6#define INVALID_SYSCALL (-1)
7
8namespace pesieve {
9 namespace util {
10
11 typedef struct _thread_info_ext
12 {
13 ULONGLONG sys_start_addr;
17
19 {
20 this->sys_start_addr = 0;
21 this->state = 0;
22 this->wait_reason = 0;
23 this->wait_time = 0;
24 }
25
27 {
28 this->sys_start_addr = other.sys_start_addr;
29 this->state = other.state;
30 this->wait_reason = other.wait_reason;
31 this->wait_time = other.wait_time;
32 }
33
35
36 typedef struct _thread_info
37 {
39 ULONGLONG start_addr;
43
45 : tid(_tid),
47 is_extended(false)
48 {
49 }
50
52 {
53 this->tid = other.tid;
54 this->start_addr = other.start_addr;
55 this->last_syscall = other.last_syscall;
56 this->is_extended = other.is_extended;
57 this->ext = other.ext;
58 }
59
61
62 bool query_threads_details(IN OUT std::map<DWORD, thread_info>& threads_info);
63
64 bool fetch_threads_info(IN DWORD pid, OUT std::map<DWORD, thread_info>& threads_info);
65
66 bool fetch_threads_by_snapshot(IN DWORD pid, OUT std::map<DWORD, thread_info>& threads_info);
67
68 }; // namespace util
69}; // namespace pesieve
bool fetch_threads_by_snapshot(IN DWORD pid, OUT std::map< DWORD, thread_info > &threads_info)
struct pesieve::util::_thread_info_ext thread_info_ext
bool query_threads_details(IN OUT std::map< DWORD, thread_info > &threads_info)
DWORD(__stdcall *_PssCaptureSnapshot)(HANDLE ProcessHandle
struct pesieve::util::_thread_info thread_info
bool fetch_threads_info(IN DWORD pid, OUT std::map< DWORD, thread_info > &threads_info)
_thread_info_ext(const _thread_info_ext &other)
_thread_info(const _thread_info &other)
#define INVALID_SYSCALL
Definition threads_util.h:6