17#define CALC_PAGE_STATS
23#include <sig_finder.h>
105#ifdef CALC_PAGE_STATS
virtual const bool toJSON(std::stringstream &outs, size_t level)
A base class of all the reports detailing on the output of the performed module's scan.
virtual const bool _toJSON(std::stringstream &outs, size_t level=JSON_LEVEL, const pesieve::t_json_level &jdetails=JSON_BASIC)
A base class for all the scanners checking appropriate process' features.
The report aggregating the results of the performed scan.
A report from the working set scan, generated by WorkingSetScanner.
util::ByteBuffer data_cache
std::vector< sig_finder::Match > custom_matched
const void patternsToJSON(std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails)
static std::string translate_mapping_type(DWORD type)
virtual const bool toJSON(std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails)
size_t generateTags(const std::string &reportPath)
virtual const void fieldsToJSON(std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails)
WorkingSetScanReport(HMODULE _module, size_t _moduleSize, t_scan_status status)
A scanner for detection of code implants in the process workingset.
virtual ~WorkingSetScanner()
WorkingSetScanReport * scanExecutableArea(MemPageData &memPageData)
bool isPotentiallyExecutable(MemPageData &memPageData, const t_data_scan_mode &mode)
ProcessScanReport & processReport
const process_details pDetails
bool checkAreaContent(IN MemPageData &_memPage, OUT WorkingSetScanReport *my_report)
bool isScannedAsModule(MemPageData &memPageData)
WorkingSetScanner(HANDLE _procHndl, process_details _proc_details, const util::mem_region_info _mem_region, pesieve::t_params _args, ProcessScanReport &_process_report)
const util::mem_region_info memRegion
bool scanImg(MemPageData &memPage)
bool isExecutable(MemPageData &memPageData)
virtual WorkingSetScanReport * scanRemote()
std::string escape_path_separators(std::string path)
size_t fill_iat(BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN OUT IATBlock &iat, IN ThunkFoundCallback *callback)
enum pesieve::module_scan_status t_scan_status
virtual const bool toJSON(std::stringstream &outs, size_t level)