diff --git a/classpesieve_1_1_artefact_scan_report-members.html b/classpesieve_1_1_artefact_scan_report-members.html index e08ac23ce..55e5bcf68 100644 --- a/classpesieve_1_1_artefact_scan_report-members.html +++ b/classpesieve_1_1_artefact_scan_report-members.html @@ -94,28 +94,27 @@ generateTags(const std::string &reportPath)pesieve::WorkingSetScanReport get_scan_status(const ModuleScanReport *report)pesieve::ModuleScanReportinlinestatic getRelocBase()pesieve::ModuleScanReportinlinevirtual - has_patternspesieve::WorkingSetScanReport - has_pepesieve::WorkingSetScanReport - has_shellcodepesieve::WorkingSetScanReport - initialRegionSizepesieve::ArtefactScanReport - is_executablepesieve::WorkingSetScanReport - is_listed_modulepesieve::WorkingSetScanReport - isDotNetModulepesieve::ModuleScanReport - JSON_LEVELpesieve::ModuleScanReportstatic - mapped_namepesieve::WorkingSetScanReport - mapping_typepesieve::WorkingSetScanReport - match_area_startpesieve::WorkingSetScanReport - moduleFilepesieve::ModuleScanReport - ModuleScanReport(HMODULE _module, size_t _moduleSize, t_scan_status _status)pesieve::ModuleScanReportinline - ModuleScanReport(HMODULE _module, size_t _moduleSize)pesieve::ModuleScanReportinline - moduleSizepesieve::ModuleScanReport - protectionpesieve::WorkingSetScanReport - statspesieve::WorkingSetScanReport - statuspesieve::ModuleScanReport - toJSON(std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails)pesieve::ArtefactScanReportinlinevirtual - translate_mapping_type(DWORD type)pesieve::WorkingSetScanReportinlineprotectedstatic - WorkingSetScanReport(HMODULE _module, size_t _moduleSize, t_scan_status status)pesieve::WorkingSetScanReportinline - ~ModuleScanReport()pesieve::ModuleScanReportinlinevirtual + has_pepesieve::WorkingSetScanReport + has_shellcodepesieve::WorkingSetScanReport + initialRegionSizepesieve::ArtefactScanReport + is_executablepesieve::WorkingSetScanReport + is_listed_modulepesieve::WorkingSetScanReport + isDotNetModulepesieve::ModuleScanReport + JSON_LEVELpesieve::ModuleScanReportstatic + mapped_namepesieve::WorkingSetScanReport + mapping_typepesieve::WorkingSetScanReport + match_area_startpesieve::WorkingSetScanReport + moduleFilepesieve::ModuleScanReport + ModuleScanReport(HMODULE _module, size_t _moduleSize, t_scan_status _status)pesieve::ModuleScanReportinline + ModuleScanReport(HMODULE _module, size_t _moduleSize)pesieve::ModuleScanReportinline + moduleSizepesieve::ModuleScanReport + protectionpesieve::WorkingSetScanReport + statspesieve::WorkingSetScanReport + statuspesieve::ModuleScanReport + toJSON(std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails)pesieve::ArtefactScanReportinlinevirtual + translate_mapping_type(DWORD type)pesieve::WorkingSetScanReportinlineprotectedstatic + WorkingSetScanReport(HMODULE _module, size_t _moduleSize, t_scan_status status)pesieve::WorkingSetScanReportinline + ~ModuleScanReport()pesieve::ModuleScanReportinlinevirtual
diff --git a/classpesieve_1_1_artefact_scan_report.html b/classpesieve_1_1_artefact_scan_report.html index 4192de96f..1a655ec2d 100644 --- a/classpesieve_1_1_artefact_scan_report.html +++ b/classpesieve_1_1_artefact_scan_report.html @@ -140,8 +140,6 @@   bool has_shellcode   -bool has_patterns -  util::ByteBuffer data_cache   std::vector< sig_finder::Match > custom_matched diff --git a/classpesieve_1_1_working_set_scan_report-members.html b/classpesieve_1_1_working_set_scan_report-members.html index 12ff05d0b..56aa7a77d 100644 --- a/classpesieve_1_1_working_set_scan_report-members.html +++ b/classpesieve_1_1_working_set_scan_report-members.html @@ -92,27 +92,26 @@ generateTags(const std::string &reportPath)pesieve::WorkingSetScanReport get_scan_status(const ModuleScanReport *report)pesieve::ModuleScanReportinlinestatic getRelocBase()pesieve::ModuleScanReportinlinevirtual - has_patternspesieve::WorkingSetScanReport - has_pepesieve::WorkingSetScanReport - has_shellcodepesieve::WorkingSetScanReport - is_executablepesieve::WorkingSetScanReport - is_listed_modulepesieve::WorkingSetScanReport - isDotNetModulepesieve::ModuleScanReport - JSON_LEVELpesieve::ModuleScanReportstatic - mapped_namepesieve::WorkingSetScanReport - mapping_typepesieve::WorkingSetScanReport - match_area_startpesieve::WorkingSetScanReport - moduleFilepesieve::ModuleScanReport - ModuleScanReport(HMODULE _module, size_t _moduleSize, t_scan_status _status)pesieve::ModuleScanReportinline - ModuleScanReport(HMODULE _module, size_t _moduleSize)pesieve::ModuleScanReportinline - moduleSizepesieve::ModuleScanReport - protectionpesieve::WorkingSetScanReport - statspesieve::WorkingSetScanReport - statuspesieve::ModuleScanReport - toJSON(std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails)pesieve::WorkingSetScanReportinlinevirtual - translate_mapping_type(DWORD type)pesieve::WorkingSetScanReportinlineprotectedstatic - WorkingSetScanReport(HMODULE _module, size_t _moduleSize, t_scan_status status)pesieve::WorkingSetScanReportinline - ~ModuleScanReport()pesieve::ModuleScanReportinlinevirtual + has_pepesieve::WorkingSetScanReport + has_shellcodepesieve::WorkingSetScanReport + is_executablepesieve::WorkingSetScanReport + is_listed_modulepesieve::WorkingSetScanReport + isDotNetModulepesieve::ModuleScanReport + JSON_LEVELpesieve::ModuleScanReportstatic + mapped_namepesieve::WorkingSetScanReport + mapping_typepesieve::WorkingSetScanReport + match_area_startpesieve::WorkingSetScanReport + moduleFilepesieve::ModuleScanReport + ModuleScanReport(HMODULE _module, size_t _moduleSize, t_scan_status _status)pesieve::ModuleScanReportinline + ModuleScanReport(HMODULE _module, size_t _moduleSize)pesieve::ModuleScanReportinline + moduleSizepesieve::ModuleScanReport + protectionpesieve::WorkingSetScanReport + statspesieve::WorkingSetScanReport + statuspesieve::ModuleScanReport + toJSON(std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails)pesieve::WorkingSetScanReportinlinevirtual + translate_mapping_type(DWORD type)pesieve::WorkingSetScanReportinlineprotectedstatic + WorkingSetScanReport(HMODULE _module, size_t _moduleSize, t_scan_status status)pesieve::WorkingSetScanReportinline + ~ModuleScanReport()pesieve::ModuleScanReportinlinevirtual
diff --git a/classpesieve_1_1_working_set_scan_report.html b/classpesieve_1_1_working_set_scan_report.html index 91a2dca26..5e2385f09 100644 --- a/classpesieve_1_1_working_set_scan_report.html +++ b/classpesieve_1_1_working_set_scan_report.html @@ -133,8 +133,6 @@   bool has_shellcode   -bool has_patterns -  util::ByteBuffer data_cache   std::vector< sig_finder::Match > custom_matched @@ -521,22 +519,6 @@

Definition at line 110 of file workingset_scanner.h.

- - - -

◆ has_patterns

- -
-
- - - - -
bool pesieve::WorkingSetScanReport::has_patterns
-
- -

Definition at line 109 of file workingset_scanner.h.

-
diff --git a/classpesieve_1_1_working_set_scanner.html b/classpesieve_1_1_working_set_scanner.html index 78c497d10..1eba0af00 100644 --- a/classpesieve_1_1_working_set_scanner.html +++ b/classpesieve_1_1_working_set_scanner.html @@ -303,7 +303,7 @@

-

Definition at line 161 of file workingset_scanner.cpp.

+

Definition at line 157 of file workingset_scanner.cpp.

Here is the call graph for this function:
@@ -344,7 +344,7 @@

-

Definition at line 169 of file workingset_scanner.cpp.

+

Definition at line 165 of file workingset_scanner.cpp.

Here is the call graph for this function:
@@ -385,7 +385,7 @@

-

Definition at line 243 of file workingset_scanner.cpp.

+

Definition at line 239 of file workingset_scanner.cpp.

Here is the call graph for this function:
@@ -424,7 +424,7 @@

-

Definition at line 202 of file workingset_scanner.cpp.

+

Definition at line 198 of file workingset_scanner.cpp.

Here is the call graph for this function:
@@ -465,7 +465,7 @@

-

Definition at line 254 of file workingset_scanner.cpp.

+

Definition at line 250 of file workingset_scanner.cpp.

Here is the call graph for this function:
@@ -560,7 +560,7 @@

pesieve::ProcessFeatureScanner.

-

Definition at line 307 of file workingset_scanner.cpp.

+

Definition at line 303 of file workingset_scanner.cpp.

Here is the call graph for this function:
diff --git a/functions_h.html b/functions_h.html index 03cb65bcf..b3fec7fc4 100644 --- a/functions_h.html +++ b/functions_h.html @@ -76,7 +76,6 @@
Here is a list of all class members with links to the classes they belong to:

- h -

    -
  • has_patterns : pesieve::WorkingSetScanReport
  • has_pe : pesieve::WorkingSetScanReport
  • has_shellcode : pesieve::WorkingSetScanReport
  • hasAnyMatch() : pesieve::AreaInfo
    • diff --git a/functions_vars_h.html b/functions_vars_h.html index f79cf5ce9..403e9207e 100644 --- a/functions_vars_h.html +++ b/functions_vars_h.html @@ -76,7 +76,6 @@
    Here is a list of all variables with links to the classes they belong to:

    - h -

      -
    • has_patterns : pesieve::WorkingSetScanReport
    • has_pe : pesieve::WorkingSetScanReport
    • has_shellcode : pesieve::WorkingSetScanReport
    • hdr_mod : report
      • diff --git a/search/all_8.js b/search/all_8.js index bdddd164b..087db5fa0 100644 --- a/search/all_8.js +++ b/search/all_8.js @@ -1,42 +1,41 @@ var searchData= [ ['hardcodedpatterns_0',['HardcodedPatterns',['../namespacepesieve.html#afd37518d5bc5a27fc935b3b156f342ea',1,'pesieve']]], - ['has_5fpatterns_1',['has_patterns',['../classpesieve_1_1_working_set_scan_report.html#a8e70bced852069d9d3840138944a1735',1,'pesieve::WorkingSetScanReport']]], - ['has_5fpe_2',['has_pe',['../classpesieve_1_1_working_set_scan_report.html#aa07022105bbf1530e5fe9f7b0f9c4b71',1,'pesieve::WorkingSetScanReport']]], - ['has_5fshellcode_3',['has_shellcode',['../classpesieve_1_1_working_set_scan_report.html#aae424b26aea4d4149da47f74a033b2e6',1,'pesieve::WorkingSetScanReport']]], - ['hasanymatch_4',['hasAnyMatch',['../structpesieve_1_1_area_info.html#a210e631ce60f015ac4dec819adbe51fa',1,'pesieve::AreaInfo']]], - ['hasanyshowntype_5',['hasAnyShownType',['../classpesieve_1_1_process_scan_report.html#a0611939155d7d2de69941e7e00390848',1,'pesieve::ProcessScanReport']]], - ['hasexecutablesection_6',['hasExecutableSection',['../classpesieve_1_1_remote_module_data.html#a6eb25ec1a932a2c35d7decd82c3436a6',1,'pesieve::RemoteModuleData']]], - ['hasmatchat_7',['hasMatchAt',['../structpesieve_1_1_area_info.html#a2dba23499478d6e5593f0ccc3d4c6892',1,'pesieve::AreaInfo']]], - ['hasmodule_8',['hasModule',['../classpesieve_1_1_process_scan_report.html#aa8f38d2fdf0ebf4f5b0131d74d03565e',1,'pesieve::ProcessScanReport']]], - ['hasmodulecontaining_9',['hasModuleContaining',['../classpesieve_1_1_process_scan_report.html#ab694abcdd016d6f073b0f3488a197cb8',1,'pesieve::ProcessScanReport']]], - ['hasnthdrs_10',['hasNtHdrs',['../classpesieve_1_1_pe_artefacts.html#a09908fcbd1202e8c1de8b9a7b5f0eb0d',1,'pesieve::PeArtefacts']]], - ['hassectionhdrs_11',['hasSectionHdrs',['../classpesieve_1_1_pe_artefacts.html#a19961a28022c5d2e0616d0d3510f12ef',1,'pesieve::PeArtefacts']]], - ['hasshellcode_12',['hasShellcode',['../classpesieve_1_1_artefact_scanner.html#a22afe7bbf01e096fa32c6c44e7ddbb0a',1,'pesieve::ArtefactScanner']]], - ['haswatchedsubstring_13',['hasWatchedSubstring',['../structpesieve_1_1_multi_stats_settings.html#a3e718c8a7a6d70c36c27b399ef5af9ca',1,'pesieve::MultiStatsSettings']]], - ['hdr_5fmod_14',['hdr_mod',['../structreport.html#a87d7a61161d8ca92757893e667c320bb',1,'report']]], - ['headerbuffer_15',['headerBuffer',['../classpesieve_1_1_remote_module_data.html#a601a27ff576179474ff6270d4bdbc87f',1,'pesieve::RemoteModuleData']]], - ['headers_5fscanner_2ecpp_16',['headers_scanner.cpp',['../headers__scanner_8cpp.html',1,'']]], - ['headers_5fscanner_2eh_17',['headers_scanner.h',['../headers__scanner_8h.html',1,'']]], - ['headersscanner_18',['HeadersScanner',['../classpesieve_1_1_headers_scanner.html',1,'pesieve::HeadersScanner'],['../classpesieve_1_1_headers_scanner.html#ab4b106badf3fd89166b465feeaddb974',1,'pesieve::HeadersScanner::HeadersScanner()']]], - ['headersscanreport_19',['HeadersScanReport',['../classpesieve_1_1_headers_scan_report.html',1,'pesieve::HeadersScanReport'],['../classpesieve_1_1_headers_scan_report.html#a3c59fc978f4a4e36b7c71ab13502a2f6',1,'pesieve::HeadersScanReport::HeadersScanReport()']]], - ['hexdumpvalue_20',['hexdumpValue',['../namespacepesieve_1_1stats.html#a235bbf3728c908787cd60810dd2b3d67',1,'pesieve::stats']]], - ['hfile_21',['hFile',['../namespacepesieve_1_1util.html#abbfc80ee34aa4b5e1dfa78c1537fe405',1,'pesieve::util']]], - ['hilighted_5fcolor_22',['HILIGHTED_COLOR',['../namespacepesieve.html#a1eba647f3f36f78d8280a93989228576',1,'pesieve']]], - ['histogram_23',['histogram',['../classpesieve_1_1_area_entropy_stats.html#a6fba37441b9fc3f27ba4ddb046012cf5',1,'pesieve::AreaEntropyStats::histogram'],['../structpesieve_1_1_chunk_stats.html#ac86682199b912201e57117ad9af87a4e',1,'pesieve::ChunkStats::histogram']]], - ['hook_5faddr_5freplacement_24',['HOOK_ADDR_REPLACEMENT',['../namespacepesieve.html#a2b1dc083f0bcae84735e71b374c389efae74f7aeade28da61cce224db03971821',1,'pesieve']]], - ['hook_5finline_25',['HOOK_INLINE',['../namespacepesieve.html#a2b1dc083f0bcae84735e71b374c389efa3ce6a9e364e0bd15f0c7bee26a0729c3',1,'pesieve']]], - ['hook_5fnone_26',['HOOK_NONE',['../namespacepesieve.html#a2b1dc083f0bcae84735e71b374c389efafddd2a4da73039f369153cc60a2d6983',1,'pesieve']]], - ['hook_5ftargets_5fresolver_2ecpp_27',['hook_targets_resolver.cpp',['../hook__targets__resolver_8cpp.html',1,'']]], - ['hook_5ftargets_5fresolver_2eh_28',['hook_targets_resolver.h',['../hook__targets__resolver_8h.html',1,'']]], - ['hooked_5ffunc_29',['hooked_func',['../classpesieve_1_1_patch_list_1_1_patch.html#a4aa1cbe33dae22e9e11bcbaf2e78331f',1,'pesieve::PatchList::Patch']]], - ['hookstagfilename_30',['hooksTagFileName',['../classpesieve_1_1_module_dump_report.html#a8c3e80abf3b10c812816630052e02e5c',1,'pesieve::ModuleDumpReport']]], - ['hookstojson_31',['hooksToJSON',['../classpesieve_1_1_i_a_t_scan_report.html#a601ee6e6ef776eb84f367c4836648546',1,'pesieve::IATScanReport']]], - ['hooktargetmodname_32',['hookTargetModName',['../classpesieve_1_1_patch_list_1_1_patch.html#a539b13c352084f0c62380fd35f388d83',1,'pesieve::PatchList::Patch']]], - ['hooktargetmodule_33',['hookTargetModule',['../classpesieve_1_1_patch_list_1_1_patch.html#acec7a5d8080e88233a3df43d8baf22b5',1,'pesieve::PatchList::Patch']]], - ['hooktargetresolver_34',['HookTargetResolver',['../classpesieve_1_1_hook_target_resolver.html',1,'pesieve::HookTargetResolver'],['../classpesieve_1_1_hook_target_resolver.html#a67f45c79aabc8609ff844bfde436bc4d',1,'pesieve::HookTargetResolver::HookTargetResolver()']]], - ['hooktargetva_35',['hookTargetVA',['../classpesieve_1_1_patch_list_1_1_patch.html#a88a970b68970e94884d5f4e2efd80359',1,'pesieve::PatchList::Patch']]], - ['hprocess_36',['hProcess',['../struct__t__stack__enum__params.html#a657834de8b3a9b7525907db521be6552',1,'_t_stack_enum_params']]], - ['hpss_37',['HPSS',['../process__reflection_8cpp.html#a245cc83fbf7f180ff454a487cae263ea',1,'process_reflection.cpp']]], - ['hthread_38',['hThread',['../struct__t__stack__enum__params.html#af39d9900e3d580fea3a16440f979bcef',1,'_t_stack_enum_params']]] + ['has_5fpe_1',['has_pe',['../classpesieve_1_1_working_set_scan_report.html#aa07022105bbf1530e5fe9f7b0f9c4b71',1,'pesieve::WorkingSetScanReport']]], + ['has_5fshellcode_2',['has_shellcode',['../classpesieve_1_1_working_set_scan_report.html#aae424b26aea4d4149da47f74a033b2e6',1,'pesieve::WorkingSetScanReport']]], + ['hasanymatch_3',['hasAnyMatch',['../structpesieve_1_1_area_info.html#a210e631ce60f015ac4dec819adbe51fa',1,'pesieve::AreaInfo']]], + ['hasanyshowntype_4',['hasAnyShownType',['../classpesieve_1_1_process_scan_report.html#a0611939155d7d2de69941e7e00390848',1,'pesieve::ProcessScanReport']]], + ['hasexecutablesection_5',['hasExecutableSection',['../classpesieve_1_1_remote_module_data.html#a6eb25ec1a932a2c35d7decd82c3436a6',1,'pesieve::RemoteModuleData']]], + ['hasmatchat_6',['hasMatchAt',['../structpesieve_1_1_area_info.html#a2dba23499478d6e5593f0ccc3d4c6892',1,'pesieve::AreaInfo']]], + ['hasmodule_7',['hasModule',['../classpesieve_1_1_process_scan_report.html#aa8f38d2fdf0ebf4f5b0131d74d03565e',1,'pesieve::ProcessScanReport']]], + ['hasmodulecontaining_8',['hasModuleContaining',['../classpesieve_1_1_process_scan_report.html#ab694abcdd016d6f073b0f3488a197cb8',1,'pesieve::ProcessScanReport']]], + ['hasnthdrs_9',['hasNtHdrs',['../classpesieve_1_1_pe_artefacts.html#a09908fcbd1202e8c1de8b9a7b5f0eb0d',1,'pesieve::PeArtefacts']]], + ['hassectionhdrs_10',['hasSectionHdrs',['../classpesieve_1_1_pe_artefacts.html#a19961a28022c5d2e0616d0d3510f12ef',1,'pesieve::PeArtefacts']]], + ['hasshellcode_11',['hasShellcode',['../classpesieve_1_1_artefact_scanner.html#a22afe7bbf01e096fa32c6c44e7ddbb0a',1,'pesieve::ArtefactScanner']]], + ['haswatchedsubstring_12',['hasWatchedSubstring',['../structpesieve_1_1_multi_stats_settings.html#a3e718c8a7a6d70c36c27b399ef5af9ca',1,'pesieve::MultiStatsSettings']]], + ['hdr_5fmod_13',['hdr_mod',['../structreport.html#a87d7a61161d8ca92757893e667c320bb',1,'report']]], + ['headerbuffer_14',['headerBuffer',['../classpesieve_1_1_remote_module_data.html#a601a27ff576179474ff6270d4bdbc87f',1,'pesieve::RemoteModuleData']]], + ['headers_5fscanner_2ecpp_15',['headers_scanner.cpp',['../headers__scanner_8cpp.html',1,'']]], + ['headers_5fscanner_2eh_16',['headers_scanner.h',['../headers__scanner_8h.html',1,'']]], + ['headersscanner_17',['HeadersScanner',['../classpesieve_1_1_headers_scanner.html',1,'pesieve::HeadersScanner'],['../classpesieve_1_1_headers_scanner.html#ab4b106badf3fd89166b465feeaddb974',1,'pesieve::HeadersScanner::HeadersScanner()']]], + ['headersscanreport_18',['HeadersScanReport',['../classpesieve_1_1_headers_scan_report.html',1,'pesieve::HeadersScanReport'],['../classpesieve_1_1_headers_scan_report.html#a3c59fc978f4a4e36b7c71ab13502a2f6',1,'pesieve::HeadersScanReport::HeadersScanReport()']]], + ['hexdumpvalue_19',['hexdumpValue',['../namespacepesieve_1_1stats.html#a235bbf3728c908787cd60810dd2b3d67',1,'pesieve::stats']]], + ['hfile_20',['hFile',['../namespacepesieve_1_1util.html#abbfc80ee34aa4b5e1dfa78c1537fe405',1,'pesieve::util']]], + ['hilighted_5fcolor_21',['HILIGHTED_COLOR',['../namespacepesieve.html#a1eba647f3f36f78d8280a93989228576',1,'pesieve']]], + ['histogram_22',['histogram',['../classpesieve_1_1_area_entropy_stats.html#a6fba37441b9fc3f27ba4ddb046012cf5',1,'pesieve::AreaEntropyStats::histogram'],['../structpesieve_1_1_chunk_stats.html#ac86682199b912201e57117ad9af87a4e',1,'pesieve::ChunkStats::histogram']]], + ['hook_5faddr_5freplacement_23',['HOOK_ADDR_REPLACEMENT',['../namespacepesieve.html#a2b1dc083f0bcae84735e71b374c389efae74f7aeade28da61cce224db03971821',1,'pesieve']]], + ['hook_5finline_24',['HOOK_INLINE',['../namespacepesieve.html#a2b1dc083f0bcae84735e71b374c389efa3ce6a9e364e0bd15f0c7bee26a0729c3',1,'pesieve']]], + ['hook_5fnone_25',['HOOK_NONE',['../namespacepesieve.html#a2b1dc083f0bcae84735e71b374c389efafddd2a4da73039f369153cc60a2d6983',1,'pesieve']]], + ['hook_5ftargets_5fresolver_2ecpp_26',['hook_targets_resolver.cpp',['../hook__targets__resolver_8cpp.html',1,'']]], + ['hook_5ftargets_5fresolver_2eh_27',['hook_targets_resolver.h',['../hook__targets__resolver_8h.html',1,'']]], + ['hooked_5ffunc_28',['hooked_func',['../classpesieve_1_1_patch_list_1_1_patch.html#a4aa1cbe33dae22e9e11bcbaf2e78331f',1,'pesieve::PatchList::Patch']]], + ['hookstagfilename_29',['hooksTagFileName',['../classpesieve_1_1_module_dump_report.html#a8c3e80abf3b10c812816630052e02e5c',1,'pesieve::ModuleDumpReport']]], + ['hookstojson_30',['hooksToJSON',['../classpesieve_1_1_i_a_t_scan_report.html#a601ee6e6ef776eb84f367c4836648546',1,'pesieve::IATScanReport']]], + ['hooktargetmodname_31',['hookTargetModName',['../classpesieve_1_1_patch_list_1_1_patch.html#a539b13c352084f0c62380fd35f388d83',1,'pesieve::PatchList::Patch']]], + ['hooktargetmodule_32',['hookTargetModule',['../classpesieve_1_1_patch_list_1_1_patch.html#acec7a5d8080e88233a3df43d8baf22b5',1,'pesieve::PatchList::Patch']]], + ['hooktargetresolver_33',['HookTargetResolver',['../classpesieve_1_1_hook_target_resolver.html',1,'pesieve::HookTargetResolver'],['../classpesieve_1_1_hook_target_resolver.html#a67f45c79aabc8609ff844bfde436bc4d',1,'pesieve::HookTargetResolver::HookTargetResolver()']]], + ['hooktargetva_34',['hookTargetVA',['../classpesieve_1_1_patch_list_1_1_patch.html#a88a970b68970e94884d5f4e2efd80359',1,'pesieve::PatchList::Patch']]], + ['hprocess_35',['hProcess',['../struct__t__stack__enum__params.html#a657834de8b3a9b7525907db521be6552',1,'_t_stack_enum_params']]], + ['hpss_36',['HPSS',['../process__reflection_8cpp.html#a245cc83fbf7f180ff454a487cae263ea',1,'process_reflection.cpp']]], + ['hthread_37',['hThread',['../struct__t__stack__enum__params.html#af39d9900e3d580fea3a16440f979bcef',1,'_t_stack_enum_params']]] ]; diff --git a/search/variables_8.js b/search/variables_8.js index bae6cede6..61500f91a 100644 --- a/search/variables_8.js +++ b/search/variables_8.js @@ -1,19 +1,18 @@ var searchData= [ ['hardcodedpatterns_0',['HardcodedPatterns',['../namespacepesieve.html#afd37518d5bc5a27fc935b3b156f342ea',1,'pesieve']]], - ['has_5fpatterns_1',['has_patterns',['../classpesieve_1_1_working_set_scan_report.html#a8e70bced852069d9d3840138944a1735',1,'pesieve::WorkingSetScanReport']]], - ['has_5fpe_2',['has_pe',['../classpesieve_1_1_working_set_scan_report.html#aa07022105bbf1530e5fe9f7b0f9c4b71',1,'pesieve::WorkingSetScanReport']]], - ['has_5fshellcode_3',['has_shellcode',['../classpesieve_1_1_working_set_scan_report.html#aae424b26aea4d4149da47f74a033b2e6',1,'pesieve::WorkingSetScanReport']]], - ['hdr_5fmod_4',['hdr_mod',['../structreport.html#a87d7a61161d8ca92757893e667c320bb',1,'report']]], - ['headerbuffer_5',['headerBuffer',['../classpesieve_1_1_remote_module_data.html#a601a27ff576179474ff6270d4bdbc87f',1,'pesieve::RemoteModuleData']]], - ['hfile_6',['hFile',['../namespacepesieve_1_1util.html#abbfc80ee34aa4b5e1dfa78c1537fe405',1,'pesieve::util']]], - ['hilighted_5fcolor_7',['HILIGHTED_COLOR',['../namespacepesieve.html#a1eba647f3f36f78d8280a93989228576',1,'pesieve']]], - ['histogram_8',['histogram',['../classpesieve_1_1_area_entropy_stats.html#a6fba37441b9fc3f27ba4ddb046012cf5',1,'pesieve::AreaEntropyStats::histogram'],['../structpesieve_1_1_chunk_stats.html#ac86682199b912201e57117ad9af87a4e',1,'pesieve::ChunkStats::histogram']]], - ['hooked_5ffunc_9',['hooked_func',['../classpesieve_1_1_patch_list_1_1_patch.html#a4aa1cbe33dae22e9e11bcbaf2e78331f',1,'pesieve::PatchList::Patch']]], - ['hookstagfilename_10',['hooksTagFileName',['../classpesieve_1_1_module_dump_report.html#a8c3e80abf3b10c812816630052e02e5c',1,'pesieve::ModuleDumpReport']]], - ['hooktargetmodname_11',['hookTargetModName',['../classpesieve_1_1_patch_list_1_1_patch.html#a539b13c352084f0c62380fd35f388d83',1,'pesieve::PatchList::Patch']]], - ['hooktargetmodule_12',['hookTargetModule',['../classpesieve_1_1_patch_list_1_1_patch.html#acec7a5d8080e88233a3df43d8baf22b5',1,'pesieve::PatchList::Patch']]], - ['hooktargetva_13',['hookTargetVA',['../classpesieve_1_1_patch_list_1_1_patch.html#a88a970b68970e94884d5f4e2efd80359',1,'pesieve::PatchList::Patch']]], - ['hprocess_14',['hProcess',['../struct__t__stack__enum__params.html#a657834de8b3a9b7525907db521be6552',1,'_t_stack_enum_params']]], - ['hthread_15',['hThread',['../struct__t__stack__enum__params.html#af39d9900e3d580fea3a16440f979bcef',1,'_t_stack_enum_params']]] + ['has_5fpe_1',['has_pe',['../classpesieve_1_1_working_set_scan_report.html#aa07022105bbf1530e5fe9f7b0f9c4b71',1,'pesieve::WorkingSetScanReport']]], + ['has_5fshellcode_2',['has_shellcode',['../classpesieve_1_1_working_set_scan_report.html#aae424b26aea4d4149da47f74a033b2e6',1,'pesieve::WorkingSetScanReport']]], + ['hdr_5fmod_3',['hdr_mod',['../structreport.html#a87d7a61161d8ca92757893e667c320bb',1,'report']]], + ['headerbuffer_4',['headerBuffer',['../classpesieve_1_1_remote_module_data.html#a601a27ff576179474ff6270d4bdbc87f',1,'pesieve::RemoteModuleData']]], + ['hfile_5',['hFile',['../namespacepesieve_1_1util.html#abbfc80ee34aa4b5e1dfa78c1537fe405',1,'pesieve::util']]], + ['hilighted_5fcolor_6',['HILIGHTED_COLOR',['../namespacepesieve.html#a1eba647f3f36f78d8280a93989228576',1,'pesieve']]], + ['histogram_7',['histogram',['../classpesieve_1_1_area_entropy_stats.html#a6fba37441b9fc3f27ba4ddb046012cf5',1,'pesieve::AreaEntropyStats::histogram'],['../structpesieve_1_1_chunk_stats.html#ac86682199b912201e57117ad9af87a4e',1,'pesieve::ChunkStats::histogram']]], + ['hooked_5ffunc_8',['hooked_func',['../classpesieve_1_1_patch_list_1_1_patch.html#a4aa1cbe33dae22e9e11bcbaf2e78331f',1,'pesieve::PatchList::Patch']]], + ['hookstagfilename_9',['hooksTagFileName',['../classpesieve_1_1_module_dump_report.html#a8c3e80abf3b10c812816630052e02e5c',1,'pesieve::ModuleDumpReport']]], + ['hooktargetmodname_10',['hookTargetModName',['../classpesieve_1_1_patch_list_1_1_patch.html#a539b13c352084f0c62380fd35f388d83',1,'pesieve::PatchList::Patch']]], + ['hooktargetmodule_11',['hookTargetModule',['../classpesieve_1_1_patch_list_1_1_patch.html#acec7a5d8080e88233a3df43d8baf22b5',1,'pesieve::PatchList::Patch']]], + ['hooktargetva_12',['hookTargetVA',['../classpesieve_1_1_patch_list_1_1_patch.html#a88a970b68970e94884d5f4e2efd80359',1,'pesieve::PatchList::Patch']]], + ['hprocess_13',['hProcess',['../struct__t__stack__enum__params.html#a657834de8b3a9b7525907db521be6552',1,'_t_stack_enum_params']]], + ['hthread_14',['hThread',['../struct__t__stack__enum__params.html#af39d9900e3d580fea3a16440f979bcef',1,'_t_stack_enum_params']]] ]; diff --git a/workingset__scanner_8cpp_source.html b/workingset__scanner_8cpp_source.html index f4fa2ffbd..c256142ed 100644 --- a/workingset__scanner_8cpp_source.html +++ b/workingset__scanner_8cpp_source.html @@ -239,239 +239,235 @@
      145 }
      146 my_report->has_shellcode = code;
      147
      -
      148 if (custom_matched_count && this->args.pattern_file.length) {
      -
      149 my_report->has_patterns = true;
      -
      150 my_report->status = SCAN_SUSPICIOUS;
      -
      151 }
      -
      152 if ( (this->args.obfuscated != OBFUSC_NONE && obfuscated) || ((this->args.shellcode != SHELLC_NONE) && code) ){
      -
      153 my_report->status = SCAN_SUSPICIOUS;
      -
      154 }
      -
      155 if (my_report->status == SCAN_SUSPICIOUS) {
      -
      156 my_report->data_cache = memPage.loadedData;
      -
      157 }
      -
      158 return true;
      -
      159}
      +
      148 if ( (this->args.obfuscated != OBFUSC_NONE && obfuscated) || ((this->args.shellcode != SHELLC_NONE) && code) ){
      +
      149 my_report->status = SCAN_SUSPICIOUS;
      +
      150 }
      +
      151 if (my_report->status == SCAN_SUSPICIOUS) {
      +
      152 my_report->data_cache = memPage.loadedData;
      +
      153 }
      +
      154 return true;
      +
      155}
-
160
-
-
161bool pesieve::WorkingSetScanner::isExecutable(MemPageData &memPage)
-
162{
-
163 if (pesieve::util::is_executable(memPage.mapping_type, memPage.protection)) {
-
164 return true;
-
165 }
-
166 return isPotentiallyExecutable(memPage, this->args.data);
-
167}
+
156
+
+
157bool pesieve::WorkingSetScanner::isExecutable(MemPageData &memPage)
+
158{
+
159 if (pesieve::util::is_executable(memPage.mapping_type, memPage.protection)) {
+
160 return true;
+
161 }
+
162 return isPotentiallyExecutable(memPage, this->args.data);
+
163}
-
168
-
-
169bool pesieve::WorkingSetScanner::isPotentiallyExecutable(MemPageData &memPage, const t_data_scan_mode &mode)
-
170{
-
171 if (mode == pesieve::PE_DATA_NO_SCAN) {
-
172 return false;
-
173 }
-
174
-
175 // check preconditions:
-
176 const bool is_managed = this->processReport.isManagedProcess();
-
177 if (mode == pesieve::PE_DATA_SCAN_NO_DEP
-
178 && this->pDetails.isDEP && !is_managed)
-
179 {
-
180 return false;
-
181 }
-
182 if (mode == pesieve::PE_DATA_SCAN_DOTNET
-
183 && !is_managed)
-
184 {
-
185 return false;
-
186 }
-
187 // preconditions are fulfilled, now check the access:
-
188 const bool is_page_readable = pesieve::util::is_readable(memPage.mapping_type, memPage.protection);
-
189 if (mode != pesieve::PE_DATA_SCAN_INACCESSIBLE_ONLY) {
-
190 if (is_page_readable) {
-
191 return true;
-
192 }
-
193 }
-
194 if ((mode >= pesieve::PE_DATA_SCAN_INACCESSIBLE) || (mode == pesieve::PE_DATA_SCAN_INACCESSIBLE_ONLY)) {
-
195 if (this->pDetails.isReflection && (memPage.protection & PAGE_NOACCESS)) {
-
196 return true;
-
197 }
-
198 }
-
199 return false;
-
200}
+
164
+
+
165bool pesieve::WorkingSetScanner::isPotentiallyExecutable(MemPageData &memPage, const t_data_scan_mode &mode)
+
166{
+
167 if (mode == pesieve::PE_DATA_NO_SCAN) {
+
168 return false;
+
169 }
+
170
+
171 // check preconditions:
+
172 const bool is_managed = this->processReport.isManagedProcess();
+
173 if (mode == pesieve::PE_DATA_SCAN_NO_DEP
+
174 && this->pDetails.isDEP && !is_managed)
+
175 {
+
176 return false;
+
177 }
+
178 if (mode == pesieve::PE_DATA_SCAN_DOTNET
+
179 && !is_managed)
+
180 {
+
181 return false;
+
182 }
+
183 // preconditions are fulfilled, now check the access:
+
184 const bool is_page_readable = pesieve::util::is_readable(memPage.mapping_type, memPage.protection);
+
185 if (mode != pesieve::PE_DATA_SCAN_INACCESSIBLE_ONLY) {
+
186 if (is_page_readable) {
+
187 return true;
+
188 }
+
189 }
+
190 if ((mode >= pesieve::PE_DATA_SCAN_INACCESSIBLE) || (mode == pesieve::PE_DATA_SCAN_INACCESSIBLE_ONLY)) {
+
191 if (this->pDetails.isReflection && (memPage.protection & PAGE_NOACCESS)) {
+
192 return true;
+
193 }
+
194 }
+
195 return false;
+
196}
-
201
-
-
202WorkingSetScanReport* pesieve::WorkingSetScanner::scanExecutableArea(MemPageData &_memPage)
-
203{
-
204 if (!_memPage.load()) {
-
205 return nullptr;
-
206 }
-
207 // check for PE artifacts (regardless if it has shellcode patterns):
-
208 if (!isScannedAsModule(_memPage)) {
-
209 ArtefactScanner artefactScanner(this->processHandle, this->pDetails, _memPage, this->processReport);
-
210 WorkingSetScanReport *my_report1 = artefactScanner.scanRemote();
-
211 if (my_report1) {
-
212 //pe artefacts found
-
213 return my_report1;
-
214 }
-
215 }
-
216 if ((!matcher::is_matcher_ready())
-
217 && (this->args.obfuscated == OBFUSC_NONE))
-
218 {
-
219 // not a PE file, and we are not interested in patterns or obfuscated contents, so just finish it here
-
220 return nullptr;
-
221 }
-
222
-
223 //report about shellcode:
-
224 ULONGLONG region_start = _memPage.region_start;
-
225 const size_t region_size = size_t(_memPage.region_end - region_start);
-
226 WorkingSetScanReport* my_report = new WorkingSetScanReport((HMODULE)region_start, region_size, SCAN_NOT_SUSPICIOUS);
-
227 if (!my_report) {
-
228 return nullptr;
+
197
+
+
198WorkingSetScanReport* pesieve::WorkingSetScanner::scanExecutableArea(MemPageData &_memPage)
+
199{
+
200 if (!_memPage.load()) {
+
201 return nullptr;
+
202 }
+
203 // check for PE artifacts (regardless if it has shellcode patterns):
+
204 if (!isScannedAsModule(_memPage)) {
+
205 ArtefactScanner artefactScanner(this->processHandle, this->pDetails, _memPage, this->processReport);
+
206 WorkingSetScanReport *my_report1 = artefactScanner.scanRemote();
+
207 if (my_report1) {
+
208 //pe artefacts found
+
209 return my_report1;
+
210 }
+
211 }
+
212 if ((!matcher::is_matcher_ready())
+
213 && (this->args.obfuscated == OBFUSC_NONE))
+
214 {
+
215 // not a PE file, and we are not interested in patterns or obfuscated contents, so just finish it here
+
216 return nullptr;
+
217 }
+
218
+
219 //report about shellcode:
+
220 ULONGLONG region_start = _memPage.region_start;
+
221 const size_t region_size = size_t(_memPage.region_end - region_start);
+
222 WorkingSetScanReport* my_report = new WorkingSetScanReport((HMODULE)region_start, region_size, SCAN_NOT_SUSPICIOUS);
+
223 if (!my_report) {
+
224 return nullptr;
+
225 }
+
226
+
227 if (!checkAreaContent(_memPage, my_report)) { // check for shellcode patterns & stats
+
228 my_report->status = SCAN_ERROR;
229 }
-
230
-
231 if (!checkAreaContent(_memPage, my_report)) { // check for shellcode patterns & stats
-
232 my_report->status = SCAN_ERROR;
-
233 }
-
234 if (my_report->status == SCAN_NOT_SUSPICIOUS) {
-
235 // do not keep reports for not suspicious areas
-
236 delete my_report;
-
237 return nullptr;
-
238 }
-
239 my_report->has_pe = isScannedAsModule(_memPage) && this->processReport.hasModule(_memPage.region_start);
-
240 return my_report;
-
241}
+
230 if (my_report->status == SCAN_NOT_SUSPICIOUS) {
+
231 // do not keep reports for not suspicious areas
+
232 delete my_report;
+
233 return nullptr;
+
234 }
+
235 my_report->has_pe = isScannedAsModule(_memPage) && this->processReport.hasModule(_memPage.region_start);
+
236 return my_report;
+
237}
-
242
-
-
243bool pesieve::WorkingSetScanner::isScannedAsModule(MemPageData &memPage)
-
244{
-
245 if (memPage.mapping_type != MEM_IMAGE) {
-
246 return false;
-
247 }
-
248 if (this->processReport.hasModule((ULONGLONG)memPage.alloc_base)) {
-
249 return true; // it was already scanned as a PE
-
250 }
-
251 return false;
-
252}
+
238
+
+
239bool pesieve::WorkingSetScanner::isScannedAsModule(MemPageData &memPage)
+
240{
+
241 if (memPage.mapping_type != MEM_IMAGE) {
+
242 return false;
+
243 }
+
244 if (this->processReport.hasModule((ULONGLONG)memPage.alloc_base)) {
+
245 return true; // it was already scanned as a PE
+
246 }
+
247 return false;
+
248}
-
253
-
-
254bool pesieve::WorkingSetScanner::scanImg(MemPageData& memPage)
-
255{
-
256 if (!memPage.loadMappedName()) {
-
257 //cannot retrieve the mapped name
-
258 return false;
-
259 }
-
260
-
261 const HMODULE module_start = (HMODULE)memPage.alloc_base;
-
262
-
263 if (!args.quiet) {
-
264 std::cout << "[!] Scanning detached: " << std::hex << module_start << " : " << memPage.mapped_name << std::endl;
-
265 }
-
266 RemoteModuleData remoteModData(this->processHandle, this->pDetails.isReflection, module_start);
-
267 if (!remoteModData.isInitialized()) {
-
268 if (!args.quiet) {
-
269 std::cout << "[-] Could not read the remote PE at: " << std::hex << module_start << std::endl;
-
270 }
-
271 return false;
-
272 }
-
273
-
274 //load module from file:
-
275 ModuleData modData(processHandle, module_start, memPage.mapped_name, args.use_cache);
-
276 if (!modData.loadOriginal()) {
-
277 if (!args.quiet) {
-
278 std::cerr << "[-] [" << std::hex << modData.moduleHandle << "] Could not read the module file" << std::endl;
-
279 }
-
280 processReport.appendReport(new UnreachableModuleReport(module_start, 0, memPage.mapped_name));
-
281 return false;
-
282 }
-
283 t_scan_status scan_status = ProcessScanner::scanForHollows(processHandle, modData, remoteModData, processReport);
-
284#ifdef _DEBUG
-
285 std::cout << "[*] Scanned for hollows. Status: " << scan_status << std::endl;
-
286#endif
-
287 if (scan_status == SCAN_ERROR) {
-
288 // failed scanning it as a loaded PE module
-
289 return false;
+
249
+
+
250bool pesieve::WorkingSetScanner::scanImg(MemPageData& memPage)
+
251{
+
252 if (!memPage.loadMappedName()) {
+
253 //cannot retrieve the mapped name
+
254 return false;
+
255 }
+
256
+
257 const HMODULE module_start = (HMODULE)memPage.alloc_base;
+
258
+
259 if (!args.quiet) {
+
260 std::cout << "[!] Scanning detached: " << std::hex << module_start << " : " << memPage.mapped_name << std::endl;
+
261 }
+
262 RemoteModuleData remoteModData(this->processHandle, this->pDetails.isReflection, module_start);
+
263 if (!remoteModData.isInitialized()) {
+
264 if (!args.quiet) {
+
265 std::cout << "[-] Could not read the remote PE at: " << std::hex << module_start << std::endl;
+
266 }
+
267 return false;
+
268 }
+
269
+
270 //load module from file:
+
271 ModuleData modData(processHandle, module_start, memPage.mapped_name, args.use_cache);
+
272 if (!modData.loadOriginal()) {
+
273 if (!args.quiet) {
+
274 std::cerr << "[-] [" << std::hex << modData.moduleHandle << "] Could not read the module file" << std::endl;
+
275 }
+
276 processReport.appendReport(new UnreachableModuleReport(module_start, 0, memPage.mapped_name));
+
277 return false;
+
278 }
+
279 t_scan_status scan_status = ProcessScanner::scanForHollows(processHandle, modData, remoteModData, processReport);
+
280#ifdef _DEBUG
+
281 std::cout << "[*] Scanned for hollows. Status: " << scan_status << std::endl;
+
282#endif
+
283 if (scan_status == SCAN_ERROR) {
+
284 // failed scanning it as a loaded PE module
+
285 return false;
+
286 }
+
287 if (scan_status == SCAN_SUSPICIOUS) {
+
288 // detected as hollowed, no need for further scans
+
289 return true;
290 }
-
291 if (scan_status == SCAN_SUSPICIOUS) {
-
292 // detected as hollowed, no need for further scans
-
293 return true;
-
294 }
-
295 if (!args.no_hooks) {
-
296 const bool scan_data = (this->args.data >= pesieve::PE_DATA_SCAN_ALWAYS && this->args.data != PE_DATA_SCAN_INACCESSIBLE_ONLY)
-
297 || (!this->pDetails.isDEP && (this->args.data == pesieve::PE_DATA_SCAN_NO_DEP));
-
298 const bool scan_inaccessible = (this->pDetails.isReflection && (this->args.data >= pesieve::PE_DATA_SCAN_INACCESSIBLE));
-
299 scan_status = ProcessScanner::scanForHooks(processHandle, modData, remoteModData, processReport, scan_data, scan_inaccessible);
-
300#ifdef _DEBUG
-
301 std::cout << "[*] Scanned for hooks. Status: " << scan_status << std::endl;
-
302#endif
-
303 }
-
304 return true;
-
305}
+
291 if (!args.no_hooks) {
+
292 const bool scan_data = (this->args.data >= pesieve::PE_DATA_SCAN_ALWAYS && this->args.data != PE_DATA_SCAN_INACCESSIBLE_ONLY)
+
293 || (!this->pDetails.isDEP && (this->args.data == pesieve::PE_DATA_SCAN_NO_DEP));
+
294 const bool scan_inaccessible = (this->pDetails.isReflection && (this->args.data >= pesieve::PE_DATA_SCAN_INACCESSIBLE));
+
295 scan_status = ProcessScanner::scanForHooks(processHandle, modData, remoteModData, processReport, scan_data, scan_inaccessible);
+
296#ifdef _DEBUG
+
297 std::cout << "[*] Scanned for hooks. Status: " << scan_status << std::endl;
+
298#endif
+
299 }
+
300 return true;
+
301}
-
306
-
-
307WorkingSetScanReport* pesieve::WorkingSetScanner::scanRemote()
-
308{
-
309 MemPageData memPage(this->processHandle, this->pDetails.isReflection, this->memRegion.base, 0);
-
310 memPage.is_listed_module = this->processReport.hasModule(this->memRegion.base);
-
311
-
312 if (!memPage.isInfoFilled() && !memPage.fillInfo()) {
-
313#ifdef _DEBUG
-
314 std::cout << "[!] Could not fill: " << std::hex << memPage.start_va << " to: " << memPage.region_end << "\n";
-
315#endif
-
316 return nullptr;
-
317 }
-
318 // sanity checks to make sure that we are scanning the same page that was previously collected:
-
319 if (memPage.alloc_base != this->memRegion.alloc_base) {
-
320#ifdef _DEBUG
-
321 std::cerr << "WARNING: Alloc Base mismatch: " << std::hex << memPage.alloc_base << " vs " << this->memRegion.alloc_base << std::endl;
-
322#endif
-
323 return nullptr;
-
324 }
-
325 if ((memPage.region_end - memPage.region_start) != this->memRegion.size) {
-
326#ifdef _DEBUG
-
327 std::cerr << "WARNING: Size mismatch: " << std::hex << (memPage.region_end - memPage.region_start) << " vs " << this->memRegion.size << std::endl;
-
328#endif
-
329 return nullptr;
-
330 }
-
331
-
332 // is the page executable?
-
333 const bool is_any_exec = isExecutable(memPage);
-
334 if (!is_any_exec) {
-
335 // probably not interesting
-
336 return nullptr;
-
337 }
-
338
-
339 if (memPage.mapping_type == MEM_MAPPED && memPage.isRealMapping()) {
-
340 //probably legit
-
341 return nullptr;
-
342 }
-
343
-
344 if (memPage.mapping_type == MEM_IMAGE) {
-
345 memPage.loadModuleName();
-
346 memPage.loadMappedName();
-
347 if (!isScannedAsModule(memPage)) {
-
348 scanImg(memPage);
-
349 }
-
350 const size_t region_size = (memPage.region_end) ? (memPage.region_end - memPage.region_start) : 0;
-
351 if (this->processReport.hasModuleContaining(memPage.region_start, region_size)) {
-
352 // the area was already scanned
-
353 return nullptr;
-
354 }
-
355 }
-
356#ifdef _DEBUG
-
357 std::cout << std::hex << memPage.start_va << ": Scanning executable area" << std::endl;
-
358#endif
-
359 WorkingSetScanReport* my_report = this->scanExecutableArea(memPage);
-
360 if (!my_report) {
-
361 return nullptr;
-
362 }
-
363 my_report->is_executable = true;
-
364 my_report->protection = memPage.protection;
-
365 my_report->mapping_type = memPage.mapping_type;
-
366 my_report->mapped_name = memPage.mapped_name;
-
367 return my_report;
-
368}
+
302
+
+
303WorkingSetScanReport* pesieve::WorkingSetScanner::scanRemote()
+
304{
+
305 MemPageData memPage(this->processHandle, this->pDetails.isReflection, this->memRegion.base, 0);
+
306 memPage.is_listed_module = this->processReport.hasModule(this->memRegion.base);
+
307
+
308 if (!memPage.isInfoFilled() && !memPage.fillInfo()) {
+
309#ifdef _DEBUG
+
310 std::cout << "[!] Could not fill: " << std::hex << memPage.start_va << " to: " << memPage.region_end << "\n";
+
311#endif
+
312 return nullptr;
+
313 }
+
314 // sanity checks to make sure that we are scanning the same page that was previously collected:
+
315 if (memPage.alloc_base != this->memRegion.alloc_base) {
+
316#ifdef _DEBUG
+
317 std::cerr << "WARNING: Alloc Base mismatch: " << std::hex << memPage.alloc_base << " vs " << this->memRegion.alloc_base << std::endl;
+
318#endif
+
319 return nullptr;
+
320 }
+
321 if ((memPage.region_end - memPage.region_start) != this->memRegion.size) {
+
322#ifdef _DEBUG
+
323 std::cerr << "WARNING: Size mismatch: " << std::hex << (memPage.region_end - memPage.region_start) << " vs " << this->memRegion.size << std::endl;
+
324#endif
+
325 return nullptr;
+
326 }
+
327
+
328 // is the page executable?
+
329 const bool is_any_exec = isExecutable(memPage);
+
330 if (!is_any_exec) {
+
331 // probably not interesting
+
332 return nullptr;
+
333 }
+
334
+
335 if (memPage.mapping_type == MEM_MAPPED && memPage.isRealMapping()) {
+
336 //probably legit
+
337 return nullptr;
+
338 }
+
339
+
340 if (memPage.mapping_type == MEM_IMAGE) {
+
341 memPage.loadModuleName();
+
342 memPage.loadMappedName();
+
343 if (!isScannedAsModule(memPage)) {
+
344 scanImg(memPage);
+
345 }
+
346 const size_t region_size = (memPage.region_end) ? (memPage.region_end - memPage.region_start) : 0;
+
347 if (this->processReport.hasModuleContaining(memPage.region_start, region_size)) {
+
348 // the area was already scanned
+
349 return nullptr;
+
350 }
+
351 }
+
352#ifdef _DEBUG
+
353 std::cout << std::hex << memPage.start_va << ": Scanning executable area" << std::endl;
+
354#endif
+
355 WorkingSetScanReport* my_report = this->scanExecutableArea(memPage);
+
356 if (!my_report) {
+
357 return nullptr;
+
358 }
+
359 my_report->is_executable = true;
+
360 my_report->protection = memPage.protection;
+
361 my_report->mapping_type = memPage.mapping_type;
+
362 my_report->mapped_name = memPage.mapped_name;
+
363 return my_report;
+
364}
artefact_scanner.h
artefacts_util.h
@@ -504,13 +500,13 @@
pesieve::WorkingSetScanReport::custom_matched
std::vector< sig_finder::Match > custom_matched
Definition workingset_scanner.h:111
pesieve::WorkingSetScanReport::generateTags
size_t generateTags(const std::string &reportPath)
Definition workingset_scanner.cpp:45
-
pesieve::WorkingSetScanner::scanExecutableArea
WorkingSetScanReport * scanExecutableArea(MemPageData &memPageData)
Definition workingset_scanner.cpp:202
-
pesieve::WorkingSetScanner::isPotentiallyExecutable
bool isPotentiallyExecutable(MemPageData &memPageData, const t_data_scan_mode &mode)
Definition workingset_scanner.cpp:169
+
pesieve::WorkingSetScanner::scanExecutableArea
WorkingSetScanReport * scanExecutableArea(MemPageData &memPageData)
Definition workingset_scanner.cpp:198
+
pesieve::WorkingSetScanner::isPotentiallyExecutable
bool isPotentiallyExecutable(MemPageData &memPageData, const t_data_scan_mode &mode)
Definition workingset_scanner.cpp:165
pesieve::WorkingSetScanner::checkAreaContent
bool checkAreaContent(IN MemPageData &_memPage, OUT WorkingSetScanReport *my_report)
Definition workingset_scanner.cpp:68
-
pesieve::WorkingSetScanner::isScannedAsModule
bool isScannedAsModule(MemPageData &memPageData)
Definition workingset_scanner.cpp:243
-
pesieve::WorkingSetScanner::scanImg
bool scanImg(MemPageData &memPage)
Definition workingset_scanner.cpp:254
-
pesieve::WorkingSetScanner::isExecutable
bool isExecutable(MemPageData &memPageData)
Definition workingset_scanner.cpp:161
-
pesieve::WorkingSetScanner::scanRemote
virtual WorkingSetScanReport * scanRemote()
Definition workingset_scanner.cpp:307
+
pesieve::WorkingSetScanner::isScannedAsModule
bool isScannedAsModule(MemPageData &memPageData)
Definition workingset_scanner.cpp:239
+
pesieve::WorkingSetScanner::scanImg
bool scanImg(MemPageData &memPage)
Definition workingset_scanner.cpp:250
+
pesieve::WorkingSetScanner::isExecutable
bool isExecutable(MemPageData &memPageData)
Definition workingset_scanner.cpp:157
+
pesieve::WorkingSetScanner::scanRemote
virtual WorkingSetScanReport * scanRemote()
Definition workingset_scanner.cpp:303
pesieve.t_data_scan_mode
Definition pesieve.py:73
pesieve.t_shellc_mode
Definition pesieve.py:27
module_data.h
diff --git a/workingset__scanner_8h_source.html b/workingset__scanner_8h_source.html index 277a5b81b..ec78736f3 100644 --- a/workingset__scanner_8h_source.html +++ b/workingset__scanner_8h_source.html @@ -199,7 +199,7 @@
106 bool is_listed_module;
107 bool has_pe;
108 bool has_shellcode;
-
109 bool has_patterns;
+
109
110 util::ByteBuffer data_cache;
111 std::vector<sig_finder::Match> custom_matched;
112 size_t all_matched_count;
@@ -285,7 +285,6 @@
pesieve::WorkingSetScanReport::fieldsToJSON
virtual const void fieldsToJSON(std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails)
Definition workingset_scanner.h:53
- @@ -294,17 +293,17 @@
pesieve::WorkingSetScanner
A scanner for detection of code implants in the process workingset.
Definition workingset_scanner.h:136
-
pesieve::WorkingSetScanner::scanExecutableArea
WorkingSetScanReport * scanExecutableArea(MemPageData &memPageData)
Definition workingset_scanner.cpp:202
-
pesieve::WorkingSetScanner::isPotentiallyExecutable
bool isPotentiallyExecutable(MemPageData &memPageData, const t_data_scan_mode &mode)
Definition workingset_scanner.cpp:169
+
pesieve::WorkingSetScanner::scanExecutableArea
WorkingSetScanReport * scanExecutableArea(MemPageData &memPageData)
Definition workingset_scanner.cpp:198
+
pesieve::WorkingSetScanner::isPotentiallyExecutable
bool isPotentiallyExecutable(MemPageData &memPageData, const t_data_scan_mode &mode)
Definition workingset_scanner.cpp:165
pesieve::WorkingSetScanner::processReport
ProcessScanReport & processReport
Definition workingset_scanner.h:162
pesieve::WorkingSetScanner::pDetails
const process_details pDetails
Definition workingset_scanner.h:159
pesieve::WorkingSetScanner::checkAreaContent
bool checkAreaContent(IN MemPageData &_memPage, OUT WorkingSetScanReport *my_report)
Definition workingset_scanner.cpp:68
-
pesieve::WorkingSetScanner::isScannedAsModule
bool isScannedAsModule(MemPageData &memPageData)
Definition workingset_scanner.cpp:243
+
pesieve::WorkingSetScanner::isScannedAsModule
bool isScannedAsModule(MemPageData &memPageData)
Definition workingset_scanner.cpp:239
pesieve::WorkingSetScanner::WorkingSetScanner
WorkingSetScanner(HANDLE _procHndl, process_details _proc_details, const util::mem_region_info _mem_region, pesieve::t_params _args, ProcessScanReport &_process_report)
Definition workingset_scanner.h:138
pesieve::WorkingSetScanner::memRegion
const util::mem_region_info memRegion
Definition workingset_scanner.h:160
-
pesieve::WorkingSetScanner::scanImg
bool scanImg(MemPageData &memPage)
Definition workingset_scanner.cpp:254
-
pesieve::WorkingSetScanner::isExecutable
bool isExecutable(MemPageData &memPageData)
Definition workingset_scanner.cpp:161
-
pesieve::WorkingSetScanner::scanRemote
virtual WorkingSetScanReport * scanRemote()
Definition workingset_scanner.cpp:307
+
pesieve::WorkingSetScanner::scanImg
bool scanImg(MemPageData &memPage)
Definition workingset_scanner.cpp:250
+
pesieve::WorkingSetScanner::isExecutable
bool isExecutable(MemPageData &memPageData)
Definition workingset_scanner.cpp:157
+
pesieve::WorkingSetScanner::scanRemote
virtual WorkingSetScanReport * scanRemote()
Definition workingset_scanner.cpp:303
pesieve.t_data_scan_mode
Definition pesieve.py:73
pesieve.t_json_level
Definition pesieve.py:82