diff --git a/classpesieve_1_1_thread_scan_report.html b/classpesieve_1_1_thread_scan_report.html index 1fc49cc5e..a12f5a4ee 100644 --- a/classpesieve_1_1_thread_scan_report.html +++ b/classpesieve_1_1_thread_scan_report.html @@ -369,7 +369,7 @@

-

Definition at line 151 of file thread_scanner.cpp.

+

Definition at line 152 of file thread_scanner.cpp.

@@ -396,7 +396,7 @@

-

Definition at line 135 of file thread_scanner.cpp.

+

Definition at line 136 of file thread_scanner.cpp.

diff --git a/classpesieve_1_1_thread_scanner.html b/classpesieve_1_1_thread_scanner.html index bb07d7027..3774b6daf 100644 --- a/classpesieve_1_1_thread_scanner.html +++ b/classpesieve_1_1_thread_scanner.html @@ -246,7 +246,7 @@

-

Definition at line 212 of file thread_scanner.cpp.

+

Definition at line 222 of file thread_scanner.cpp.

Here is the call graph for this function:
@@ -283,23 +283,32 @@

-

Definition at line 172 of file thread_scanner.cpp.

+

Definition at line 173 of file thread_scanner.cpp.

Here is the call graph for this function:
- + - + - + - - - - - + + + + + + + + + + + + + +
@@ -337,7 +346,7 @@

-

Definition at line 318 of file thread_scanner.cpp.

+

Definition at line 328 of file thread_scanner.cpp.

Here is the call graph for this function:
@@ -384,7 +393,7 @@

-

Definition at line 420 of file thread_scanner.cpp.

+

Definition at line 430 of file thread_scanner.cpp.

Here is the call graph for this function:
@@ -459,7 +468,7 @@

-

Definition at line 268 of file thread_scanner.cpp.

+

Definition at line 278 of file thread_scanner.cpp.

Here is the call graph for this function:
@@ -496,7 +505,7 @@

-

Definition at line 357 of file thread_scanner.cpp.

+

Definition at line 367 of file thread_scanner.cpp.

Here is the call graph for this function:
@@ -533,7 +542,7 @@

-

Definition at line 369 of file thread_scanner.cpp.

+

Definition at line 379 of file thread_scanner.cpp.

Here is the call graph for this function:
@@ -570,7 +579,7 @@

-

Definition at line 399 of file thread_scanner.cpp.

+

Definition at line 409 of file thread_scanner.cpp.

Here is the call graph for this function:
@@ -615,7 +624,7 @@

-

Definition at line 433 of file thread_scanner.cpp.

+

Definition at line 443 of file thread_scanner.cpp.

Here is the call graph for this function:
@@ -657,7 +666,7 @@

pesieve::ProcessFeatureScanner.

-

Definition at line 574 of file thread_scanner.cpp.

+

Definition at line 584 of file thread_scanner.cpp.

Here is the call graph for this function:
@@ -701,7 +710,7 @@

-

Definition at line 482 of file thread_scanner.cpp.

+

Definition at line 492 of file thread_scanner.cpp.

Here is the call graph for this function:
diff --git a/classpesieve_1_1_thread_scanner_aed5b08704f3c1e96e9d8e00b05c7768f_cgraph.map b/classpesieve_1_1_thread_scanner_aed5b08704f3c1e96e9d8e00b05c7768f_cgraph.map index 1718d3f31..a35f7b629 100644 --- a/classpesieve_1_1_thread_scanner_aed5b08704f3c1e96e9d8e00b05c7768f_cgraph.map +++ b/classpesieve_1_1_thread_scanner_aed5b08704f3c1e96e9d8e00b05c7768f_cgraph.map @@ -1,13 +1,22 @@ - + - + - + - - - - - + + + + + + + + + + + + + + diff --git a/classpesieve_1_1_thread_scanner_aed5b08704f3c1e96e9d8e00b05c7768f_cgraph.md5 b/classpesieve_1_1_thread_scanner_aed5b08704f3c1e96e9d8e00b05c7768f_cgraph.md5 index 6bd5c21d4..6330aec02 100644 --- a/classpesieve_1_1_thread_scanner_aed5b08704f3c1e96e9d8e00b05c7768f_cgraph.md5 +++ b/classpesieve_1_1_thread_scanner_aed5b08704f3c1e96e9d8e00b05c7768f_cgraph.md5 @@ -1 +1 @@ -590e0861206b354614b32277dad01ac6 \ No newline at end of file +e9a506702970c7abcee018a41b985fb0 \ No newline at end of file diff --git a/classpesieve_1_1_thread_scanner_aed5b08704f3c1e96e9d8e00b05c7768f_cgraph.png b/classpesieve_1_1_thread_scanner_aed5b08704f3c1e96e9d8e00b05c7768f_cgraph.png index 9cb277a45..1642159a0 100644 Binary files a/classpesieve_1_1_thread_scanner_aed5b08704f3c1e96e9d8e00b05c7768f_cgraph.png and b/classpesieve_1_1_thread_scanner_aed5b08704f3c1e96e9d8e00b05c7768f_cgraph.png differ diff --git a/doxygen_crawl.html b/doxygen_crawl.html index 6931db666..b30fd55ba 100644 --- a/doxygen_crawl.html +++ b/doxygen_crawl.html @@ -2049,6 +2049,7 @@ + @@ -2421,6 +2422,7 @@ + diff --git a/mempage__data_8cpp_source.html b/mempage__data_8cpp_source.html index b694457d1..cb24e69c9 100644 --- a/mempage__data_8cpp_source.html +++ b/mempage__data_8cpp_source.html @@ -259,8 +259,8 @@
pesieve::RemoteModuleData::getMappedName
static std::string getMappedName(HANDLE _processHandle, LPVOID _modBaseAddr)
Definition module_data.cpp:269
mempage_data.h
module_data.h
-
pesieve::util::wow64_disable_fs_redirection
BOOL wow64_disable_fs_redirection(OUT PVOID *OldValue)
Definition process_util.cpp:91
-
pesieve::util::wow64_revert_fs_redirection
BOOL wow64_revert_fs_redirection(IN PVOID OldValue)
Definition process_util.cpp:108
+
pesieve::util::wow64_disable_fs_redirection
BOOL wow64_disable_fs_redirection(OUT PVOID *OldValue)
Definition process_util.cpp:104
+
pesieve::util::wow64_revert_fs_redirection
BOOL wow64_revert_fs_redirection(IN PVOID OldValue)
Definition process_util.cpp:121
process_util.h

diff --git a/module__data_8cpp_source.html b/module__data_8cpp_source.html index a3998844e..2cc076589 100644 --- a/module__data_8cpp_source.html +++ b/module__data_8cpp_source.html @@ -613,7 +613,7 @@
module_data.h
pesieve::util::to_lowercase
std::string to_lowercase(std::string)
Definition strings_util.cpp:6
-
pesieve::util::wow64_disable_fs_redirection
BOOL wow64_disable_fs_redirection(OUT PVOID *OldValue)
Definition process_util.cpp:91
+
pesieve::util::wow64_disable_fs_redirection
BOOL wow64_disable_fs_redirection(OUT PVOID *OldValue)
Definition process_util.cpp:104
pesieve::util::is_process_wow64
BOOL is_process_wow64(IN HANDLE processHandle, OUT BOOL *isProcWow64)
Definition process_util.cpp:27
pesieve::util::expand_path
std::string expand_path(std::string path)
Definition path_converter.cpp:252
pesieve::util::is_readable
bool is_readable(DWORD mapping_type, DWORD protection)
Definition artefacts_util.cpp:118
@@ -623,7 +623,7 @@
pesieve::util::is_executable
bool is_executable(DWORD mapping_type, DWORD protection)
Definition artefacts_util.cpp:109
pesieve::util::DWORD
DWORD(__stdcall *_PssCaptureSnapshot)(HANDLE ProcessHandle
pesieve::util::convert_to_wow64_path
bool convert_to_wow64_path(char *szModName)
Definition path_converter.cpp:195
-
pesieve::util::wow64_revert_fs_redirection
BOOL wow64_revert_fs_redirection(IN PVOID OldValue)
Definition process_util.cpp:108
+
pesieve::util::wow64_revert_fs_redirection
BOOL wow64_revert_fs_redirection(IN PVOID OldValue)
Definition process_util.cpp:121
pesieve.MAX_PATH
int MAX_PATH
Definition pesieve.py:10
path_converter.h
process_util.h
diff --git a/namespacemembers_func.html b/namespacemembers_func.html index fd1212fe5..16fd5b19e 100644 --- a/namespacemembers_func.html +++ b/namespacemembers_func.html @@ -196,6 +196,7 @@

- i -

+

+ +

◆ is_current_wow64()

+ +
+
+ + + + + + + +
bool pesieve::util::is_current_wow64 ()
+
+ +

Definition at line 73 of file process_util.cpp.

+
+Here is the call graph for this function:
+
+
+ + + + + + + + + + +
+
@@ -3221,7 +3257,7 @@

-

Definition at line 91 of file process_util.cpp.

+

Definition at line 104 of file process_util.cpp.

Here is the call graph for this function:
@@ -3256,7 +3292,7 @@

-

Definition at line 73 of file process_util.cpp.

+

Definition at line 86 of file process_util.cpp.

Here is the call graph for this function:
@@ -3287,7 +3323,7 @@

-

Definition at line 108 of file process_util.cpp.

+

Definition at line 121 of file process_util.cpp.

Here is the call graph for this function:
diff --git a/namespacepesieve_1_1util_a8d7eb7eb1b3e3c05251341d0c14d82be_cgraph.map b/namespacepesieve_1_1util_a8d7eb7eb1b3e3c05251341d0c14d82be_cgraph.map new file mode 100644 index 000000000..461439442 --- /dev/null +++ b/namespacepesieve_1_1util_a8d7eb7eb1b3e3c05251341d0c14d82be_cgraph.map @@ -0,0 +1,10 @@ + + + + + + + + + + diff --git a/namespacepesieve_1_1util_a8d7eb7eb1b3e3c05251341d0c14d82be_cgraph.md5 b/namespacepesieve_1_1util_a8d7eb7eb1b3e3c05251341d0c14d82be_cgraph.md5 new file mode 100644 index 000000000..23c2326e0 --- /dev/null +++ b/namespacepesieve_1_1util_a8d7eb7eb1b3e3c05251341d0c14d82be_cgraph.md5 @@ -0,0 +1 @@ +a82b0e077cb25e664beeb02283508e7d \ No newline at end of file diff --git a/namespacepesieve_1_1util_a8d7eb7eb1b3e3c05251341d0c14d82be_cgraph.png b/namespacepesieve_1_1util_a8d7eb7eb1b3e3c05251341d0c14d82be_cgraph.png new file mode 100644 index 000000000..b7297d80a Binary files /dev/null and b/namespacepesieve_1_1util_a8d7eb7eb1b3e3c05251341d0c14d82be_cgraph.png differ diff --git a/process__util_8cpp_source.html b/process__util_8cpp_source.html index b266cdb5e..717037702 100644 --- a/process__util_8cpp_source.html +++ b/process__util_8cpp_source.html @@ -172,72 +172,88 @@
72
-
73BOOL pesieve::util::wow64_get_thread_context(IN HANDLE hThread, IN OUT PWOW64_CONTEXT lpContext)
+
73bool pesieve::util::is_current_wow64()
74{
75#ifdef _WIN64
-
76 if (!g_Wow64GetThreadContext) {
-
77 HMODULE kernelLib = get_kernel32_hndl();
-
78 if (!kernelLib) return FALSE;
-
79
-
80 FARPROC procPtr = GetProcAddress(get_kernel32_hndl(), "Wow64GetThreadContext");
-
81 if (!procPtr) return FALSE;
-
82
-
83 g_Wow64GetThreadContext = (BOOL(WINAPI*)(IN HANDLE, IN OUT PWOW64_CONTEXT))procPtr;
-
84 }
-
85 return g_Wow64GetThreadContext(hThread, lpContext);
-
86#else
-
87 return FALSE;
-
88#endif
-
89}
+
76 return false;
+
77#else
+
78 BOOL isWow64 = FALSE;
+
79 if (is_process_wow64(GetCurrentProcess(), &isWow64)) {
+
80 return false;
+
81 }
+
82 return (bool)isWow64;
+
83#endif
+
84}
-
90
-
-
91BOOL pesieve::util::wow64_disable_fs_redirection(OUT PVOID* OldValue)
-
92{
-
93 if (!g_Wow64DisableWow64FsRedirection) {
-
94 HMODULE kernelLib = get_kernel32_hndl();
-
95 if (!kernelLib) return FALSE;
-
96
-
97 FARPROC procPtr = GetProcAddress(kernelLib, "Wow64DisableWow64FsRedirection");
-
98 if (!procPtr) return FALSE;
-
99
-
100 g_Wow64DisableWow64FsRedirection = (BOOL(WINAPI *) (OUT PVOID*))procPtr;
-
101 }
-
102 if (!g_Wow64DisableWow64FsRedirection) {
-
103 return FALSE;
-
104 }
-
105 return g_Wow64DisableWow64FsRedirection(OldValue);
-
106}
+
85
+
+
86BOOL pesieve::util::wow64_get_thread_context(IN HANDLE hThread, IN OUT PWOW64_CONTEXT lpContext)
+
87{
+
88#ifdef _WIN64
+
89 if (!g_Wow64GetThreadContext) {
+
90 HMODULE kernelLib = get_kernel32_hndl();
+
91 if (!kernelLib) return FALSE;
+
92
+
93 FARPROC procPtr = GetProcAddress(get_kernel32_hndl(), "Wow64GetThreadContext");
+
94 if (!procPtr) return FALSE;
+
95
+
96 g_Wow64GetThreadContext = (BOOL(WINAPI*)(IN HANDLE, IN OUT PWOW64_CONTEXT))procPtr;
+
97 }
+
98 return g_Wow64GetThreadContext(hThread, lpContext);
+
99#else
+
100 return FALSE;
+
101#endif
+
102}
-
107
-
-
108BOOL pesieve::util::wow64_revert_fs_redirection(IN PVOID OldValue)
-
109{
-
110 if (!g_Wow64RevertWow64FsRedirection) {
-
111 HMODULE kernelLib = get_kernel32_hndl();
-
112 if (!kernelLib) return FALSE;
-
113
-
114 FARPROC procPtr = GetProcAddress(kernelLib, "Wow64RevertWow64FsRedirection");
-
115 if (!procPtr) return FALSE;
-
116
-
117 g_Wow64RevertWow64FsRedirection = (BOOL(WINAPI *) (IN PVOID))procPtr;
-
118 }
-
119 if (!g_Wow64RevertWow64FsRedirection) {
-
120 return FALSE;
-
121 }
-
122 return g_Wow64RevertWow64FsRedirection(OldValue);
-
123}
+
103
+
+
104BOOL pesieve::util::wow64_disable_fs_redirection(OUT PVOID* OldValue)
+
105{
+
106 if (!g_Wow64DisableWow64FsRedirection) {
+
107 HMODULE kernelLib = get_kernel32_hndl();
+
108 if (!kernelLib) return FALSE;
+
109
+
110 FARPROC procPtr = GetProcAddress(kernelLib, "Wow64DisableWow64FsRedirection");
+
111 if (!procPtr) return FALSE;
+
112
+
113 g_Wow64DisableWow64FsRedirection = (BOOL(WINAPI *) (OUT PVOID*))procPtr;
+
114 }
+
115 if (!g_Wow64DisableWow64FsRedirection) {
+
116 return FALSE;
+
117 }
+
118 return g_Wow64DisableWow64FsRedirection(OldValue);
+
119}
+
+
120
+
+
121BOOL pesieve::util::wow64_revert_fs_redirection(IN PVOID OldValue)
+
122{
+
123 if (!g_Wow64RevertWow64FsRedirection) {
+
124 HMODULE kernelLib = get_kernel32_hndl();
+
125 if (!kernelLib) return FALSE;
+
126
+
127 FARPROC procPtr = GetProcAddress(kernelLib, "Wow64RevertWow64FsRedirection");
+
128 if (!procPtr) return FALSE;
+
129
+
130 g_Wow64RevertWow64FsRedirection = (BOOL(WINAPI *) (IN PVOID))procPtr;
+
131 }
+
132 if (!g_Wow64RevertWow64FsRedirection) {
+
133 return FALSE;
+
134 }
+
135 return g_Wow64RevertWow64FsRedirection(OldValue);
+
136}
pesieve::util::is_process_64bit
bool is_process_64bit(IN HANDLE process)
Definition process_util.cpp:47
-
pesieve::util::wow64_disable_fs_redirection
BOOL wow64_disable_fs_redirection(OUT PVOID *OldValue)
Definition process_util.cpp:91
+
pesieve::util::wow64_disable_fs_redirection
BOOL wow64_disable_fs_redirection(OUT PVOID *OldValue)
Definition process_util.cpp:104
pesieve::util::is_process_wow64
BOOL is_process_wow64(IN HANDLE processHandle, OUT BOOL *isProcWow64)
Definition process_util.cpp:27
pesieve::util::lpContext
IN OUT PWOW64_CONTEXT lpContext
Definition process_util.cpp:11
pesieve::util::get_kernel32_hndl
HMODULE get_kernel32_hndl()
Definition process_util.cpp:13
+
pesieve::util::is_current_wow64
bool is_current_wow64()
Definition process_util.cpp:73
pesieve::util::BOOL
BOOL(CALLBACK *_MiniDumpWriteDump)(HANDLE hProcess
pesieve::util::g_kernel32Hndl
HMODULE g_kernel32Hndl
Definition process_util.cpp:6
-
pesieve::util::wow64_get_thread_context
BOOL wow64_get_thread_context(IN HANDLE hThread, IN OUT PWOW64_CONTEXT lpContext)
Definition process_util.cpp:73
-
pesieve::util::wow64_revert_fs_redirection
BOOL wow64_revert_fs_redirection(IN PVOID OldValue)
Definition process_util.cpp:108
+
pesieve::util::wow64_get_thread_context
BOOL wow64_get_thread_context(IN HANDLE hThread, IN OUT PWOW64_CONTEXT lpContext)
Definition process_util.cpp:86
+
pesieve::util::wow64_revert_fs_redirection
BOOL wow64_revert_fs_redirection(IN PVOID OldValue)
Definition process_util.cpp:121
process_util.h
diff --git a/process__util_8h.html b/process__util_8h.html index 0523f15ae..c0a52ff0a 100644 --- a/process__util_8h.html +++ b/process__util_8h.html @@ -113,6 +113,8 @@   bool pesieve::util::is_process_64bit (IN HANDLE process)   +bool pesieve::util::is_current_wow64 () +  BOOL pesieve::util::wow64_disable_fs_redirection (OUT PVOID *OldValue)   BOOL pesieve::util::wow64_revert_fs_redirection (IN PVOID OldValue) diff --git a/process__util_8h_source.html b/process__util_8h_source.html index dc237d468..b79606292 100644 --- a/process__util_8h_source.html +++ b/process__util_8h_source.html @@ -103,19 +103,22 @@
8 BOOL is_process_wow64(IN HANDLE processHandle, OUT BOOL* isProcWow64);
9 bool is_process_64bit(IN HANDLE process);
10
-
11 BOOL wow64_disable_fs_redirection(OUT PVOID* OldValue);
-
12 BOOL wow64_revert_fs_redirection(IN PVOID OldValue);
-
13
-
14 BOOL wow64_get_thread_context(IN HANDLE hThread, IN OUT PWOW64_CONTEXT lpContext);
-
15 };
-
16};
+
11 bool is_current_wow64();
+
12
+
13 BOOL wow64_disable_fs_redirection(OUT PVOID* OldValue);
+
14 BOOL wow64_revert_fs_redirection(IN PVOID OldValue);
+
15
+
16 BOOL wow64_get_thread_context(IN HANDLE hThread, IN OUT PWOW64_CONTEXT lpContext);
+
17 };
+
18};
pesieve::util::is_process_64bit
bool is_process_64bit(IN HANDLE process)
Definition process_util.cpp:47
-
pesieve::util::wow64_disable_fs_redirection
BOOL wow64_disable_fs_redirection(OUT PVOID *OldValue)
Definition process_util.cpp:91
+
pesieve::util::wow64_disable_fs_redirection
BOOL wow64_disable_fs_redirection(OUT PVOID *OldValue)
Definition process_util.cpp:104
pesieve::util::is_process_wow64
BOOL is_process_wow64(IN HANDLE processHandle, OUT BOOL *isProcWow64)
Definition process_util.cpp:27
pesieve::util::lpContext
IN OUT PWOW64_CONTEXT lpContext
Definition process_util.cpp:11
+
pesieve::util::is_current_wow64
bool is_current_wow64()
Definition process_util.cpp:73
pesieve::util::BOOL
BOOL(CALLBACK *_MiniDumpWriteDump)(HANDLE hProcess
-
pesieve::util::wow64_get_thread_context
BOOL wow64_get_thread_context(IN HANDLE hThread, IN OUT PWOW64_CONTEXT lpContext)
Definition process_util.cpp:73
-
pesieve::util::wow64_revert_fs_redirection
BOOL wow64_revert_fs_redirection(IN PVOID OldValue)
Definition process_util.cpp:108
+
pesieve::util::wow64_get_thread_context
BOOL wow64_get_thread_context(IN HANDLE hThread, IN OUT PWOW64_CONTEXT lpContext)
Definition process_util.cpp:86
+
pesieve::util::wow64_revert_fs_redirection
BOOL wow64_revert_fs_redirection(IN PVOID OldValue)
Definition process_util.cpp:121

diff --git a/scanner_8cpp_source.html b/scanner_8cpp_source.html index 1e219e412..1acd53f0d 100644 --- a/scanner_8cpp_source.html +++ b/scanner_8cpp_source.html @@ -733,7 +733,7 @@
pesieve::ThreadScanReport
A report from the thread scan, generated by ThreadScanner.
Definition thread_scanner.h:16
-
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:574
+
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:584
pesieve::WorkingSetScanReport
A report from the working set scan, generated by WorkingSetScanner.
Definition workingset_scanner.h:29
diff --git a/search/all_9.js b/search/all_9.js index 1b1349f52..b1beadf99 100644 --- a/search/all_9.js +++ b/search/all_9.js @@ -81,92 +81,93 @@ var searchData= ['is_5fcode_78',['is_code',['../namespacepesieve_1_1util.html#aad87136e3b6e94f105074093a97970c5',1,'pesieve::util']]], ['is_5fcorrupt_5fpe_79',['is_corrupt_pe',['../classpesieve_1_1_module_dump_report.html#aadf8118269fad055196034c7daeca382',1,'pesieve::ModuleDumpReport']]], ['is_5fcstr_5fequal_80',['is_cstr_equal',['../namespacepesieve_1_1util.html#a6211673ea221530eb4472658fdab12a6',1,'pesieve::util']]], - ['is_5fdec_81',['is_dec',['../namespacepesieve_1_1util.html#ae57bc6f959f2d79411087e1b8d3600f7',1,'pesieve::util']]], - ['is_5fdep_5fenabled_82',['is_DEP_enabled',['../namespacepesieve_1_1util.html#a4e03a2c1c527e0f0b4063f8ac12ff22d',1,'pesieve::util']]], - ['is_5fdevice_5fpath_83',['is_device_path',['../path__converter_8cpp.html#aa38e814828efe4c9d588eb4529ed5b1c',1,'path_converter.cpp']]], - ['is_5fdisk_5frelative_84',['is_disk_relative',['../namespacepesieve_1_1util.html#aa402c13598449f9a1f47efb72df8f62f',1,'pesieve::util']]], - ['is_5fdot_5fnet_85',['is_dot_net',['../classpesieve_1_1_module_data.html#a7f242e23b293e9741c8b4821a5df9dc4',1,'pesieve::ModuleData']]], - ['is_5fendline_86',['IS_ENDLINE',['../strings__util_8h.html#a08090b46d9133e90e2a8f0d326895b09',1,'strings_util.h']]], - ['is_5fexecutable_87',['is_executable',['../classpesieve_1_1_working_set_scan_report.html#aa036516e8290539cbb74245285805754',1,'pesieve::WorkingSetScanReport::is_executable'],['../namespacepesieve_1_1util.html#ab5a500e51ff539294a3c71f6b95aa65b',1,'pesieve::util::is_executable()']]], - ['is_5fextended_88',['is_extended',['../structpesieve_1_1util_1_1__thread__info.html#a8ec77c6fa5aa1dc71802d52afdc37386',1,'pesieve::util::_thread_info']]], - ['is_5fhex_89',['is_hex',['../namespacepesieve_1_1util.html#a23447c87ce0d32d372ca0c4e3bc6e39b',1,'pesieve::util']]], - ['is_5fin_5flist_90',['is_in_list',['../namespacepesieve_1_1util.html#a980992e8baccca3371865922e85925be',1,'pesieve::util']]], - ['is_5finfo_5ffilled_91',['is_info_filled',['../classpesieve_1_1_mem_page_data.html#aad1e7a796768c408b43162a2ec230904',1,'pesieve::MemPageData']]], - ['is_5flisted_5fmodule_92',['is_listed_module',['../classpesieve_1_1_mem_page_data.html#adc986006810f6248a2d7e6e568ada735',1,'pesieve::MemPageData::is_listed_module'],['../classpesieve_1_1_working_set_scan_report.html#a9167635c76bcba07d274133c8af95f17',1,'pesieve::WorkingSetScanReport::is_listed_module']]], - ['is_5fmanaged_93',['is_managed',['../structreport.html#ac67fcb03e111ef23c331793ba07902f5',1,'report::is_managed'],['../structpesieve_1_1__ctx__details.html#a8add5038bb0b71c10646482ba2bbcaaa',1,'pesieve::_ctx_details::is_managed']]], - ['is_5fmodule_5fnamed_94',['is_module_named',['../classpesieve_1_1_module_data.html#abe700fd542ce7c24cfe82028e1c49961',1,'pesieve::ModuleData']]], - ['is_5fnormal_5finaccessible_95',['is_normal_inaccessible',['../namespacepesieve_1_1util.html#a9bc0e707ae1cceda1678bc269f2870ea',1,'pesieve::util']]], - ['is_5fnumber_96',['is_number',['../namespacepesieve_1_1util.html#a282125458b003e9ab800b24552bd7242',1,'pesieve::util']]], - ['is_5fok_97',['is_ok',['../struct__t__stack__enum__params.html#a61d74c02774139f2cccf850af389735c',1,'_t_stack_enum_params::is_ok'],['../structpesieve_1_1util_1_1t__refl__args.html#a5bfa172f10a03190cb3dadf2e6ff623e',1,'pesieve::util::t_refl_args::is_ok']]], - ['is_5fprintable_98',['IS_PRINTABLE',['../strings__util_8h.html#a1a739e1f368dc1b3b122572eec3d12ab',1,'strings_util.h']]], - ['is_5fprivate_99',['is_private',['../classpesieve_1_1_mem_page_data.html#acccbcee56b0c039264705e102bce814d',1,'pesieve::MemPageData']]], - ['is_5fprocess_5f64bit_100',['is_process_64bit',['../namespacepesieve_1_1util.html#a015be6a0937814caf43586043817d922',1,'pesieve::util']]], - ['is_5fprocess_5frefl_101',['is_process_refl',['../classpesieve_1_1_mem_page_data.html#a4baeb4ff99b47933d66f057745b43541',1,'pesieve::MemPageData']]], - ['is_5fprocess_5fwow64_102',['is_process_wow64',['../namespacepesieve_1_1util.html#a43b6faf00b6a97279f2d67f4a3fd2513',1,'pesieve::util']]], - ['is_5freadable_103',['is_readable',['../namespacepesieve_1_1util.html#a57e9c1266c247784669f5ea0191e086d',1,'pesieve::util']]], - ['is_5freflection_104',['is_reflection',['../structreport.html#a31eeb7f48250fc3d175bcf9684634fb8',1,'report']]], - ['is_5frelative_105',['is_relative',['../namespacepesieve_1_1util.html#a970337282940a37076a16db56183c03d',1,'pesieve::util']]], - ['is_5fret_5fas_5fsyscall_106',['is_ret_as_syscall',['../structpesieve_1_1__ctx__details.html#af71831469a0fe507c8b6e2256dae681e',1,'pesieve::_ctx_details']]], - ['is_5fret_5fin_5fframe_107',['is_ret_in_frame',['../structpesieve_1_1__ctx__details.html#a236ccadbe7548913e6186651b56f1636',1,'pesieve::_ctx_details']]], - ['is_5frunning_108',['is_running',['../namespacepesieve.html#a5de73d5ffa8f7073fdf5fd6b7c6deea5',1,'pesieve']]], - ['is_5fscanner_5fcompatible_109',['is_scanner_compatible',['../namespacepesieve.html#ab939d4edad1446e418ec8fb4d33cb137',1,'pesieve']]], - ['is_5fshellcode_110',['is_shellcode',['../classpesieve_1_1_module_dump_report.html#a9cdd70712964e083c4c0f6257336d48d',1,'pesieve::ModuleDumpReport']]], - ['is_5fshown_5ftype_111',['is_shown_type',['../namespacepesieve.html#acbbeace832fb77bc16027b0371cf55d9',1,'pesieve']]], - ['is_5fthread_5frunning_112',['is_thread_running',['../namespacepesieve.html#a7c9c19e3f0ce1362c7e404893a1163f6',1,'pesieve']]], - ['is_5fvalid_5ffile_5fhdr_113',['is_valid_file_hdr',['../namespacepesieve.html#a18e59ce96d19eab91937d55a85d40d3a',1,'pesieve']]], - ['is_5fvalid_5fimport_5fdescriptor_114',['is_valid_import_descriptor',['../namespacepesieve.html#af856350491a23b4fba1aabf0ffb5ecdb',1,'pesieve']]], - ['is_5fvalid_5fsection_115',['is_valid_section',['../namespacepesieve.html#ab6eb75407c454f07ae7910a1d8b7c826',1,'pesieve']]], - ['isaddrinshellcode_116',['isAddrInShellcode',['../classpesieve_1_1_thread_scanner.html#a912120f6549a8b27c3e8166ccd2511cf',1,'pesieve::ThreadScanner']]], - ['isallprintable_117',['isAllPrintable',['../namespacepesieve_1_1stats.html#a1f38f630a729f596b4cd2b3eebd36fa2',1,'pesieve::stats']]], - ['iscacheavailable_118',['isCacheAvailable',['../classpesieve_1_1_modules_cache.html#a7fcdbf7fd47572a9d02c430bbf55697d',1,'pesieve::ModulesCache']]], - ['iscode_119',['isCode',['../classpesieve_1_1_pe_buffer.html#a39400f75a56c653e647fd7cb19724d27',1,'pesieve::PeBuffer']]], - ['iscontained_120',['isContained',['../classpesieve_1_1_pe_section.html#a98091942ed90ff8157039ff1008cbc25',1,'pesieve::PeSection']]], - ['iscoveragecomplete_121',['isCoverageComplete',['../classpesieve_1_1_i_a_t_block.html#a03ce76940ff373f9ed1a5bb56dee7d7a',1,'pesieve::IATBlock']]], - ['iscovered_122',['isCovered',['../classpesieve_1_1_i_a_t_thunks_series.html#afa77af01bd49d5428a03227b1d2a2283',1,'pesieve::IATThunksSeries::isCovered()'],['../classpesieve_1_1_i_a_t_block.html#a55cba9be25b9ad8c2b15073b5fb3eb17',1,'pesieve::IATBlock::isCovered()']]], - ['isdatacontained_123',['isDataContained',['../structpesieve_1_1util_1_1_byte_buffer.html#ad5659eccb45c518338f2b682b347041b',1,'pesieve::util::ByteBuffer']]], - ['isdep_124',['isDEP',['../structpesieve_1_1__process__details.html#a36de3778d1d58ed0112e70c830e98462',1,'pesieve::_process_details::isDEP'],['../classpesieve_1_1_process_scanner.html#a4420dc261297d3b67b487b5f2439a852',1,'pesieve::ProcessScanner::isDEP']]], - ['isdirect_125',['isDirect',['../classpesieve_1_1_patch_list_1_1_patch.html#a917c77f6c3480b170239dd0f060d80f4',1,'pesieve::PatchList::Patch']]], - ['isdll_126',['isDll',['../classpesieve_1_1_pe_artefacts.html#a11d5032dc934f3415900f90a46db5cbe',1,'pesieve::PeArtefacts']]], - ['isdotnet_127',['isDotNet',['../classpesieve_1_1_module_data.html#a669207603953e5ce9ca208a9b4b3636b',1,'pesieve::ModuleData']]], - ['isdotnetmanagedcode_128',['isDotNetManagedCode',['../classpesieve_1_1_module_data.html#afd198d7810e60af9584f4fc2fd90e9fa',1,'pesieve::ModuleData']]], - ['isdotnetmodule_129',['isDotNetModule',['../classpesieve_1_1_module_scan_report.html#a81a4088afbf84bfa89dd60969527ebca',1,'pesieve::ModuleScanReport']]], - ['isdumped_130',['isDumped',['../classpesieve_1_1_module_dump_report.html#a111e084a95143aeeeb7bdfae1408eb75',1,'pesieve::ModuleDumpReport']]], - ['isexecutable_131',['isExecutable',['../classpesieve_1_1_working_set_scanner.html#ac66d70d22a149e709998b4cf68b40ad1',1,'pesieve::WorkingSetScanner']]], - ['isfilled_132',['isFilled',['../classpesieve_1_1_process_dump_report.html#ab5df52d208711d1ae9c2084d459c9211',1,'pesieve::ProcessDumpReport::isFilled()'],['../classpesieve_1_1_pe_buffer.html#a2d59396064feb956755694ddb6b4df07',1,'pesieve::PeBuffer::isFilled()'],['../structpesieve_1_1_multi_stats_settings.html#aa6d2351e57b5cdb71e63e9985a83fb13',1,'pesieve::MultiStatsSettings::isFilled()'],['../classpesieve_1_1_area_multi_stats.html#a211c3964f9d24a9d31673e2581e4b632',1,'pesieve::AreaMultiStats::isFilled()'],['../structpesieve_1_1_stats_settings.html#a4754111ab8c574eaf58d73fe0b2e7422',1,'pesieve::StatsSettings::isFilled()'],['../classpesieve_1_1_area_stats.html#a3005dfc8cd36c15290a724a29ee09a63',1,'pesieve::AreaStats::isFilled()'],['../structpesieve_1_1util_1_1_basic_buffer.html#a62c880c7daca719d983e9fc638518fca',1,'pesieve::util::BasicBuffer::isFilled()']]], - ['isfullimageloaded_133',['isFullImageLoaded',['../classpesieve_1_1_remote_module_data.html#a1bbfb7e3bcb6136909a1cf812da2a955',1,'pesieve::RemoteModuleData']]], - ['ishdrreplaced_134',['isHdrReplaced',['../classpesieve_1_1_headers_scan_report.html#af04c1c2f3d532acf4bd980f23422f134',1,'pesieve::HeadersScanReport']]], - ['isinfofilled_135',['isInfoFilled',['../classpesieve_1_1_mem_page_data.html#a92b303ba4c9abaffa472a57bb943bec9',1,'pesieve::MemPageData']]], - ['isinit_136',['isInit',['../class_process_symbols_manager.html#a4c2130eb0673ab159d260c63d56aee23',1,'ProcessSymbolsManager']]], - ['isinitialized_137',['IsInitialized',['../class_process_symbols_manager.html#ad6b1d880d0b5ae9618c8ac5452823704',1,'ProcessSymbolsManager']]], - ['isinitialized_138',['isInitialized',['../classpesieve_1_1_module_data.html#aa3717faf0b70606705752321f8efe254',1,'pesieve::ModuleData::isInitialized()'],['../classpesieve_1_1_remote_module_data.html#a10f74dddd152a0895545bd68268da7ff',1,'pesieve::RemoteModuleData::isInitialized()'],['../classpesieve_1_1_pe_section.html#a6ab5831f0e1542427793f151f2746f78',1,'pesieve::PeSection::isInitialized()']]], - ['isinmain_139',['isInMain',['../classpesieve_1_1_i_a_t_block.html#a090236dac85527e386c7a8d509a07116',1,'pesieve::IATBlock']]], - ['isinpeb_140',['isInPEB',['../classpesieve_1_1_headers_scan_report.html#aebdeeae678d69ca403aa6b16e4d08ec0',1,'pesieve::HeadersScanReport']]], - ['islongmodifier_141',['isLongModifier',['../classpesieve_1_1_patch_analyzer.html#ab001e027c9dba6e06ff4c6b06996455e',1,'pesieve::PatchAnalyzer']]], - ['ismanaged_142',['isManaged',['../classpesieve_1_1_process_scan_report.html#a69437e618cbea7083a39c78f6391ef24',1,'pesieve::ProcessScanReport']]], - ['ismanagedprocess_143',['isManagedProcess',['../classpesieve_1_1_process_scan_report.html#a20f7307ba415bb75748eff0d9d60930f',1,'pesieve::ProcessScanReport']]], - ['ismatched_144',['isMatched',['../classpesieve_1_1_rule_matcher.html#ae15f8e5d971163e6156b858f50ff0b4d',1,'pesieve::RuleMatcher']]], - ['ismatching_145',['isMatching',['../classpesieve_1_1_rule_matcher.html#a14f2cd3fb316465b0f5f9d770312aaeb',1,'pesieve::RuleMatcher']]], - ['ismodule64bit_146',['isModule64bit',['../classpesieve_1_1_patch_analyzer.html#a7e6ec6e872a4854c22134fa65c39d136',1,'pesieve::PatchAnalyzer']]], - ['ismoduleinpeblist_147',['isModuleInPEBList',['../classpesieve_1_1_module_data.html#a16a3fa21a9c517e2d69b080fb9544773',1,'pesieve::ModuleData']]], - ['ismodulereplaced_148',['isModuleReplaced',['../classpesieve_1_1_process_scan_report.html#a3c12c6b6913421538450af514b67a641',1,'pesieve::ProcessScanReport']]], - ['ismzpefound_149',['isMzPeFound',['../classpesieve_1_1_pe_artefacts.html#a96aa7a9827fffeaad69a5c7bb7334534',1,'pesieve::PeArtefacts::isMzPeFound'],['../classpesieve_1_1_artefact_scanner_1_1_artefacts_mapping.html#a66e0b7bd90ffce6274c4c278816d0750',1,'pesieve::ArtefactScanner::ArtefactsMapping::isMzPeFound']]], - ['ispebconnected_150',['isPEBConnected',['../classpesieve_1_1_module_data.html#a4c6bdfac3eeef79c206e3f959ea0519b',1,'pesieve::ModuleData']]], - ['ispotentiallyexecutable_151',['isPotentiallyExecutable',['../classpesieve_1_1_working_set_scanner.html#a1ceb025397c65bc550c7fbad5b74ac38',1,'pesieve::WorkingSetScanner']]], - ['isprocess64bit_152',['isProcess64bit',['../classpesieve_1_1_artefact_scanner.html#a39a2da104ed77f5bb62f30521ef41f92',1,'pesieve::ArtefactScanner']]], - ['isready_153',['isReady',['../classpesieve_1_1_pattern_matcher.html#afa900e521f8021190efd3cd7840c051f',1,'pesieve::PatternMatcher::isReady()'],['../structpesieve_1_1_syscall_table.html#a88e2aaa8bdf47d29d611c198a49bcf97',1,'pesieve::SyscallTable::isReady()']]], - ['isrealmapping_154',['isRealMapping',['../classpesieve_1_1_mem_page_data.html#ab431925c7d4bd5c61c377a4995f8169a',1,'pesieve::MemPageData']]], - ['isrefl_155',['isRefl',['../classpesieve_1_1_pe_buffer.html#aa0c0b360dfa543106539d573e3abd86d',1,'pesieve::PeBuffer::isRefl'],['../classpesieve_1_1_mem_page_data.html#a97f1d9da9fd37db4b847aa89e7170901',1,'pesieve::MemPageData::isRefl()']]], - ['isreflection_156',['isReflection',['../classpesieve_1_1_remote_module_data.html#ae569cea9480c24784e2831e16a18dc87',1,'pesieve::RemoteModuleData::isReflection'],['../structpesieve_1_1__process__details.html#a6198a4f50d86dcc0b2a1b2242205cf72',1,'pesieve::_process_details::isReflection'],['../classpesieve_1_1_process_scan_report.html#a13cb114f188c2d84d9d1682a302539e1',1,'pesieve::ProcessScanReport::isReflection'],['../classpesieve_1_1_process_scanner.html#a2b64b6548b346669f8de4907dca24041',1,'pesieve::ProcessScanner::isReflection'],['../classpesieve_1_1_thread_scanner.html#a121637d2eb96737a16a8bd43d5017d2a',1,'pesieve::ThreadScanner::isReflection']]], - ['isreportdumped_157',['isReportDumped',['../classpesieve_1_1_module_dump_report.html#ac28ccaf7ec4d2d63019c04fda207a99c',1,'pesieve::ModuleDumpReport']]], - ['issamesyscallfunc_158',['isSameSyscallFunc',['../structpesieve_1_1_syscall_table.html#a14a36e5a99adfc3322ab8f2b96d1faf2',1,'pesieve::SyscallTable']]], - ['isscannedasmodule_159',['isScannedAsModule',['../classpesieve_1_1_working_set_scanner.html#a98fe3023305ff14521c6d7098873fce4',1,'pesieve::WorkingSetScanner']]], - ['issectionentry_160',['isSectionEntry',['../classpesieve_1_1_remote_module_data.html#ad9f27c0872806491dbcb729d27e04bce',1,'pesieve::RemoteModuleData']]], - ['issectionexecutable_161',['isSectionExecutable',['../classpesieve_1_1_remote_module_data.html#a98f87651ef4162967b54bb662bd8e0b7',1,'pesieve::RemoteModuleData']]], - ['issuspicious_162',['isSuspicious',['../classpesieve_1_1_scanned_module.html#a107e7818470321b79edd89bae3940a93',1,'pesieve::ScannedModule']]], - ['issyscallfunc_163',['isSyscallFunc',['../namespacepesieve_1_1util.html#a1f7e69ed521ed2a4d2c4887a4c4a7323',1,'pesieve::util']]], - ['istargetsuspicious_164',['isTargetSuspicious',['../classpesieve_1_1_patch_list_1_1_patch.html#ac6ce416e0c43e1d33fcab1dfe51e2aae',1,'pesieve::PatchList::Patch']]], - ['isterminated_165',['isTerminated',['../classpesieve_1_1_i_a_t_block.html#af4886702574e1d355616fe4b62ef45b6',1,'pesieve::IATBlock']]], - ['isvalid_166',['isValid',['../classpesieve_1_1_i_a_t_block.html#a51f4f94343508d1acc169ef1b1fcb617',1,'pesieve::IATBlock']]], - ['isvalidpe_167',['isValidPe',['../classpesieve_1_1_pe_buffer.html#a314ac1c88e3eb95becd89ae75c92b67f',1,'pesieve::PeBuffer']]], - ['isvalidptr_168',['isValidPtr',['../structpesieve_1_1util_1_1_byte_buffer.html#a7a2f937740d14222bbaf70bb28865fe9',1,'pesieve::util::ByteBuffer']]] + ['is_5fcurrent_5fwow64_81',['is_current_wow64',['../namespacepesieve_1_1util.html#a8d7eb7eb1b3e3c05251341d0c14d82be',1,'pesieve::util']]], + ['is_5fdec_82',['is_dec',['../namespacepesieve_1_1util.html#ae57bc6f959f2d79411087e1b8d3600f7',1,'pesieve::util']]], + ['is_5fdep_5fenabled_83',['is_DEP_enabled',['../namespacepesieve_1_1util.html#a4e03a2c1c527e0f0b4063f8ac12ff22d',1,'pesieve::util']]], + ['is_5fdevice_5fpath_84',['is_device_path',['../path__converter_8cpp.html#aa38e814828efe4c9d588eb4529ed5b1c',1,'path_converter.cpp']]], + ['is_5fdisk_5frelative_85',['is_disk_relative',['../namespacepesieve_1_1util.html#aa402c13598449f9a1f47efb72df8f62f',1,'pesieve::util']]], + ['is_5fdot_5fnet_86',['is_dot_net',['../classpesieve_1_1_module_data.html#a7f242e23b293e9741c8b4821a5df9dc4',1,'pesieve::ModuleData']]], + ['is_5fendline_87',['IS_ENDLINE',['../strings__util_8h.html#a08090b46d9133e90e2a8f0d326895b09',1,'strings_util.h']]], + ['is_5fexecutable_88',['is_executable',['../classpesieve_1_1_working_set_scan_report.html#aa036516e8290539cbb74245285805754',1,'pesieve::WorkingSetScanReport::is_executable'],['../namespacepesieve_1_1util.html#ab5a500e51ff539294a3c71f6b95aa65b',1,'pesieve::util::is_executable()']]], + ['is_5fextended_89',['is_extended',['../structpesieve_1_1util_1_1__thread__info.html#a8ec77c6fa5aa1dc71802d52afdc37386',1,'pesieve::util::_thread_info']]], + ['is_5fhex_90',['is_hex',['../namespacepesieve_1_1util.html#a23447c87ce0d32d372ca0c4e3bc6e39b',1,'pesieve::util']]], + ['is_5fin_5flist_91',['is_in_list',['../namespacepesieve_1_1util.html#a980992e8baccca3371865922e85925be',1,'pesieve::util']]], + ['is_5finfo_5ffilled_92',['is_info_filled',['../classpesieve_1_1_mem_page_data.html#aad1e7a796768c408b43162a2ec230904',1,'pesieve::MemPageData']]], + ['is_5flisted_5fmodule_93',['is_listed_module',['../classpesieve_1_1_mem_page_data.html#adc986006810f6248a2d7e6e568ada735',1,'pesieve::MemPageData::is_listed_module'],['../classpesieve_1_1_working_set_scan_report.html#a9167635c76bcba07d274133c8af95f17',1,'pesieve::WorkingSetScanReport::is_listed_module']]], + ['is_5fmanaged_94',['is_managed',['../structreport.html#ac67fcb03e111ef23c331793ba07902f5',1,'report::is_managed'],['../structpesieve_1_1__ctx__details.html#a8add5038bb0b71c10646482ba2bbcaaa',1,'pesieve::_ctx_details::is_managed']]], + ['is_5fmodule_5fnamed_95',['is_module_named',['../classpesieve_1_1_module_data.html#abe700fd542ce7c24cfe82028e1c49961',1,'pesieve::ModuleData']]], + ['is_5fnormal_5finaccessible_96',['is_normal_inaccessible',['../namespacepesieve_1_1util.html#a9bc0e707ae1cceda1678bc269f2870ea',1,'pesieve::util']]], + ['is_5fnumber_97',['is_number',['../namespacepesieve_1_1util.html#a282125458b003e9ab800b24552bd7242',1,'pesieve::util']]], + ['is_5fok_98',['is_ok',['../struct__t__stack__enum__params.html#a61d74c02774139f2cccf850af389735c',1,'_t_stack_enum_params::is_ok'],['../structpesieve_1_1util_1_1t__refl__args.html#a5bfa172f10a03190cb3dadf2e6ff623e',1,'pesieve::util::t_refl_args::is_ok']]], + ['is_5fprintable_99',['IS_PRINTABLE',['../strings__util_8h.html#a1a739e1f368dc1b3b122572eec3d12ab',1,'strings_util.h']]], + ['is_5fprivate_100',['is_private',['../classpesieve_1_1_mem_page_data.html#acccbcee56b0c039264705e102bce814d',1,'pesieve::MemPageData']]], + ['is_5fprocess_5f64bit_101',['is_process_64bit',['../namespacepesieve_1_1util.html#a015be6a0937814caf43586043817d922',1,'pesieve::util']]], + ['is_5fprocess_5frefl_102',['is_process_refl',['../classpesieve_1_1_mem_page_data.html#a4baeb4ff99b47933d66f057745b43541',1,'pesieve::MemPageData']]], + ['is_5fprocess_5fwow64_103',['is_process_wow64',['../namespacepesieve_1_1util.html#a43b6faf00b6a97279f2d67f4a3fd2513',1,'pesieve::util']]], + ['is_5freadable_104',['is_readable',['../namespacepesieve_1_1util.html#a57e9c1266c247784669f5ea0191e086d',1,'pesieve::util']]], + ['is_5freflection_105',['is_reflection',['../structreport.html#a31eeb7f48250fc3d175bcf9684634fb8',1,'report']]], + ['is_5frelative_106',['is_relative',['../namespacepesieve_1_1util.html#a970337282940a37076a16db56183c03d',1,'pesieve::util']]], + ['is_5fret_5fas_5fsyscall_107',['is_ret_as_syscall',['../structpesieve_1_1__ctx__details.html#af71831469a0fe507c8b6e2256dae681e',1,'pesieve::_ctx_details']]], + ['is_5fret_5fin_5fframe_108',['is_ret_in_frame',['../structpesieve_1_1__ctx__details.html#a236ccadbe7548913e6186651b56f1636',1,'pesieve::_ctx_details']]], + ['is_5frunning_109',['is_running',['../namespacepesieve.html#a5de73d5ffa8f7073fdf5fd6b7c6deea5',1,'pesieve']]], + ['is_5fscanner_5fcompatible_110',['is_scanner_compatible',['../namespacepesieve.html#ab939d4edad1446e418ec8fb4d33cb137',1,'pesieve']]], + ['is_5fshellcode_111',['is_shellcode',['../classpesieve_1_1_module_dump_report.html#a9cdd70712964e083c4c0f6257336d48d',1,'pesieve::ModuleDumpReport']]], + ['is_5fshown_5ftype_112',['is_shown_type',['../namespacepesieve.html#acbbeace832fb77bc16027b0371cf55d9',1,'pesieve']]], + ['is_5fthread_5frunning_113',['is_thread_running',['../namespacepesieve.html#a7c9c19e3f0ce1362c7e404893a1163f6',1,'pesieve']]], + ['is_5fvalid_5ffile_5fhdr_114',['is_valid_file_hdr',['../namespacepesieve.html#a18e59ce96d19eab91937d55a85d40d3a',1,'pesieve']]], + ['is_5fvalid_5fimport_5fdescriptor_115',['is_valid_import_descriptor',['../namespacepesieve.html#af856350491a23b4fba1aabf0ffb5ecdb',1,'pesieve']]], + ['is_5fvalid_5fsection_116',['is_valid_section',['../namespacepesieve.html#ab6eb75407c454f07ae7910a1d8b7c826',1,'pesieve']]], + ['isaddrinshellcode_117',['isAddrInShellcode',['../classpesieve_1_1_thread_scanner.html#a912120f6549a8b27c3e8166ccd2511cf',1,'pesieve::ThreadScanner']]], + ['isallprintable_118',['isAllPrintable',['../namespacepesieve_1_1stats.html#a1f38f630a729f596b4cd2b3eebd36fa2',1,'pesieve::stats']]], + ['iscacheavailable_119',['isCacheAvailable',['../classpesieve_1_1_modules_cache.html#a7fcdbf7fd47572a9d02c430bbf55697d',1,'pesieve::ModulesCache']]], + ['iscode_120',['isCode',['../classpesieve_1_1_pe_buffer.html#a39400f75a56c653e647fd7cb19724d27',1,'pesieve::PeBuffer']]], + ['iscontained_121',['isContained',['../classpesieve_1_1_pe_section.html#a98091942ed90ff8157039ff1008cbc25',1,'pesieve::PeSection']]], + ['iscoveragecomplete_122',['isCoverageComplete',['../classpesieve_1_1_i_a_t_block.html#a03ce76940ff373f9ed1a5bb56dee7d7a',1,'pesieve::IATBlock']]], + ['iscovered_123',['isCovered',['../classpesieve_1_1_i_a_t_thunks_series.html#afa77af01bd49d5428a03227b1d2a2283',1,'pesieve::IATThunksSeries::isCovered()'],['../classpesieve_1_1_i_a_t_block.html#a55cba9be25b9ad8c2b15073b5fb3eb17',1,'pesieve::IATBlock::isCovered()']]], + ['isdatacontained_124',['isDataContained',['../structpesieve_1_1util_1_1_byte_buffer.html#ad5659eccb45c518338f2b682b347041b',1,'pesieve::util::ByteBuffer']]], + ['isdep_125',['isDEP',['../structpesieve_1_1__process__details.html#a36de3778d1d58ed0112e70c830e98462',1,'pesieve::_process_details::isDEP'],['../classpesieve_1_1_process_scanner.html#a4420dc261297d3b67b487b5f2439a852',1,'pesieve::ProcessScanner::isDEP']]], + ['isdirect_126',['isDirect',['../classpesieve_1_1_patch_list_1_1_patch.html#a917c77f6c3480b170239dd0f060d80f4',1,'pesieve::PatchList::Patch']]], + ['isdll_127',['isDll',['../classpesieve_1_1_pe_artefacts.html#a11d5032dc934f3415900f90a46db5cbe',1,'pesieve::PeArtefacts']]], + ['isdotnet_128',['isDotNet',['../classpesieve_1_1_module_data.html#a669207603953e5ce9ca208a9b4b3636b',1,'pesieve::ModuleData']]], + ['isdotnetmanagedcode_129',['isDotNetManagedCode',['../classpesieve_1_1_module_data.html#afd198d7810e60af9584f4fc2fd90e9fa',1,'pesieve::ModuleData']]], + ['isdotnetmodule_130',['isDotNetModule',['../classpesieve_1_1_module_scan_report.html#a81a4088afbf84bfa89dd60969527ebca',1,'pesieve::ModuleScanReport']]], + ['isdumped_131',['isDumped',['../classpesieve_1_1_module_dump_report.html#a111e084a95143aeeeb7bdfae1408eb75',1,'pesieve::ModuleDumpReport']]], + ['isexecutable_132',['isExecutable',['../classpesieve_1_1_working_set_scanner.html#ac66d70d22a149e709998b4cf68b40ad1',1,'pesieve::WorkingSetScanner']]], + ['isfilled_133',['isFilled',['../classpesieve_1_1_process_dump_report.html#ab5df52d208711d1ae9c2084d459c9211',1,'pesieve::ProcessDumpReport::isFilled()'],['../classpesieve_1_1_pe_buffer.html#a2d59396064feb956755694ddb6b4df07',1,'pesieve::PeBuffer::isFilled()'],['../structpesieve_1_1_multi_stats_settings.html#aa6d2351e57b5cdb71e63e9985a83fb13',1,'pesieve::MultiStatsSettings::isFilled()'],['../classpesieve_1_1_area_multi_stats.html#a211c3964f9d24a9d31673e2581e4b632',1,'pesieve::AreaMultiStats::isFilled()'],['../structpesieve_1_1_stats_settings.html#a4754111ab8c574eaf58d73fe0b2e7422',1,'pesieve::StatsSettings::isFilled()'],['../classpesieve_1_1_area_stats.html#a3005dfc8cd36c15290a724a29ee09a63',1,'pesieve::AreaStats::isFilled()'],['../structpesieve_1_1util_1_1_basic_buffer.html#a62c880c7daca719d983e9fc638518fca',1,'pesieve::util::BasicBuffer::isFilled()']]], + ['isfullimageloaded_134',['isFullImageLoaded',['../classpesieve_1_1_remote_module_data.html#a1bbfb7e3bcb6136909a1cf812da2a955',1,'pesieve::RemoteModuleData']]], + ['ishdrreplaced_135',['isHdrReplaced',['../classpesieve_1_1_headers_scan_report.html#af04c1c2f3d532acf4bd980f23422f134',1,'pesieve::HeadersScanReport']]], + ['isinfofilled_136',['isInfoFilled',['../classpesieve_1_1_mem_page_data.html#a92b303ba4c9abaffa472a57bb943bec9',1,'pesieve::MemPageData']]], + ['isinit_137',['isInit',['../class_process_symbols_manager.html#a4c2130eb0673ab159d260c63d56aee23',1,'ProcessSymbolsManager']]], + ['isinitialized_138',['IsInitialized',['../class_process_symbols_manager.html#ad6b1d880d0b5ae9618c8ac5452823704',1,'ProcessSymbolsManager']]], + ['isinitialized_139',['isInitialized',['../classpesieve_1_1_module_data.html#aa3717faf0b70606705752321f8efe254',1,'pesieve::ModuleData::isInitialized()'],['../classpesieve_1_1_remote_module_data.html#a10f74dddd152a0895545bd68268da7ff',1,'pesieve::RemoteModuleData::isInitialized()'],['../classpesieve_1_1_pe_section.html#a6ab5831f0e1542427793f151f2746f78',1,'pesieve::PeSection::isInitialized()']]], + ['isinmain_140',['isInMain',['../classpesieve_1_1_i_a_t_block.html#a090236dac85527e386c7a8d509a07116',1,'pesieve::IATBlock']]], + ['isinpeb_141',['isInPEB',['../classpesieve_1_1_headers_scan_report.html#aebdeeae678d69ca403aa6b16e4d08ec0',1,'pesieve::HeadersScanReport']]], + ['islongmodifier_142',['isLongModifier',['../classpesieve_1_1_patch_analyzer.html#ab001e027c9dba6e06ff4c6b06996455e',1,'pesieve::PatchAnalyzer']]], + ['ismanaged_143',['isManaged',['../classpesieve_1_1_process_scan_report.html#a69437e618cbea7083a39c78f6391ef24',1,'pesieve::ProcessScanReport']]], + ['ismanagedprocess_144',['isManagedProcess',['../classpesieve_1_1_process_scan_report.html#a20f7307ba415bb75748eff0d9d60930f',1,'pesieve::ProcessScanReport']]], + ['ismatched_145',['isMatched',['../classpesieve_1_1_rule_matcher.html#ae15f8e5d971163e6156b858f50ff0b4d',1,'pesieve::RuleMatcher']]], + ['ismatching_146',['isMatching',['../classpesieve_1_1_rule_matcher.html#a14f2cd3fb316465b0f5f9d770312aaeb',1,'pesieve::RuleMatcher']]], + ['ismodule64bit_147',['isModule64bit',['../classpesieve_1_1_patch_analyzer.html#a7e6ec6e872a4854c22134fa65c39d136',1,'pesieve::PatchAnalyzer']]], + ['ismoduleinpeblist_148',['isModuleInPEBList',['../classpesieve_1_1_module_data.html#a16a3fa21a9c517e2d69b080fb9544773',1,'pesieve::ModuleData']]], + ['ismodulereplaced_149',['isModuleReplaced',['../classpesieve_1_1_process_scan_report.html#a3c12c6b6913421538450af514b67a641',1,'pesieve::ProcessScanReport']]], + ['ismzpefound_150',['isMzPeFound',['../classpesieve_1_1_pe_artefacts.html#a96aa7a9827fffeaad69a5c7bb7334534',1,'pesieve::PeArtefacts::isMzPeFound'],['../classpesieve_1_1_artefact_scanner_1_1_artefacts_mapping.html#a66e0b7bd90ffce6274c4c278816d0750',1,'pesieve::ArtefactScanner::ArtefactsMapping::isMzPeFound']]], + ['ispebconnected_151',['isPEBConnected',['../classpesieve_1_1_module_data.html#a4c6bdfac3eeef79c206e3f959ea0519b',1,'pesieve::ModuleData']]], + ['ispotentiallyexecutable_152',['isPotentiallyExecutable',['../classpesieve_1_1_working_set_scanner.html#a1ceb025397c65bc550c7fbad5b74ac38',1,'pesieve::WorkingSetScanner']]], + ['isprocess64bit_153',['isProcess64bit',['../classpesieve_1_1_artefact_scanner.html#a39a2da104ed77f5bb62f30521ef41f92',1,'pesieve::ArtefactScanner']]], + ['isready_154',['isReady',['../classpesieve_1_1_pattern_matcher.html#afa900e521f8021190efd3cd7840c051f',1,'pesieve::PatternMatcher::isReady()'],['../structpesieve_1_1_syscall_table.html#a88e2aaa8bdf47d29d611c198a49bcf97',1,'pesieve::SyscallTable::isReady()']]], + ['isrealmapping_155',['isRealMapping',['../classpesieve_1_1_mem_page_data.html#ab431925c7d4bd5c61c377a4995f8169a',1,'pesieve::MemPageData']]], + ['isrefl_156',['isRefl',['../classpesieve_1_1_pe_buffer.html#aa0c0b360dfa543106539d573e3abd86d',1,'pesieve::PeBuffer::isRefl'],['../classpesieve_1_1_mem_page_data.html#a97f1d9da9fd37db4b847aa89e7170901',1,'pesieve::MemPageData::isRefl()']]], + ['isreflection_157',['isReflection',['../classpesieve_1_1_remote_module_data.html#ae569cea9480c24784e2831e16a18dc87',1,'pesieve::RemoteModuleData::isReflection'],['../structpesieve_1_1__process__details.html#a6198a4f50d86dcc0b2a1b2242205cf72',1,'pesieve::_process_details::isReflection'],['../classpesieve_1_1_process_scan_report.html#a13cb114f188c2d84d9d1682a302539e1',1,'pesieve::ProcessScanReport::isReflection'],['../classpesieve_1_1_process_scanner.html#a2b64b6548b346669f8de4907dca24041',1,'pesieve::ProcessScanner::isReflection'],['../classpesieve_1_1_thread_scanner.html#a121637d2eb96737a16a8bd43d5017d2a',1,'pesieve::ThreadScanner::isReflection']]], + ['isreportdumped_158',['isReportDumped',['../classpesieve_1_1_module_dump_report.html#ac28ccaf7ec4d2d63019c04fda207a99c',1,'pesieve::ModuleDumpReport']]], + ['issamesyscallfunc_159',['isSameSyscallFunc',['../structpesieve_1_1_syscall_table.html#a14a36e5a99adfc3322ab8f2b96d1faf2',1,'pesieve::SyscallTable']]], + ['isscannedasmodule_160',['isScannedAsModule',['../classpesieve_1_1_working_set_scanner.html#a98fe3023305ff14521c6d7098873fce4',1,'pesieve::WorkingSetScanner']]], + ['issectionentry_161',['isSectionEntry',['../classpesieve_1_1_remote_module_data.html#ad9f27c0872806491dbcb729d27e04bce',1,'pesieve::RemoteModuleData']]], + ['issectionexecutable_162',['isSectionExecutable',['../classpesieve_1_1_remote_module_data.html#a98f87651ef4162967b54bb662bd8e0b7',1,'pesieve::RemoteModuleData']]], + ['issuspicious_163',['isSuspicious',['../classpesieve_1_1_scanned_module.html#a107e7818470321b79edd89bae3940a93',1,'pesieve::ScannedModule']]], + ['issyscallfunc_164',['isSyscallFunc',['../namespacepesieve_1_1util.html#a1f7e69ed521ed2a4d2c4887a4c4a7323',1,'pesieve::util']]], + ['istargetsuspicious_165',['isTargetSuspicious',['../classpesieve_1_1_patch_list_1_1_patch.html#ac6ce416e0c43e1d33fcab1dfe51e2aae',1,'pesieve::PatchList::Patch']]], + ['isterminated_166',['isTerminated',['../classpesieve_1_1_i_a_t_block.html#af4886702574e1d355616fe4b62ef45b6',1,'pesieve::IATBlock']]], + ['isvalid_167',['isValid',['../classpesieve_1_1_i_a_t_block.html#a51f4f94343508d1acc169ef1b1fcb617',1,'pesieve::IATBlock']]], + ['isvalidpe_168',['isValidPe',['../classpesieve_1_1_pe_buffer.html#a314ac1c88e3eb95becd89ae75c92b67f',1,'pesieve::PeBuffer']]], + ['isvalidptr_169',['isValidPtr',['../structpesieve_1_1util_1_1_byte_buffer.html#a7a2f937740d14222bbaf70bb28865fe9',1,'pesieve::util::ByteBuffer']]] ]; diff --git a/search/functions_9.js b/search/functions_9.js index 7323d9f83..9727362d3 100644 --- a/search/functions_9.js +++ b/search/functions_9.js @@ -24,59 +24,60 @@ var searchData= ['is_5fby_5fstats_21',['is_by_stats',['../namespacepesieve.html#aee245dc4878b8329cc82d3e93ce843e1',1,'pesieve']]], ['is_5fcode_22',['is_code',['../namespacepesieve_1_1util.html#aad87136e3b6e94f105074093a97970c5',1,'pesieve::util']]], ['is_5fcstr_5fequal_23',['is_cstr_equal',['../namespacepesieve_1_1util.html#a6211673ea221530eb4472658fdab12a6',1,'pesieve::util']]], - ['is_5fdec_24',['is_dec',['../namespacepesieve_1_1util.html#ae57bc6f959f2d79411087e1b8d3600f7',1,'pesieve::util']]], - ['is_5fdep_5fenabled_25',['is_DEP_enabled',['../namespacepesieve_1_1util.html#a4e03a2c1c527e0f0b4063f8ac12ff22d',1,'pesieve::util']]], - ['is_5fdevice_5fpath_26',['is_device_path',['../path__converter_8cpp.html#aa38e814828efe4c9d588eb4529ed5b1c',1,'path_converter.cpp']]], - ['is_5fdisk_5frelative_27',['is_disk_relative',['../namespacepesieve_1_1util.html#aa402c13598449f9a1f47efb72df8f62f',1,'pesieve::util']]], - ['is_5fexecutable_28',['is_executable',['../namespacepesieve_1_1util.html#ab5a500e51ff539294a3c71f6b95aa65b',1,'pesieve::util']]], - ['is_5fhex_29',['is_hex',['../namespacepesieve_1_1util.html#a23447c87ce0d32d372ca0c4e3bc6e39b',1,'pesieve::util']]], - ['is_5fin_5flist_30',['is_in_list',['../namespacepesieve_1_1util.html#a980992e8baccca3371865922e85925be',1,'pesieve::util']]], - ['is_5fnormal_5finaccessible_31',['is_normal_inaccessible',['../namespacepesieve_1_1util.html#a9bc0e707ae1cceda1678bc269f2870ea',1,'pesieve::util']]], - ['is_5fnumber_32',['is_number',['../namespacepesieve_1_1util.html#a282125458b003e9ab800b24552bd7242',1,'pesieve::util']]], - ['is_5fprocess_5f64bit_33',['is_process_64bit',['../namespacepesieve_1_1util.html#a015be6a0937814caf43586043817d922',1,'pesieve::util']]], - ['is_5fprocess_5fwow64_34',['is_process_wow64',['../namespacepesieve_1_1util.html#a43b6faf00b6a97279f2d67f4a3fd2513',1,'pesieve::util']]], - ['is_5freadable_35',['is_readable',['../namespacepesieve_1_1util.html#a57e9c1266c247784669f5ea0191e086d',1,'pesieve::util']]], - ['is_5frelative_36',['is_relative',['../namespacepesieve_1_1util.html#a970337282940a37076a16db56183c03d',1,'pesieve::util']]], - ['is_5frunning_37',['is_running',['../namespacepesieve.html#a5de73d5ffa8f7073fdf5fd6b7c6deea5',1,'pesieve']]], - ['is_5fscanner_5fcompatible_38',['is_scanner_compatible',['../namespacepesieve.html#ab939d4edad1446e418ec8fb4d33cb137',1,'pesieve']]], - ['is_5fshown_5ftype_39',['is_shown_type',['../namespacepesieve.html#acbbeace832fb77bc16027b0371cf55d9',1,'pesieve']]], - ['is_5fthread_5frunning_40',['is_thread_running',['../namespacepesieve.html#a7c9c19e3f0ce1362c7e404893a1163f6',1,'pesieve']]], - ['is_5fvalid_5ffile_5fhdr_41',['is_valid_file_hdr',['../namespacepesieve.html#a18e59ce96d19eab91937d55a85d40d3a',1,'pesieve']]], - ['is_5fvalid_5fimport_5fdescriptor_42',['is_valid_import_descriptor',['../namespacepesieve.html#af856350491a23b4fba1aabf0ffb5ecdb',1,'pesieve']]], - ['is_5fvalid_5fsection_43',['is_valid_section',['../namespacepesieve.html#ab6eb75407c454f07ae7910a1d8b7c826',1,'pesieve']]], - ['isaddrinshellcode_44',['isAddrInShellcode',['../classpesieve_1_1_thread_scanner.html#a912120f6549a8b27c3e8166ccd2511cf',1,'pesieve::ThreadScanner']]], - ['isallprintable_45',['isAllPrintable',['../namespacepesieve_1_1stats.html#a1f38f630a729f596b4cd2b3eebd36fa2',1,'pesieve::stats']]], - ['iscacheavailable_46',['isCacheAvailable',['../classpesieve_1_1_modules_cache.html#a7fcdbf7fd47572a9d02c430bbf55697d',1,'pesieve::ModulesCache']]], - ['iscode_47',['isCode',['../classpesieve_1_1_pe_buffer.html#a39400f75a56c653e647fd7cb19724d27',1,'pesieve::PeBuffer']]], - ['iscontained_48',['isContained',['../classpesieve_1_1_pe_section.html#a98091942ed90ff8157039ff1008cbc25',1,'pesieve::PeSection']]], - ['iscovered_49',['isCovered',['../classpesieve_1_1_i_a_t_thunks_series.html#afa77af01bd49d5428a03227b1d2a2283',1,'pesieve::IATThunksSeries::isCovered()'],['../classpesieve_1_1_i_a_t_block.html#a55cba9be25b9ad8c2b15073b5fb3eb17',1,'pesieve::IATBlock::isCovered()']]], - ['isdatacontained_50',['isDataContained',['../structpesieve_1_1util_1_1_byte_buffer.html#ad5659eccb45c518338f2b682b347041b',1,'pesieve::util::ByteBuffer']]], - ['isdotnet_51',['isDotNet',['../classpesieve_1_1_module_data.html#a669207603953e5ce9ca208a9b4b3636b',1,'pesieve::ModuleData']]], - ['isdotnetmanagedcode_52',['isDotNetManagedCode',['../classpesieve_1_1_module_data.html#afd198d7810e60af9584f4fc2fd90e9fa',1,'pesieve::ModuleData']]], - ['isexecutable_53',['isExecutable',['../classpesieve_1_1_working_set_scanner.html#ac66d70d22a149e709998b4cf68b40ad1',1,'pesieve::WorkingSetScanner']]], - ['isfilled_54',['isFilled',['../classpesieve_1_1_process_dump_report.html#ab5df52d208711d1ae9c2084d459c9211',1,'pesieve::ProcessDumpReport::isFilled()'],['../classpesieve_1_1_pe_buffer.html#a2d59396064feb956755694ddb6b4df07',1,'pesieve::PeBuffer::isFilled()'],['../structpesieve_1_1_multi_stats_settings.html#aa6d2351e57b5cdb71e63e9985a83fb13',1,'pesieve::MultiStatsSettings::isFilled()'],['../classpesieve_1_1_area_multi_stats.html#a211c3964f9d24a9d31673e2581e4b632',1,'pesieve::AreaMultiStats::isFilled()'],['../structpesieve_1_1_stats_settings.html#a4754111ab8c574eaf58d73fe0b2e7422',1,'pesieve::StatsSettings::isFilled()'],['../classpesieve_1_1_area_stats.html#a3005dfc8cd36c15290a724a29ee09a63',1,'pesieve::AreaStats::isFilled()'],['../structpesieve_1_1util_1_1_basic_buffer.html#a62c880c7daca719d983e9fc638518fca',1,'pesieve::util::BasicBuffer::isFilled()']]], - ['isfullimageloaded_55',['isFullImageLoaded',['../classpesieve_1_1_remote_module_data.html#a1bbfb7e3bcb6136909a1cf812da2a955',1,'pesieve::RemoteModuleData']]], - ['ishdrreplaced_56',['isHdrReplaced',['../classpesieve_1_1_headers_scan_report.html#af04c1c2f3d532acf4bd980f23422f134',1,'pesieve::HeadersScanReport']]], - ['isinfofilled_57',['isInfoFilled',['../classpesieve_1_1_mem_page_data.html#a92b303ba4c9abaffa472a57bb943bec9',1,'pesieve::MemPageData']]], - ['isinitialized_58',['IsInitialized',['../class_process_symbols_manager.html#ad6b1d880d0b5ae9618c8ac5452823704',1,'ProcessSymbolsManager']]], - ['isinitialized_59',['isInitialized',['../classpesieve_1_1_module_data.html#aa3717faf0b70606705752321f8efe254',1,'pesieve::ModuleData::isInitialized()'],['../classpesieve_1_1_remote_module_data.html#a10f74dddd152a0895545bd68268da7ff',1,'pesieve::RemoteModuleData::isInitialized()'],['../classpesieve_1_1_pe_section.html#a6ab5831f0e1542427793f151f2746f78',1,'pesieve::PeSection::isInitialized()']]], - ['islongmodifier_60',['isLongModifier',['../classpesieve_1_1_patch_analyzer.html#ab001e027c9dba6e06ff4c6b06996455e',1,'pesieve::PatchAnalyzer']]], - ['ismanagedprocess_61',['isManagedProcess',['../classpesieve_1_1_process_scan_report.html#a20f7307ba415bb75748eff0d9d60930f',1,'pesieve::ProcessScanReport']]], - ['ismatched_62',['isMatched',['../classpesieve_1_1_rule_matcher.html#ae15f8e5d971163e6156b858f50ff0b4d',1,'pesieve::RuleMatcher']]], - ['ismatching_63',['isMatching',['../classpesieve_1_1_rule_matcher.html#a14f2cd3fb316465b0f5f9d770312aaeb',1,'pesieve::RuleMatcher']]], - ['ismoduleinpeblist_64',['isModuleInPEBList',['../classpesieve_1_1_module_data.html#a16a3fa21a9c517e2d69b080fb9544773',1,'pesieve::ModuleData']]], - ['ismodulereplaced_65',['isModuleReplaced',['../classpesieve_1_1_process_scan_report.html#a3c12c6b6913421538450af514b67a641',1,'pesieve::ProcessScanReport']]], - ['ispotentiallyexecutable_66',['isPotentiallyExecutable',['../classpesieve_1_1_working_set_scanner.html#a1ceb025397c65bc550c7fbad5b74ac38',1,'pesieve::WorkingSetScanner']]], - ['isready_67',['isReady',['../classpesieve_1_1_pattern_matcher.html#afa900e521f8021190efd3cd7840c051f',1,'pesieve::PatternMatcher::isReady()'],['../structpesieve_1_1_syscall_table.html#a88e2aaa8bdf47d29d611c198a49bcf97',1,'pesieve::SyscallTable::isReady()']]], - ['isrealmapping_68',['isRealMapping',['../classpesieve_1_1_mem_page_data.html#ab431925c7d4bd5c61c377a4995f8169a',1,'pesieve::MemPageData']]], - ['isrefl_69',['isRefl',['../classpesieve_1_1_mem_page_data.html#a97f1d9da9fd37db4b847aa89e7170901',1,'pesieve::MemPageData']]], - ['issamesyscallfunc_70',['isSameSyscallFunc',['../structpesieve_1_1_syscall_table.html#a14a36e5a99adfc3322ab8f2b96d1faf2',1,'pesieve::SyscallTable']]], - ['isscannedasmodule_71',['isScannedAsModule',['../classpesieve_1_1_working_set_scanner.html#a98fe3023305ff14521c6d7098873fce4',1,'pesieve::WorkingSetScanner']]], - ['issectionentry_72',['isSectionEntry',['../classpesieve_1_1_remote_module_data.html#ad9f27c0872806491dbcb729d27e04bce',1,'pesieve::RemoteModuleData']]], - ['issectionexecutable_73',['isSectionExecutable',['../classpesieve_1_1_remote_module_data.html#a98f87651ef4162967b54bb662bd8e0b7',1,'pesieve::RemoteModuleData']]], - ['issuspicious_74',['isSuspicious',['../classpesieve_1_1_scanned_module.html#a107e7818470321b79edd89bae3940a93',1,'pesieve::ScannedModule']]], - ['issyscallfunc_75',['isSyscallFunc',['../namespacepesieve_1_1util.html#a1f7e69ed521ed2a4d2c4887a4c4a7323',1,'pesieve::util']]], - ['isvalid_76',['isValid',['../classpesieve_1_1_i_a_t_block.html#a51f4f94343508d1acc169ef1b1fcb617',1,'pesieve::IATBlock']]], - ['isvalidpe_77',['isValidPe',['../classpesieve_1_1_pe_buffer.html#a314ac1c88e3eb95becd89ae75c92b67f',1,'pesieve::PeBuffer']]], - ['isvalidptr_78',['isValidPtr',['../structpesieve_1_1util_1_1_byte_buffer.html#a7a2f937740d14222bbaf70bb28865fe9',1,'pesieve::util::ByteBuffer']]] + ['is_5fcurrent_5fwow64_24',['is_current_wow64',['../namespacepesieve_1_1util.html#a8d7eb7eb1b3e3c05251341d0c14d82be',1,'pesieve::util']]], + ['is_5fdec_25',['is_dec',['../namespacepesieve_1_1util.html#ae57bc6f959f2d79411087e1b8d3600f7',1,'pesieve::util']]], + ['is_5fdep_5fenabled_26',['is_DEP_enabled',['../namespacepesieve_1_1util.html#a4e03a2c1c527e0f0b4063f8ac12ff22d',1,'pesieve::util']]], + ['is_5fdevice_5fpath_27',['is_device_path',['../path__converter_8cpp.html#aa38e814828efe4c9d588eb4529ed5b1c',1,'path_converter.cpp']]], + ['is_5fdisk_5frelative_28',['is_disk_relative',['../namespacepesieve_1_1util.html#aa402c13598449f9a1f47efb72df8f62f',1,'pesieve::util']]], + ['is_5fexecutable_29',['is_executable',['../namespacepesieve_1_1util.html#ab5a500e51ff539294a3c71f6b95aa65b',1,'pesieve::util']]], + ['is_5fhex_30',['is_hex',['../namespacepesieve_1_1util.html#a23447c87ce0d32d372ca0c4e3bc6e39b',1,'pesieve::util']]], + ['is_5fin_5flist_31',['is_in_list',['../namespacepesieve_1_1util.html#a980992e8baccca3371865922e85925be',1,'pesieve::util']]], + ['is_5fnormal_5finaccessible_32',['is_normal_inaccessible',['../namespacepesieve_1_1util.html#a9bc0e707ae1cceda1678bc269f2870ea',1,'pesieve::util']]], + ['is_5fnumber_33',['is_number',['../namespacepesieve_1_1util.html#a282125458b003e9ab800b24552bd7242',1,'pesieve::util']]], + ['is_5fprocess_5f64bit_34',['is_process_64bit',['../namespacepesieve_1_1util.html#a015be6a0937814caf43586043817d922',1,'pesieve::util']]], + ['is_5fprocess_5fwow64_35',['is_process_wow64',['../namespacepesieve_1_1util.html#a43b6faf00b6a97279f2d67f4a3fd2513',1,'pesieve::util']]], + ['is_5freadable_36',['is_readable',['../namespacepesieve_1_1util.html#a57e9c1266c247784669f5ea0191e086d',1,'pesieve::util']]], + ['is_5frelative_37',['is_relative',['../namespacepesieve_1_1util.html#a970337282940a37076a16db56183c03d',1,'pesieve::util']]], + ['is_5frunning_38',['is_running',['../namespacepesieve.html#a5de73d5ffa8f7073fdf5fd6b7c6deea5',1,'pesieve']]], + ['is_5fscanner_5fcompatible_39',['is_scanner_compatible',['../namespacepesieve.html#ab939d4edad1446e418ec8fb4d33cb137',1,'pesieve']]], + ['is_5fshown_5ftype_40',['is_shown_type',['../namespacepesieve.html#acbbeace832fb77bc16027b0371cf55d9',1,'pesieve']]], + ['is_5fthread_5frunning_41',['is_thread_running',['../namespacepesieve.html#a7c9c19e3f0ce1362c7e404893a1163f6',1,'pesieve']]], + ['is_5fvalid_5ffile_5fhdr_42',['is_valid_file_hdr',['../namespacepesieve.html#a18e59ce96d19eab91937d55a85d40d3a',1,'pesieve']]], + ['is_5fvalid_5fimport_5fdescriptor_43',['is_valid_import_descriptor',['../namespacepesieve.html#af856350491a23b4fba1aabf0ffb5ecdb',1,'pesieve']]], + ['is_5fvalid_5fsection_44',['is_valid_section',['../namespacepesieve.html#ab6eb75407c454f07ae7910a1d8b7c826',1,'pesieve']]], + ['isaddrinshellcode_45',['isAddrInShellcode',['../classpesieve_1_1_thread_scanner.html#a912120f6549a8b27c3e8166ccd2511cf',1,'pesieve::ThreadScanner']]], + ['isallprintable_46',['isAllPrintable',['../namespacepesieve_1_1stats.html#a1f38f630a729f596b4cd2b3eebd36fa2',1,'pesieve::stats']]], + ['iscacheavailable_47',['isCacheAvailable',['../classpesieve_1_1_modules_cache.html#a7fcdbf7fd47572a9d02c430bbf55697d',1,'pesieve::ModulesCache']]], + ['iscode_48',['isCode',['../classpesieve_1_1_pe_buffer.html#a39400f75a56c653e647fd7cb19724d27',1,'pesieve::PeBuffer']]], + ['iscontained_49',['isContained',['../classpesieve_1_1_pe_section.html#a98091942ed90ff8157039ff1008cbc25',1,'pesieve::PeSection']]], + ['iscovered_50',['isCovered',['../classpesieve_1_1_i_a_t_thunks_series.html#afa77af01bd49d5428a03227b1d2a2283',1,'pesieve::IATThunksSeries::isCovered()'],['../classpesieve_1_1_i_a_t_block.html#a55cba9be25b9ad8c2b15073b5fb3eb17',1,'pesieve::IATBlock::isCovered()']]], + ['isdatacontained_51',['isDataContained',['../structpesieve_1_1util_1_1_byte_buffer.html#ad5659eccb45c518338f2b682b347041b',1,'pesieve::util::ByteBuffer']]], + ['isdotnet_52',['isDotNet',['../classpesieve_1_1_module_data.html#a669207603953e5ce9ca208a9b4b3636b',1,'pesieve::ModuleData']]], + ['isdotnetmanagedcode_53',['isDotNetManagedCode',['../classpesieve_1_1_module_data.html#afd198d7810e60af9584f4fc2fd90e9fa',1,'pesieve::ModuleData']]], + ['isexecutable_54',['isExecutable',['../classpesieve_1_1_working_set_scanner.html#ac66d70d22a149e709998b4cf68b40ad1',1,'pesieve::WorkingSetScanner']]], + ['isfilled_55',['isFilled',['../classpesieve_1_1_process_dump_report.html#ab5df52d208711d1ae9c2084d459c9211',1,'pesieve::ProcessDumpReport::isFilled()'],['../classpesieve_1_1_pe_buffer.html#a2d59396064feb956755694ddb6b4df07',1,'pesieve::PeBuffer::isFilled()'],['../structpesieve_1_1_multi_stats_settings.html#aa6d2351e57b5cdb71e63e9985a83fb13',1,'pesieve::MultiStatsSettings::isFilled()'],['../classpesieve_1_1_area_multi_stats.html#a211c3964f9d24a9d31673e2581e4b632',1,'pesieve::AreaMultiStats::isFilled()'],['../structpesieve_1_1_stats_settings.html#a4754111ab8c574eaf58d73fe0b2e7422',1,'pesieve::StatsSettings::isFilled()'],['../classpesieve_1_1_area_stats.html#a3005dfc8cd36c15290a724a29ee09a63',1,'pesieve::AreaStats::isFilled()'],['../structpesieve_1_1util_1_1_basic_buffer.html#a62c880c7daca719d983e9fc638518fca',1,'pesieve::util::BasicBuffer::isFilled()']]], + ['isfullimageloaded_56',['isFullImageLoaded',['../classpesieve_1_1_remote_module_data.html#a1bbfb7e3bcb6136909a1cf812da2a955',1,'pesieve::RemoteModuleData']]], + ['ishdrreplaced_57',['isHdrReplaced',['../classpesieve_1_1_headers_scan_report.html#af04c1c2f3d532acf4bd980f23422f134',1,'pesieve::HeadersScanReport']]], + ['isinfofilled_58',['isInfoFilled',['../classpesieve_1_1_mem_page_data.html#a92b303ba4c9abaffa472a57bb943bec9',1,'pesieve::MemPageData']]], + ['isinitialized_59',['IsInitialized',['../class_process_symbols_manager.html#ad6b1d880d0b5ae9618c8ac5452823704',1,'ProcessSymbolsManager']]], + ['isinitialized_60',['isInitialized',['../classpesieve_1_1_module_data.html#aa3717faf0b70606705752321f8efe254',1,'pesieve::ModuleData::isInitialized()'],['../classpesieve_1_1_remote_module_data.html#a10f74dddd152a0895545bd68268da7ff',1,'pesieve::RemoteModuleData::isInitialized()'],['../classpesieve_1_1_pe_section.html#a6ab5831f0e1542427793f151f2746f78',1,'pesieve::PeSection::isInitialized()']]], + ['islongmodifier_61',['isLongModifier',['../classpesieve_1_1_patch_analyzer.html#ab001e027c9dba6e06ff4c6b06996455e',1,'pesieve::PatchAnalyzer']]], + ['ismanagedprocess_62',['isManagedProcess',['../classpesieve_1_1_process_scan_report.html#a20f7307ba415bb75748eff0d9d60930f',1,'pesieve::ProcessScanReport']]], + ['ismatched_63',['isMatched',['../classpesieve_1_1_rule_matcher.html#ae15f8e5d971163e6156b858f50ff0b4d',1,'pesieve::RuleMatcher']]], + ['ismatching_64',['isMatching',['../classpesieve_1_1_rule_matcher.html#a14f2cd3fb316465b0f5f9d770312aaeb',1,'pesieve::RuleMatcher']]], + ['ismoduleinpeblist_65',['isModuleInPEBList',['../classpesieve_1_1_module_data.html#a16a3fa21a9c517e2d69b080fb9544773',1,'pesieve::ModuleData']]], + ['ismodulereplaced_66',['isModuleReplaced',['../classpesieve_1_1_process_scan_report.html#a3c12c6b6913421538450af514b67a641',1,'pesieve::ProcessScanReport']]], + ['ispotentiallyexecutable_67',['isPotentiallyExecutable',['../classpesieve_1_1_working_set_scanner.html#a1ceb025397c65bc550c7fbad5b74ac38',1,'pesieve::WorkingSetScanner']]], + ['isready_68',['isReady',['../classpesieve_1_1_pattern_matcher.html#afa900e521f8021190efd3cd7840c051f',1,'pesieve::PatternMatcher::isReady()'],['../structpesieve_1_1_syscall_table.html#a88e2aaa8bdf47d29d611c198a49bcf97',1,'pesieve::SyscallTable::isReady()']]], + ['isrealmapping_69',['isRealMapping',['../classpesieve_1_1_mem_page_data.html#ab431925c7d4bd5c61c377a4995f8169a',1,'pesieve::MemPageData']]], + ['isrefl_70',['isRefl',['../classpesieve_1_1_mem_page_data.html#a97f1d9da9fd37db4b847aa89e7170901',1,'pesieve::MemPageData']]], + ['issamesyscallfunc_71',['isSameSyscallFunc',['../structpesieve_1_1_syscall_table.html#a14a36e5a99adfc3322ab8f2b96d1faf2',1,'pesieve::SyscallTable']]], + ['isscannedasmodule_72',['isScannedAsModule',['../classpesieve_1_1_working_set_scanner.html#a98fe3023305ff14521c6d7098873fce4',1,'pesieve::WorkingSetScanner']]], + ['issectionentry_73',['isSectionEntry',['../classpesieve_1_1_remote_module_data.html#ad9f27c0872806491dbcb729d27e04bce',1,'pesieve::RemoteModuleData']]], + ['issectionexecutable_74',['isSectionExecutable',['../classpesieve_1_1_remote_module_data.html#a98f87651ef4162967b54bb662bd8e0b7',1,'pesieve::RemoteModuleData']]], + ['issuspicious_75',['isSuspicious',['../classpesieve_1_1_scanned_module.html#a107e7818470321b79edd89bae3940a93',1,'pesieve::ScannedModule']]], + ['issyscallfunc_76',['isSyscallFunc',['../namespacepesieve_1_1util.html#a1f7e69ed521ed2a4d2c4887a4c4a7323',1,'pesieve::util']]], + ['isvalid_77',['isValid',['../classpesieve_1_1_i_a_t_block.html#a51f4f94343508d1acc169ef1b1fcb617',1,'pesieve::IATBlock']]], + ['isvalidpe_78',['isValidPe',['../classpesieve_1_1_pe_buffer.html#a314ac1c88e3eb95becd89ae75c92b67f',1,'pesieve::PeBuffer']]], + ['isvalidptr_79',['isValidPtr',['../structpesieve_1_1util_1_1_byte_buffer.html#a7a2f937740d14222bbaf70bb28865fe9',1,'pesieve::util::ByteBuffer']]] ]; diff --git a/syscall__extractor_8cpp_source.html b/syscall__extractor_8cpp_source.html index c53817008..12ea18b68 100644 --- a/syscall__extractor_8cpp_source.html +++ b/syscall__extractor_8cpp_source.html @@ -209,12 +209,12 @@
107}

pesieve::util::isSyscallFunc
bool isSyscallFunc(const std::string &funcName)
Definition syscall_extractor.cpp:11
-
pesieve::util::wow64_disable_fs_redirection
BOOL wow64_disable_fs_redirection(OUT PVOID *OldValue)
Definition process_util.cpp:91
+
pesieve::util::wow64_disable_fs_redirection
BOOL wow64_disable_fs_redirection(OUT PVOID *OldValue)
Definition process_util.cpp:104
pesieve::util::extract_from_dll
size_t extract_from_dll(IN const std::string &path, size_t startSyscallID, OUT std::map< DWORD, std::string > &syscallToName)
Definition syscall_extractor.cpp:55
pesieve::util::DWORD
DWORD(__stdcall *_PssCaptureSnapshot)(HANDLE ProcessHandle
pesieve::util::extract_syscall_table
size_t extract_syscall_table(OUT std::map< DWORD, std::string > &syscallToName)
Definition syscall_extractor.cpp:82
pesieve::util::extract_syscalls
size_t extract_syscalls(BYTE *pe_buf, size_t pe_size, std::map< DWORD, std::string > &syscallToName, size_t startID=0)
Definition syscall_extractor.cpp:29
-
pesieve::util::wow64_revert_fs_redirection
BOOL wow64_revert_fs_redirection(IN PVOID OldValue)
Definition process_util.cpp:108
+
pesieve::util::wow64_revert_fs_redirection
BOOL wow64_revert_fs_redirection(IN PVOID OldValue)
Definition process_util.cpp:121
pesieve.MAX_PATH
int MAX_PATH
Definition pesieve.py:10
process_util.h
diff --git a/thread__scanner_8cpp.html b/thread__scanner_8cpp.html index 7cfa2c8cd..b67f00f4c 100644 --- a/thread__scanner_8cpp.html +++ b/thread__scanner_8cpp.html @@ -200,7 +200,7 @@

-

Definition at line 69 of file thread_scanner.cpp.

+

Definition at line 70 of file thread_scanner.cpp.

@@ -228,7 +228,7 @@

-

Definition at line 56 of file thread_scanner.cpp.

+

Definition at line 57 of file thread_scanner.cpp.

@@ -247,7 +247,7 @@

-

Definition at line 118 of file thread_scanner.cpp.

+

Definition at line 119 of file thread_scanner.cpp.

@@ -272,7 +272,7 @@

-

Definition at line 308 of file thread_scanner.cpp.

+

Definition at line 318 of file thread_scanner.cpp.

@@ -291,7 +291,7 @@

-

Definition at line 464 of file thread_scanner.cpp.

+

Definition at line 474 of file thread_scanner.cpp.

Here is the call graph for this function:
diff --git a/thread__scanner_8cpp_source.html b/thread__scanner_8cpp_source.html index 907e0919f..90aada013 100644 --- a/thread__scanner_8cpp_source.html +++ b/thread__scanner_8cpp_source.html @@ -152,603 +152,613 @@
52 return true;
53 }
-
54};
-
55
-
-
56bool get_page_details(HANDLE processHandle, LPVOID start_va, MEMORY_BASIC_INFORMATION& page_info)
-
57{
-
58 size_t page_info_size = sizeof(MEMORY_BASIC_INFORMATION);
-
59 const SIZE_T out = VirtualQueryEx(processHandle, (LPCVOID)start_va, &page_info, page_info_size);
-
60 const bool is_read = (out == page_info_size) ? true : false;
-
61 const DWORD error = is_read ? ERROR_SUCCESS : GetLastError();
-
62 if (error != ERROR_SUCCESS) {
-
63 //nothing to read
-
64 return false;
-
65 }
-
66 return true;
-
67}
+
54
+
55};
+
56
+
+
57bool get_page_details(HANDLE processHandle, LPVOID start_va, MEMORY_BASIC_INFORMATION& page_info)
+
58{
+
59 size_t page_info_size = sizeof(MEMORY_BASIC_INFORMATION);
+
60 const SIZE_T out = VirtualQueryEx(processHandle, (LPCVOID)start_va, &page_info, page_info_size);
+
61 const bool is_read = (out == page_info_size) ? true : false;
+
62 const DWORD error = is_read ? ERROR_SUCCESS : GetLastError();
+
63 if (error != ERROR_SUCCESS) {
+
64 //nothing to read
+
65 return false;
+
66 }
+
67 return true;
+
68}
-
68
-
-
69DWORD WINAPI enum_stack_thread(LPVOID lpParam)
-
70{
-
71 t_stack_enum_params* args = static_cast<t_stack_enum_params*>(lpParam);
-
72 if (!args || !args->cDetails || !args->ctx) {
-
73 return STATUS_INVALID_PARAMETER;
-
74 }
-
75 size_t fetched = 0;
-
76 const pesieve::ctx_details& cDetails = *(args->cDetails);
-
77#ifdef _WIN64
-
78 if (cDetails.is64b) {
-
79 STACKFRAME64 frame = { 0 };
-
80
-
81 frame.AddrPC.Offset = cDetails.rip;
-
82 frame.AddrPC.Mode = AddrModeFlat;
-
83 frame.AddrStack.Offset = cDetails.rsp;
-
84 frame.AddrStack.Mode = AddrModeFlat;
-
85 frame.AddrFrame.Offset = cDetails.rbp;
-
86 frame.AddrFrame.Mode = AddrModeFlat;
-
87
-
88 while (StackWalk64(IMAGE_FILE_MACHINE_AMD64, args->hProcess, args->hThread, &frame, args->ctx, NULL, SymFunctionTableAccess64, SymGetModuleBase64, NULL)) {
-
89 const ULONGLONG next_addr = frame.AddrPC.Offset;
-
90 args->callStack.push_back(next_addr);
-
91 fetched++;
-
92 }
-
93 }
-
94#endif
-
95 if (!cDetails.is64b) {
-
96 STACKFRAME frame = { 0 };
-
97
-
98 frame.AddrPC.Offset = cDetails.rip;
-
99 frame.AddrPC.Mode = AddrModeFlat;
-
100 frame.AddrStack.Offset = cDetails.rsp;
-
101 frame.AddrStack.Mode = AddrModeFlat;
-
102 frame.AddrFrame.Offset = cDetails.rbp;
-
103 frame.AddrFrame.Mode = AddrModeFlat;
-
104
-
105 while (StackWalk(IMAGE_FILE_MACHINE_I386, args->hProcess, args->hThread, &frame, args->ctx, NULL, SymFunctionTableAccess, SymGetModuleBase, NULL)) {
-
106 const ULONGLONG next_return = frame.AddrPC.Offset;
-
107 args->callStack.push_back(next_return);
-
108 fetched++;
-
109 }
-
110 }
-
111 if (fetched) {
-
112 args->is_ok = true;
-
113 return STATUS_SUCCESS;
-
114 }
-
115 return STATUS_UNSUCCESSFUL;
-
116}
+
69
+
+
70DWORD WINAPI enum_stack_thread(LPVOID lpParam)
+
71{
+
72 t_stack_enum_params* args = static_cast<t_stack_enum_params*>(lpParam);
+
73 if (!args || !args->cDetails || !args->ctx) {
+
74 return STATUS_INVALID_PARAMETER;
+
75 }
+
76 size_t fetched = 0;
+
77 const pesieve::ctx_details& cDetails = *(args->cDetails);
+
78#ifdef _WIN64
+
79 if (cDetails.is64b) {
+
80 STACKFRAME64 frame = { 0 };
+
81
+
82 frame.AddrPC.Offset = cDetails.rip;
+
83 frame.AddrPC.Mode = AddrModeFlat;
+
84 frame.AddrStack.Offset = cDetails.rsp;
+
85 frame.AddrStack.Mode = AddrModeFlat;
+
86 frame.AddrFrame.Offset = cDetails.rbp;
+
87 frame.AddrFrame.Mode = AddrModeFlat;
+
88
+
89 while (StackWalk64(IMAGE_FILE_MACHINE_AMD64, args->hProcess, args->hThread, &frame, args->ctx, NULL, SymFunctionTableAccess64, SymGetModuleBase64, NULL)) {
+
90 const ULONGLONG next_addr = frame.AddrPC.Offset;
+
91 args->callStack.push_back(next_addr);
+
92 fetched++;
+
93 }
+
94 }
+
95#endif
+
96 if (!cDetails.is64b) {
+
97 STACKFRAME frame = { 0 };
+
98
+
99 frame.AddrPC.Offset = cDetails.rip;
+
100 frame.AddrPC.Mode = AddrModeFlat;
+
101 frame.AddrStack.Offset = cDetails.rsp;
+
102 frame.AddrStack.Mode = AddrModeFlat;
+
103 frame.AddrFrame.Offset = cDetails.rbp;
+
104 frame.AddrFrame.Mode = AddrModeFlat;
+
105
+
106 while (StackWalk(IMAGE_FILE_MACHINE_I386, args->hProcess, args->hThread, &frame, args->ctx, NULL, SymFunctionTableAccess, SymGetModuleBase, NULL)) {
+
107 const ULONGLONG next_return = frame.AddrPC.Offset;
+
108 args->callStack.push_back(next_return);
+
109 fetched++;
+
110 }
+
111 }
+
112 if (fetched) {
+
113 args->is_ok = true;
+
114 return STATUS_SUCCESS;
+
115 }
+
116 return STATUS_UNSUCCESSFUL;
+
117}
-
117
-
-
118bool has_empty_gui_info(DWORD tid)
-
119{
-
120 GUITHREADINFO gui = { 0 };
-
121 gui.cbSize = sizeof(GUITHREADINFO);
-
122 if (!GetGUIThreadInfo(tid, &gui)) {
-
123 return false;
-
124 }
-
125 bool hasWindows = gui.hwndActive || gui.hwndCapture || gui.hwndCaret || gui.hwndMenuOwner || gui.hwndMoveSize;
-
126 bool hasRcCaret = gui.rcCaret.left || gui.rcCaret.right || gui.rcCaret.bottom || gui.rcCaret.top;
-
127 if (hasWindows || hasRcCaret) {
-
128 return false;
-
129 }
-
130 return true;
-
131}
+
118
+
+
119bool has_empty_gui_info(DWORD tid)
+
120{
+
121 GUITHREADINFO gui = { 0 };
+
122 gui.cbSize = sizeof(GUITHREADINFO);
+
123 if (!GetGUIThreadInfo(tid, &gui)) {
+
124 return false;
+
125 }
+
126 bool hasWindows = gui.hwndActive || gui.hwndCapture || gui.hwndCaret || gui.hwndMenuOwner || gui.hwndMoveSize;
+
127 bool hasRcCaret = gui.rcCaret.left || gui.rcCaret.right || gui.rcCaret.bottom || gui.rcCaret.top;
+
128 if (hasWindows || hasRcCaret) {
+
129 return false;
+
130 }
+
131 return true;
+
132}
-
132
-
133//---
-
134
-
-
135std::string ThreadScanReport::translate_wait_reason(DWORD thread_wait_reason)
-
136{
-
137 switch (thread_wait_reason) {
-
138 case DelayExecution: return "DelayExecution";
-
139 case Suspended: return "Suspended";
-
140 case Executive: return "Executive";
-
141 case UserRequest: return "UserRequest";
-
142 case WrUserRequest: return "WrUserRequest";
-
143 case WrEventPair: return "WrEventPair";
-
144 case WrQueue: return "WrQueue";
-
145 }
-
146 std::stringstream ss;
-
147 ss << "Other: " << std::dec << thread_wait_reason;
-
148 return ss.str();
-
149}
+
133
+
134//---
+
135
+
+
136std::string ThreadScanReport::translate_wait_reason(DWORD thread_wait_reason)
+
137{
+
138 switch (thread_wait_reason) {
+
139 case DelayExecution: return "DelayExecution";
+
140 case Suspended: return "Suspended";
+
141 case Executive: return "Executive";
+
142 case UserRequest: return "UserRequest";
+
143 case WrUserRequest: return "WrUserRequest";
+
144 case WrEventPair: return "WrEventPair";
+
145 case WrQueue: return "WrQueue";
+
146 }
+
147 std::stringstream ss;
+
148 ss << "Other: " << std::dec << thread_wait_reason;
+
149 return ss.str();
+
150}
-
150
-
-
151std::string ThreadScanReport::translate_thread_state(DWORD thread_state)
-
152{
-
153 switch (thread_state) {
-
154 case Initialized: return "Initialized";
-
155 case Ready: return "Ready";
-
156 case Running: return "Running";
-
157 case Standby: return "Standby";
-
158 case Terminated: return "Terminated";
-
159 case Waiting: return "Waiting";
-
160 case Transition: return "Transition";
-
161 case DeferredReady: return "DeferredReady";
-
162 case GateWaitObsolete: return "GateWaitObsolete";
-
163 case WaitingForProcessInSwap: return "WaitingForProcessInSwap";
-
164 }
-
165 std::stringstream ss;
-
166 ss << "Other: " << std::dec << thread_state;
-
167 return ss.str();
-
168}
+
151
+
+
152std::string ThreadScanReport::translate_thread_state(DWORD thread_state)
+
153{
+
154 switch (thread_state) {
+
155 case Initialized: return "Initialized";
+
156 case Ready: return "Ready";
+
157 case Running: return "Running";
+
158 case Standby: return "Standby";
+
159 case Terminated: return "Terminated";
+
160 case Waiting: return "Waiting";
+
161 case Transition: return "Transition";
+
162 case DeferredReady: return "DeferredReady";
+
163 case GateWaitObsolete: return "GateWaitObsolete";
+
164 case WaitingForProcessInSwap: return "WaitingForProcessInSwap";
+
165 }
+
166 std::stringstream ss;
+
167 ss << "Other: " << std::dec << thread_state;
+
168 return ss.str();
+
169}
-
169
-
170//---
-
171
-
-
172bool pesieve::ThreadScanner::checkReturnAddrIntegrity(IN const std::vector<ULONGLONG>& callStack)
-
173{
-
174 if (this->info.last_syscall == INVALID_SYSCALL || !symbols || !callStack.size() || !info.is_extended || !g_SyscallTable.isReady()) {
-
175 return true; // skip the check
-
176 }
-
177 const std::string syscallFuncName = g_SyscallTable.getSyscallName(this->info.last_syscall);
-
178
-
179 const ULONGLONG lastCalled = *callStack.begin();
-
180 const std::string lastFuncCalled = symbols->funcNameFromAddr(lastCalled);
-
181
-
182 if (SyscallTable::isSameSyscallFunc(syscallFuncName, lastFuncCalled)) {
-
183 return true;
-
184 }
-
185 if (this->info.ext.wait_reason == Suspended && callStack.size() == 1 && lastFuncCalled == "RtlUserThreadStart" && this->info.last_syscall == 0) {
-
186 return true; //normal for suspended threads
+
170
+
171//---
+
172
+
+
173bool pesieve::ThreadScanner::checkReturnAddrIntegrity(IN const std::vector<ULONGLONG>& callStack)
+
174{
+
175 if (this->info.last_syscall == INVALID_SYSCALL || !symbols || !callStack.size() || !info.is_extended || !g_SyscallTable.isReady()) {
+
176 return true; // skip the check
+
177 }
+
178 const std::string syscallFuncName = g_SyscallTable.getSyscallName(this->info.last_syscall);
+
179
+
180 const ULONGLONG lastCalled = *callStack.begin();
+
181 const std::string lastFuncCalled = symbols->funcNameFromAddr(lastCalled);
+
182 if (callStack.size() == 1) {
+
183 if (this->info.ext.wait_reason == Suspended && lastFuncCalled == "RtlUserThreadStart" && this->info.last_syscall == 0) {
+
184 return true; //normal for suspended threads
+
185 }
+
186 return false; // otherwise it is an anomaly
187 }
-
188 if (this->info.ext.wait_reason == UserRequest && syscallFuncName == "NtWaitForSingleObject") {
-
189 if (lastFuncCalled.rfind("NtQuery", 0) == 0 || lastFuncCalled.rfind("ZwQuery", 0) == 0) {
-
190 return true;
-
191 }
+
188#ifndef _WIN64
+
189 static bool isWow64 = util::is_current_wow64();
+
190 if (!isWow64 && lastFuncCalled == "KiFastSystemCallRet") {
+
191 return true;
192 }
-
193 if (syscallFuncName == "NtCallbackReturn") {
-
194 const ScannedModule* mod = modulesInfo.findModuleContaining(lastCalled);
-
195 if (mod && mod->getModName() == "win32u.dll") return true;
+
193#endif
+
194 if (SyscallTable::isSameSyscallFunc(syscallFuncName, lastFuncCalled)) {
+
195 return true;
196 }
-
197#ifdef _SHOW_THREAD_INFO
-
198 std::cout << "\n#### TID=" << std::dec <<info.tid << " " << syscallFuncName << " VS " << lastFuncCalled << " DIFFERENT"<< std::endl;
-
199 printThreadInfo(info);
-
200 std::cout << "STACK:\n";
-
201 for (auto itr = callStack.rbegin(); itr != callStack.rend(); ++itr) {
-
202 ULONGLONG next_return = *itr;
-
203 symbols->dumpSymbolInfo(next_return);
-
204 std::cout << "\t";
-
205 printResolvedAddr(next_return);
+
197
+
198 if (this->info.ext.wait_reason == UserRequest && syscallFuncName == "NtWaitForSingleObject") {
+
199 if (lastFuncCalled.rfind("NtQuery", 0) == 0 || lastFuncCalled.rfind("ZwQuery", 0) == 0) {
+
200 return true;
+
201 }
+
202 }
+
203 if (syscallFuncName == "NtCallbackReturn") {
+
204 const ScannedModule* mod = modulesInfo.findModuleContaining(lastCalled);
+
205 if (mod && mod->getModName() == "win32u.dll") return true;
206 }
-
207 std::cout << std::endl;
-
208#endif //_SHOW_THREAD_INFO
-
209 return false;
-
210}
+
207#ifdef _SHOW_THREAD_INFO
+
208 std::cout << "\n#### TID=" << std::dec <<info.tid << " " << syscallFuncName << " VS " << lastFuncCalled << " DIFFERENT"<< std::endl;
+
209 printThreadInfo(info);
+
210 std::cout << "STACK:\n";
+
211 for (auto itr = callStack.rbegin(); itr != callStack.rend(); ++itr) {
+
212 ULONGLONG next_return = *itr;
+
213 symbols->dumpSymbolInfo(next_return);
+
214 std::cout << "\t";
+
215 printResolvedAddr(next_return);
+
216 }
+
217 std::cout << std::endl;
+
218#endif //_SHOW_THREAD_INFO
+
219 return false;
+
220}
-
211
-
-
212size_t pesieve::ThreadScanner::analyzeCallStack(IN const std::vector<ULONGLONG> call_stack, IN OUT ctx_details& cDetails)
-
213{
-
214 size_t processedCntr = 0;
-
215
-
216 cDetails.is_managed = false;
-
217 cDetails.stackFramesCount = call_stack.size();
-
218 cDetails.is_ret_in_frame = false;
-
219#ifdef _SHOW_THREAD_INFO
-
220 std::cout << "\n" << "Stack frame Size: " << std::dec << call_stack.size() << "\n===\n";
-
221#endif //_SHOW_THREAD_INFO
-
222 for (auto itr = call_stack.rbegin(); itr != call_stack.rend() ;++itr, ++processedCntr) {
-
223 const ULONGLONG next_return = *itr;
-
224 if (cDetails.ret_on_stack == next_return) {
-
225 cDetails.is_ret_in_frame = true;
-
226 }
-
227#ifdef _SHOW_THREAD_INFO
-
228 if (symbols) {
-
229 symbols->dumpSymbolInfo(next_return);
-
230 }
-
231 std::cout << "\t";
-
232 printResolvedAddr(next_return);
-
233#endif //_SHOW_THREAD_INFO
-
234 bool is_curr_shc = false;
-
235 const ScannedModule* mod = modulesInfo.findModuleContaining(next_return);
-
236 const std::string mod_name = mod ? mod->getModName() : "";
-
237 if (mod_name.length() == 0) {
-
238 if (!cDetails.is_managed) {
-
239 is_curr_shc = true;
-
240 cDetails.shcCandidates.insert(next_return);
-
241#ifdef _SHOW_THREAD_INFO
-
242 std::cout << "\t" << std::hex << next_return << " <=== SHELLCODE\n";
+
221
+
+
222size_t pesieve::ThreadScanner::analyzeCallStack(IN const std::vector<ULONGLONG> call_stack, IN OUT ctx_details& cDetails)
+
223{
+
224 size_t processedCntr = 0;
+
225
+
226 cDetails.is_managed = false;
+
227 cDetails.stackFramesCount = call_stack.size();
+
228 cDetails.is_ret_in_frame = false;
+
229#ifdef _SHOW_THREAD_INFO
+
230 std::cout << "\n" << "Stack frame Size: " << std::dec << call_stack.size() << "\n===\n";
+
231#endif //_SHOW_THREAD_INFO
+
232 for (auto itr = call_stack.rbegin(); itr != call_stack.rend() ;++itr, ++processedCntr) {
+
233 const ULONGLONG next_return = *itr;
+
234 if (cDetails.ret_on_stack == next_return) {
+
235 cDetails.is_ret_in_frame = true;
+
236 }
+
237#ifdef _SHOW_THREAD_INFO
+
238 if (symbols) {
+
239 symbols->dumpSymbolInfo(next_return);
+
240 }
+
241 std::cout << "\t";
+
242 printResolvedAddr(next_return);
243#endif //_SHOW_THREAD_INFO
-
244 } else {
-
245#ifdef _SHOW_THREAD_INFO
-
246 std::cout << "\t" << std::hex << next_return << " <=== .NET JIT\n";
-
247#endif //_SHOW_THREAD_INFO
-
248 }
-
249 }
-
250 if (!is_curr_shc) {
-
251 // store the last address, till the first called shellcode:
-
252 cDetails.last_ret = next_return;
-
253 }
-
254 // check if the found shellcode is a .NET JIT:
-
255 if (mod_name == "clr.dll" || mod_name == "coreclr.dll") {
-
256 cDetails.is_managed = true;
-
257#ifdef _SHOW_THREAD_INFO
-
258 std::cout << "\t" << std::hex << next_return << " <--- .NET\n";
-
259#endif //_SHOW_THREAD_INFO
-
260 }
-
261 }
-
262#ifdef _SHOW_THREAD_INFO
-
263 std::cout << "\n===\n";
-
264#endif //_SHOW_THREAD_INFO
-
265 return processedCntr;
-
266}
+
244 bool is_curr_shc = false;
+
245 const ScannedModule* mod = modulesInfo.findModuleContaining(next_return);
+
246 const std::string mod_name = mod ? mod->getModName() : "";
+
247 if (mod_name.length() == 0) {
+
248 if (!cDetails.is_managed) {
+
249 is_curr_shc = true;
+
250 cDetails.shcCandidates.insert(next_return);
+
251#ifdef _SHOW_THREAD_INFO
+
252 std::cout << "\t" << std::hex << next_return << " <=== SHELLCODE\n";
+
253#endif //_SHOW_THREAD_INFO
+
254 } else {
+
255#ifdef _SHOW_THREAD_INFO
+
256 std::cout << "\t" << std::hex << next_return << " <=== .NET JIT\n";
+
257#endif //_SHOW_THREAD_INFO
+
258 }
+
259 }
+
260 if (!is_curr_shc) {
+
261 // store the last address, till the first called shellcode:
+
262 cDetails.last_ret = next_return;
+
263 }
+
264 // check if the found shellcode is a .NET JIT:
+
265 if (mod_name == "clr.dll" || mod_name == "coreclr.dll") {
+
266 cDetails.is_managed = true;
+
267#ifdef _SHOW_THREAD_INFO
+
268 std::cout << "\t" << std::hex << next_return << " <--- .NET\n";
+
269#endif //_SHOW_THREAD_INFO
+
270 }
+
271 }
+
272#ifdef _SHOW_THREAD_INFO
+
273 std::cout << "\n===\n";
+
274#endif //_SHOW_THREAD_INFO
+
275 return processedCntr;
+
276}
-
267
-
-
268size_t pesieve::ThreadScanner::fillCallStackInfo(IN HANDLE hProcess, IN HANDLE hThread, IN LPVOID ctx, IN OUT ctx_details& cDetails)
-
269{
-
270 // do it in a new thread to prevent stucking...
-
271 t_stack_enum_params args(hProcess, hThread, ctx, &cDetails);
-
272
-
273 const size_t max_wait = 1000;
-
274 {
-
275 HANDLE enumThread = CreateThread(
-
276 NULL, // default security attributes
-
277 0, // use default stack size
-
278 enum_stack_thread, // thread function name
-
279 &args, // argument to thread function
-
280 0, // use default creation flags
-
281 0); // returns the thread identifiee
+
277
+
+
278size_t pesieve::ThreadScanner::fillCallStackInfo(IN HANDLE hProcess, IN HANDLE hThread, IN LPVOID ctx, IN OUT ctx_details& cDetails)
+
279{
+
280 // do it in a new thread to prevent stucking...
+
281 t_stack_enum_params args(hProcess, hThread, ctx, &cDetails);
282
-
283 if (enumThread) {
-
284 DWORD wait_result = WaitForSingleObject(enumThread, max_wait);
-
285 if (wait_result == WAIT_TIMEOUT) {
-
286 std::cerr << "[!] Cannot retrieve stack frame: timeout passed!\n";
-
287 TerminateThread(enumThread, 0);
-
288 CloseHandle(enumThread);
-
289 return 0;
-
290 }
-
291 CloseHandle(enumThread);
-
292 }
-
293 }
-
294 if (!args.is_ok) {
-
295 return 0;
-
296 }
-
297#ifdef _SHOW_THREAD_INFO
-
298 std::cout << "\n=== TID " << std::dec << GetThreadId(hThread) << " ===\n";
-
299#endif //_SHOW_THREAD_INFO
-
300 const size_t analyzedCount = analyzeCallStack(args.callStack, cDetails);
-
301 if (!cDetails.is_managed) {
-
302 cDetails.is_ret_as_syscall = checkReturnAddrIntegrity(args.callStack);
+
283 const size_t max_wait = 1000;
+
284 {
+
285 HANDLE enumThread = CreateThread(
+
286 NULL, // default security attributes
+
287 0, // use default stack size
+
288 enum_stack_thread, // thread function name
+
289 &args, // argument to thread function
+
290 0, // use default creation flags
+
291 0); // returns the thread identifiee
+
292
+
293 if (enumThread) {
+
294 DWORD wait_result = WaitForSingleObject(enumThread, max_wait);
+
295 if (wait_result == WAIT_TIMEOUT) {
+
296 std::cerr << "[!] Cannot retrieve stack frame: timeout passed!\n";
+
297 TerminateThread(enumThread, 0);
+
298 CloseHandle(enumThread);
+
299 return 0;
+
300 }
+
301 CloseHandle(enumThread);
+
302 }
303 }
-
304 return analyzedCount;
-
305}
+
304 if (!args.is_ok) {
+
305 return 0;
+
306 }
+
307#ifdef _SHOW_THREAD_INFO
+
308 std::cout << "\n=== TID " << std::dec << GetThreadId(hThread) << " ===\n";
+
309#endif //_SHOW_THREAD_INFO
+
310 const size_t analyzedCount = analyzeCallStack(args.callStack, cDetails);
+
311 if (!cDetails.is_managed) {
+
312 cDetails.is_ret_as_syscall = checkReturnAddrIntegrity(args.callStack);
+
313 }
+
314 return analyzedCount;
+
315}
-
306
-
307template <typename PTR_T>
-
-
308bool read_return_ptr(IN HANDLE hProcess, IN OUT ctx_details& cDetails) {
-
309 PTR_T ret_addr = 0;
-
310 cDetails.ret_on_stack = 0;
-
311 if (peconv::read_remote_memory(hProcess, (LPVOID)cDetails.rsp, (BYTE*)&ret_addr, sizeof(ret_addr)) == sizeof(ret_addr)) {
-
312 cDetails.ret_on_stack = (ULONGLONG)ret_addr;
-
313 return true;
-
314 }
-
315 return false;
-
316}
-
-
317
+
316
+
317template <typename PTR_T>
-
318bool pesieve::ThreadScanner::fetchThreadCtxDetails(IN HANDLE hProcess, IN HANDLE hThread, OUT ctx_details& cDetails)
-
319{
-
320 bool is_ok = false;
-
321 BOOL is_wow64 = FALSE;
-
322 size_t retrieved = 0;
-
323#ifdef _WIN64
-
324 pesieve::util::is_process_wow64(hProcess, &is_wow64);
-
325
-
326 if (is_wow64) {
-
327 WOW64_CONTEXT ctx = { 0 };
-
328 ctx.ContextFlags = CONTEXT_INTEGER | CONTEXT_CONTROL;
-
329 if (pesieve::util::wow64_get_thread_context(hThread, &ctx)) {
-
330 is_ok = true;
-
331 cDetails.init(false, ctx.Eip, ctx.Esp, ctx.Ebp);
-
332 read_return_ptr<DWORD>(hProcess, cDetails);
-
333 retrieved = fillCallStackInfo(hProcess, hThread, &ctx, cDetails);
-
334 }
-
335 }
-
336#endif
-
337 if (!is_ok) {
-
338
-
339 CONTEXT ctx = { 0 };
-
340 ctx.ContextFlags = CONTEXT_INTEGER | CONTEXT_CONTROL;
-
341 if (GetThreadContext(hThread, &ctx)) {
-
342 is_ok = true;
-
343#ifdef _WIN64
-
344 cDetails.init(true, ctx.Rip, ctx.Rsp, ctx.Rbp);
-
345 read_return_ptr<ULONGLONG>(hProcess, cDetails);
-
346#else
-
347 cDetails.init(false, ctx.Eip, ctx.Esp, ctx.Ebp);
-
348 read_return_ptr<DWORD>(hProcess, cDetails);
-
349#endif
-
350 retrieved = fillCallStackInfo(hProcess, hThread, &ctx, cDetails);
-
351 }
-
352 }
-
353 if (!retrieved) is_ok = false;
-
354 return is_ok;
-
355}
+
318bool read_return_ptr(IN HANDLE hProcess, IN OUT ctx_details& cDetails) {
+
319 PTR_T ret_addr = 0;
+
320 cDetails.ret_on_stack = 0;
+
321 if (peconv::read_remote_memory(hProcess, (LPVOID)cDetails.rsp, (BYTE*)&ret_addr, sizeof(ret_addr)) == sizeof(ret_addr)) {
+
322 cDetails.ret_on_stack = (ULONGLONG)ret_addr;
+
323 return true;
+
324 }
+
325 return false;
+
326}
-
356
-
-
357bool pesieve::ThreadScanner::isAddrInShellcode(const ULONGLONG addr)
-
358{
-
359 ScannedModule* mod = modulesInfo.findModuleContaining(addr);
-
360 if (!mod) return true;
-
361
-
362 //the module is named
-
363 if (mod->getModName().length() > 0) {
-
364 return false;
-
365 }
-
366 return true;
-
367}
+
327
+
+
328bool pesieve::ThreadScanner::fetchThreadCtxDetails(IN HANDLE hProcess, IN HANDLE hThread, OUT ctx_details& cDetails)
+
329{
+
330 bool is_ok = false;
+
331 BOOL is_wow64 = FALSE;
+
332 size_t retrieved = 0;
+
333#ifdef _WIN64
+
334 pesieve::util::is_process_wow64(hProcess, &is_wow64);
+
335
+
336 if (is_wow64) {
+
337 WOW64_CONTEXT ctx = { 0 };
+
338 ctx.ContextFlags = CONTEXT_INTEGER | CONTEXT_CONTROL;
+
339 if (pesieve::util::wow64_get_thread_context(hThread, &ctx)) {
+
340 is_ok = true;
+
341 cDetails.init(false, ctx.Eip, ctx.Esp, ctx.Ebp);
+
342 read_return_ptr<DWORD>(hProcess, cDetails);
+
343 retrieved = fillCallStackInfo(hProcess, hThread, &ctx, cDetails);
+
344 }
+
345 }
+
346#endif
+
347 if (!is_ok) {
+
348
+
349 CONTEXT ctx = { 0 };
+
350 ctx.ContextFlags = CONTEXT_INTEGER | CONTEXT_CONTROL;
+
351 if (GetThreadContext(hThread, &ctx)) {
+
352 is_ok = true;
+
353#ifdef _WIN64
+
354 cDetails.init(true, ctx.Rip, ctx.Rsp, ctx.Rbp);
+
355 read_return_ptr<ULONGLONG>(hProcess, cDetails);
+
356#else
+
357 cDetails.init(false, ctx.Eip, ctx.Esp, ctx.Ebp);
+
358 read_return_ptr<DWORD>(hProcess, cDetails);
+
359#endif
+
360 retrieved = fillCallStackInfo(hProcess, hThread, &ctx, cDetails);
+
361 }
+
362 }
+
363 if (!retrieved) is_ok = false;
+
364 return is_ok;
+
365}
-
368
-
-
369bool pesieve::ThreadScanner::printResolvedAddr(const ULONGLONG addr)
-
370{
-
371 bool is_resolved = false;
-
372 std::cout << std::hex << addr;
-
373 ScannedModule* mod = modulesInfo.findModuleContaining(addr);
-
374 if (mod) {
-
375 std::cout << " : " << mod->getModName();
-
376 is_resolved = true;
-
377 }
-
378 if (exportsMap && is_resolved) {
-
379 bool search_name = false;
-
380 if (mod->getModName() == "ntdll.dll" || mod->getModName() == "win32u.dll") {
-
381 search_name = true;
-
382 }
-
383 for (size_t i = 0; i < 25; i++) {
-
384 const peconv::ExportedFunc* exp = exportsMap->find_export_by_va(addr - i);
-
385 if (exp) {
-
386 std::cout << " : " << exp->toString();
-
387 is_resolved = true;
-
388 break;
-
389 }
-
390 if (!search_name) {
-
391 break;
-
392 }
-
393 }
-
394 }
-
395 std::cout << std::endl;
-
396 return is_resolved;
-
397}
+
366
+
+
367bool pesieve::ThreadScanner::isAddrInShellcode(const ULONGLONG addr)
+
368{
+
369 ScannedModule* mod = modulesInfo.findModuleContaining(addr);
+
370 if (!mod) return true;
+
371
+
372 //the module is named
+
373 if (mod->getModName().length() > 0) {
+
374 return false;
+
375 }
+
376 return true;
+
377}
-
398
-
-
399void pesieve::ThreadScanner::printThreadInfo(const pesieve::util::thread_info& threadi)
-
400{
-
401 std::cout << std::dec << "TID: " << threadi.tid << "\n";
-
402 std::cout << std::hex << "\tStart : ";
-
403 printResolvedAddr(threadi.start_addr);
-
404
-
405 if (threadi.is_extended) {
-
406 std::cout << std::hex << "\tSysStart: ";
-
407 printResolvedAddr(threadi.ext.sys_start_addr);
-
408 if (threadi.last_syscall != INVALID_SYSCALL) {
-
409 std::cout << "\tLast Syscall: " << std::hex << threadi.last_syscall << " Func: " << g_SyscallTable.getSyscallName(threadi.last_syscall) << std::endl;
-
410 }
-
411 std::cout << "\tState: [" << ThreadScanReport::translate_thread_state(threadi.ext.state) << "]";
-
412 if (threadi.ext.state == Waiting) {
-
413 std::cout << " Reason: [" << ThreadScanReport::translate_wait_reason(threadi.ext.wait_reason) << "] Time: " << threadi.ext.wait_time;
-
414 }
-
415 std::cout << "\n";
-
416 }
-
417 std::cout << "\n";
-
418}
+
378
+
+
379bool pesieve::ThreadScanner::printResolvedAddr(const ULONGLONG addr)
+
380{
+
381 bool is_resolved = false;
+
382 std::cout << std::hex << addr;
+
383 ScannedModule* mod = modulesInfo.findModuleContaining(addr);
+
384 if (mod) {
+
385 std::cout << " : " << mod->getModName();
+
386 is_resolved = true;
+
387 }
+
388 if (exportsMap && is_resolved) {
+
389 bool search_name = false;
+
390 if (mod->getModName() == "ntdll.dll" || mod->getModName() == "win32u.dll") {
+
391 search_name = true;
+
392 }
+
393 for (size_t i = 0; i < 25; i++) {
+
394 const peconv::ExportedFunc* exp = exportsMap->find_export_by_va(addr - i);
+
395 if (exp) {
+
396 std::cout << " : " << exp->toString();
+
397 is_resolved = true;
+
398 break;
+
399 }
+
400 if (!search_name) {
+
401 break;
+
402 }
+
403 }
+
404 }
+
405 std::cout << std::endl;
+
406 return is_resolved;
+
407}
-
419
-
-
420bool pesieve::ThreadScanner::fillAreaStats(ThreadScanReport* my_report)
-
421{
-
422 if (!my_report) return false;
-
423
-
424 ULONG_PTR end_va = (ULONG_PTR)my_report->module + my_report->moduleSize;
-
425 MemPageData mem(this->processHandle, this->isReflection, (ULONG_PTR)my_report->module, end_va);
-
426 if (!mem.fillInfo() || !mem.load()) {
-
427 return false;
-
428 }
-
429 AreaStatsCalculator calc(mem.loadedData);
-
430 return calc.fill(my_report->stats, nullptr);
-
431}
+
408
+
+
409void pesieve::ThreadScanner::printThreadInfo(const pesieve::util::thread_info& threadi)
+
410{
+
411 std::cout << std::dec << "TID: " << threadi.tid << "\n";
+
412 std::cout << std::hex << "\tStart : ";
+
413 printResolvedAddr(threadi.start_addr);
+
414
+
415 if (threadi.is_extended) {
+
416 std::cout << std::hex << "\tSysStart: ";
+
417 printResolvedAddr(threadi.ext.sys_start_addr);
+
418 if (threadi.last_syscall != INVALID_SYSCALL) {
+
419 std::cout << "\tLast Syscall: " << std::hex << threadi.last_syscall << " Func: " << g_SyscallTable.getSyscallName(threadi.last_syscall) << std::endl;
+
420 }
+
421 std::cout << "\tState: [" << ThreadScanReport::translate_thread_state(threadi.ext.state) << "]";
+
422 if (threadi.ext.state == Waiting) {
+
423 std::cout << " Reason: [" << ThreadScanReport::translate_wait_reason(threadi.ext.wait_reason) << "] Time: " << threadi.ext.wait_time;
+
424 }
+
425 std::cout << "\n";
+
426 }
+
427 std::cout << "\n";
+
428}
-
432
-
-
433bool pesieve::ThreadScanner::reportSuspiciousAddr(ThreadScanReport* my_report, ULONGLONG susp_addr)
-
434{
-
435 MEMORY_BASIC_INFORMATION page_info = { 0 };
-
436 if (!get_page_details(processHandle, (LPVOID)susp_addr, page_info)) {
+
429
+
+
430bool pesieve::ThreadScanner::fillAreaStats(ThreadScanReport* my_report)
+
431{
+
432 if (!my_report) return false;
+
433
+
434 ULONG_PTR end_va = (ULONG_PTR)my_report->module + my_report->moduleSize;
+
435 MemPageData mem(this->processHandle, this->isReflection, (ULONG_PTR)my_report->module, end_va);
+
436 if (!mem.fillInfo() || !mem.load()) {
437 return false;
438 }
-
439 if (page_info.State & MEM_FREE) {
-
440 return false;
-
441 }
-
442 ULONGLONG base = (ULONGLONG)page_info.BaseAddress;
-
443 if (this->info.is_extended) {
-
444 my_report->thread_state = info.ext.state;
-
445 my_report->thread_wait_reason = info.ext.wait_reason;
-
446 my_report->thread_wait_time = info.ext.wait_time;
-
447 }
-
448 my_report->module = (HMODULE)base;
-
449 my_report->moduleSize = page_info.RegionSize;
-
450 my_report->protection = page_info.AllocationProtect;
-
451
-
452 my_report->susp_addr = susp_addr;
-
453 my_report->status = SCAN_SUSPICIOUS;
-
454 const bool isStatFilled = fillAreaStats(my_report);
-
455#ifndef NO_ENTROPY_CHECK
-
456 if (isStatFilled && (my_report->stats.entropy < ENTROPY_TRESHOLD)) {
-
457 my_report->status = SCAN_NOT_SUSPICIOUS;
-
458 }
-
459#endif
-
460 return true;
-
461}
+
439 AreaStatsCalculator calc(mem.loadedData);
+
440 return calc.fill(my_report->stats, nullptr);
+
441}
-
462
-
463// if extended info given, allow to filter out from the scan basing on the thread state and conditions
-
-
464bool should_scan_context(const util::thread_info& info)
-
465{
-
466 if (!info.is_extended) {
-
467 return true;
+
442
+
+
443bool pesieve::ThreadScanner::reportSuspiciousAddr(ThreadScanReport* my_report, ULONGLONG susp_addr)
+
444{
+
445 MEMORY_BASIC_INFORMATION page_info = { 0 };
+
446 if (!get_page_details(processHandle, (LPVOID)susp_addr, page_info)) {
+
447 return false;
+
448 }
+
449 if (page_info.State & MEM_FREE) {
+
450 return false;
+
451 }
+
452 ULONGLONG base = (ULONGLONG)page_info.BaseAddress;
+
453 if (this->info.is_extended) {
+
454 my_report->thread_state = info.ext.state;
+
455 my_report->thread_wait_reason = info.ext.wait_reason;
+
456 my_report->thread_wait_time = info.ext.wait_time;
+
457 }
+
458 my_report->module = (HMODULE)base;
+
459 my_report->moduleSize = page_info.RegionSize;
+
460 my_report->protection = page_info.AllocationProtect;
+
461
+
462 my_report->susp_addr = susp_addr;
+
463 my_report->status = SCAN_SUSPICIOUS;
+
464 const bool isStatFilled = fillAreaStats(my_report);
+
465#ifndef NO_ENTROPY_CHECK
+
466 if (isStatFilled && (my_report->stats.entropy < ENTROPY_TRESHOLD)) {
+
467 my_report->status = SCAN_NOT_SUSPICIOUS;
468 }
-
469 const KTHREAD_STATE state = (KTHREAD_STATE)info.ext.state;
-
470 if (state == Ready) {
-
471 return true;
-
472 }
-
473 if (state == Terminated) {
-
474 return false;
-
475 }
-
476 if (state == Waiting && info.ext.wait_reason <= WrQueue) {
+
469#endif
+
470 return true;
+
471}
+
+
472
+
473// if extended info given, allow to filter out from the scan basing on the thread state and conditions
+
+
474bool should_scan_context(const util::thread_info& info)
+
475{
+
476 if (!info.is_extended) {
477 return true;
478 }
-
479 return false;
-
480}
-
-
481
-
-
482bool pesieve::ThreadScanner::scanRemoteThreadCtx(HANDLE hThread, ThreadScanReport* my_report)
-
483{
-
484 const DWORD tid = GetThreadId(hThread);
-
485 ctx_details cDetails = { 0 };
-
486 const bool is_ok = fetchThreadCtxDetails(processHandle, hThread, cDetails);
-
487
-
488 if (!pesieve::is_thread_running(hThread)) {
-
489 my_report->status = SCAN_NOT_SUSPICIOUS;
-
490 return false;
-
491 }
-
492
-
493 if (!is_ok) {
-
494 // could not fetch the thread context and information
-
495 my_report->status = SCAN_ERROR;
-
496 return false;
-
497 }
-
498
-
499 bool is_shc = isAddrInShellcode(cDetails.rip);
-
500 if (is_shc) {
-
501 if (reportSuspiciousAddr(my_report, cDetails.rip)) {
-
502 if (my_report->status == SCAN_SUSPICIOUS) {
-
503 return true;
-
504 }
-
505 }
-
506 }
-
507
-
508 for (auto itr = cDetails.shcCandidates.begin(); itr != cDetails.shcCandidates.end(); ++itr) {
-
509 const ULONGLONG addr = *itr;
-
510#ifdef _SHOW_THREAD_INFO
-
511 std::cout << "Checking shc candidate: " << std::hex << addr << "\n";
-
512#endif //_SHOW_THREAD_INFO
-
513 //automatically verifies if the address is legit:
-
514 if (reportSuspiciousAddr(my_report, addr)) {
-
515 if (my_report->status == SCAN_SUSPICIOUS) {
-
516#ifdef _SHOW_THREAD_INFO
-
517 std::cout << "Found! " << std::hex << addr << "\n";
-
518#endif //_SHOW_THREAD_INFO
-
519 return true;
-
520 }
-
521 }
-
522 }
-
523
-
524 const bool hasEmptyGUI = has_empty_gui_info(tid);
-
525
-
526 if (this->info.is_extended && info.ext.state == Waiting && !cDetails.is_ret_in_frame)
-
527 {
-
528 const ULONGLONG ret_addr = cDetails.ret_on_stack;
-
529 is_shc = isAddrInShellcode(ret_addr);
-
530#ifdef _SHOW_THREAD_INFO
-
531 std::cout << "Return addr: " << std::hex << ret_addr << "\n";
-
532 printResolvedAddr(ret_addr);
-
533#endif //_SHOW_THREAD_INFO
-
534 if (is_shc && reportSuspiciousAddr(my_report, (ULONGLONG)ret_addr)) {
-
535 if (my_report->status == SCAN_SUSPICIOUS) {
-
536 return true;
-
537 }
-
538 my_report->status = SCAN_SUSPICIOUS;
-
539 my_report->stack_ptr = cDetails.rsp;
-
540 if (my_report->stats.entropy < 1) { // discard, do not dump
-
541 my_report->module = 0;
-
542 my_report->moduleSize = 0;
-
543 }
-
544 return true;
-
545 }
-
546 }
-
547 // other indicators of stack being corrupt:
-
548
-
549 bool isStackCorrupt = false;
-
550
-
551 if (this->info.is_extended && !cDetails.is_managed && !cDetails.is_ret_as_syscall)
-
552 {
-
553 isStackCorrupt = true;
-
554 }
-
555
-
556 if (hasEmptyGUI &&
-
557 cDetails.stackFramesCount == 1
-
558 && this->info.is_extended && info.ext.state == Waiting && info.ext.wait_reason == UserRequest)
-
559 {
-
560 isStackCorrupt = true;
-
561 }
-
562
-
563 if (isStackCorrupt) {
-
564 my_report->thread_state = info.ext.state;
-
565 my_report->thread_wait_reason = info.ext.wait_reason;
-
566 my_report->thread_wait_time = info.ext.wait_time;
-
567 my_report->stack_ptr = cDetails.rsp;
-
568 my_report->status = SCAN_SUSPICIOUS;
-
569 }
-
570 return true;
-
571}
+
479 const KTHREAD_STATE state = (KTHREAD_STATE)info.ext.state;
+
480 if (state == Ready) {
+
481 return true;
+
482 }
+
483 if (state == Terminated) {
+
484 return false;
+
485 }
+
486 if (state == Waiting && info.ext.wait_reason <= WrQueue) {
+
487 return true;
+
488 }
+
489 return false;
+
490}
+
491
+
+
492bool pesieve::ThreadScanner::scanRemoteThreadCtx(HANDLE hThread, ThreadScanReport* my_report)
+
493{
+
494 const DWORD tid = GetThreadId(hThread);
+
495 ctx_details cDetails = { 0 };
+
496 const bool is_ok = fetchThreadCtxDetails(processHandle, hThread, cDetails);
+
497
+
498 if (!pesieve::is_thread_running(hThread)) {
+
499 my_report->status = SCAN_NOT_SUSPICIOUS;
+
500 return false;
+
501 }
+
502
+
503 if (!is_ok) {
+
504 // could not fetch the thread context and information
+
505 my_report->status = SCAN_ERROR;
+
506 return false;
+
507 }
+
508
+
509 bool is_shc = isAddrInShellcode(cDetails.rip);
+
510 if (is_shc) {
+
511 if (reportSuspiciousAddr(my_report, cDetails.rip)) {
+
512 if (my_report->status == SCAN_SUSPICIOUS) {
+
513 return true;
+
514 }
+
515 }
+
516 }
+
517
+
518 for (auto itr = cDetails.shcCandidates.begin(); itr != cDetails.shcCandidates.end(); ++itr) {
+
519 const ULONGLONG addr = *itr;
+
520#ifdef _SHOW_THREAD_INFO
+
521 std::cout << "Checking shc candidate: " << std::hex << addr << "\n";
+
522#endif //_SHOW_THREAD_INFO
+
523 //automatically verifies if the address is legit:
+
524 if (reportSuspiciousAddr(my_report, addr)) {
+
525 if (my_report->status == SCAN_SUSPICIOUS) {
+
526#ifdef _SHOW_THREAD_INFO
+
527 std::cout << "Found! " << std::hex << addr << "\n";
+
528#endif //_SHOW_THREAD_INFO
+
529 return true;
+
530 }
+
531 }
+
532 }
+
533
+
534 const bool hasEmptyGUI = has_empty_gui_info(tid);
+
535
+
536 if (this->info.is_extended && info.ext.state == Waiting && !cDetails.is_ret_in_frame)
+
537 {
+
538 const ULONGLONG ret_addr = cDetails.ret_on_stack;
+
539 is_shc = isAddrInShellcode(ret_addr);
+
540#ifdef _SHOW_THREAD_INFO
+
541 std::cout << "Return addr: " << std::hex << ret_addr << "\n";
+
542 printResolvedAddr(ret_addr);
+
543#endif //_SHOW_THREAD_INFO
+
544 if (is_shc && reportSuspiciousAddr(my_report, (ULONGLONG)ret_addr)) {
+
545 if (my_report->status == SCAN_SUSPICIOUS) {
+
546 return true;
+
547 }
+
548 my_report->status = SCAN_SUSPICIOUS;
+
549 my_report->stack_ptr = cDetails.rsp;
+
550 if (my_report->stats.entropy < 1) { // discard, do not dump
+
551 my_report->module = 0;
+
552 my_report->moduleSize = 0;
+
553 }
+
554 return true;
+
555 }
+
556 }
+
557 // other indicators of stack being corrupt:
+
558
+
559 bool isStackCorrupt = false;
+
560
+
561 if (this->info.is_extended && !cDetails.is_managed && !cDetails.is_ret_as_syscall)
+
562 {
+
563 isStackCorrupt = true;
+
564 }
+
565
+
566 if (hasEmptyGUI &&
+
567 cDetails.stackFramesCount == 1
+
568 && this->info.is_extended && info.ext.state == Waiting && info.ext.wait_reason == UserRequest)
+
569 {
+
570 isStackCorrupt = true;
+
571 }
572
-
573
-
-
574ThreadScanReport* pesieve::ThreadScanner::scanRemote()
-
575{
-
576 if (GetCurrentThreadId() == info.tid) {
-
577 return nullptr; // do not scan your own thread
-
578 }
-
579 ThreadScanReport* my_report = new (std::nothrow) ThreadScanReport(info.tid);
-
580 if (!my_report) {
-
581 return nullptr;
-
582 }
-
583#ifdef _SHOW_THREAD_INFO
-
584 printThreadInfo(info);
-
585#endif // _SHOW_THREAD_INFO
-
586
-
587 bool is_shc = isAddrInShellcode(info.start_addr);
-
588 if (is_shc) {
-
589 if (reportSuspiciousAddr(my_report, info.start_addr)) {
-
590 if (my_report->status == SCAN_SUSPICIOUS) {
-
591 return my_report;
-
592 }
-
593 }
-
594 }
-
595 if (!should_scan_context(info)) {
-
596 my_report->status = SCAN_NOT_SUSPICIOUS;
-
597 return my_report;
-
598 }
-
599 // proceed with detailed checks:
-
600 HANDLE hThread = OpenThread(
-
601 THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION | SYNCHRONIZE,
-
602 FALSE,
-
603 info.tid
-
604 );
-
605 if (!hThread) {
-
606#ifdef _DEBUG
-
607 std::cerr << "[-] Could not OpenThread. Error: " << GetLastError() << std::endl;
-
608#endif
-
609 my_report->status = SCAN_ERROR;
-
610 return my_report;
-
611 }
-
612 scanRemoteThreadCtx(hThread, my_report);
-
613 CloseHandle(hThread);
-
614 return my_report;
-
615}
+
573 if (isStackCorrupt) {
+
574 my_report->thread_state = info.ext.state;
+
575 my_report->thread_wait_reason = info.ext.wait_reason;
+
576 my_report->thread_wait_time = info.ext.wait_time;
+
577 my_report->stack_ptr = cDetails.rsp;
+
578 my_report->status = SCAN_SUSPICIOUS;
+
579 }
+
580 return true;
+
581}
+
+
582
+
583
+
+
584ThreadScanReport* pesieve::ThreadScanner::scanRemote()
+
585{
+
586 if (GetCurrentThreadId() == info.tid) {
+
587 return nullptr; // do not scan your own thread
+
588 }
+
589 ThreadScanReport* my_report = new (std::nothrow) ThreadScanReport(info.tid);
+
590 if (!my_report) {
+
591 return nullptr;
+
592 }
+
593#ifdef _SHOW_THREAD_INFO
+
594 printThreadInfo(info);
+
595#endif // _SHOW_THREAD_INFO
+
596
+
597 bool is_shc = isAddrInShellcode(info.start_addr);
+
598 if (is_shc) {
+
599 if (reportSuspiciousAddr(my_report, info.start_addr)) {
+
600 if (my_report->status == SCAN_SUSPICIOUS) {
+
601 return my_report;
+
602 }
+
603 }
+
604 }
+
605 if (!should_scan_context(info)) {
+
606 my_report->status = SCAN_NOT_SUSPICIOUS;
+
607 return my_report;
+
608 }
+
609 // proceed with detailed checks:
+
610 HANDLE hThread = OpenThread(
+
611 THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION | SYNCHRONIZE,
+
612 FALSE,
+
613 info.tid
+
614 );
+
615 if (!hThread) {
+
616#ifdef _DEBUG
+
617 std::cerr << "[-] Could not OpenThread. Error: " << GetLastError() << std::endl;
+
618#endif
+
619 my_report->status = SCAN_ERROR;
+
620 return my_report;
+
621 }
+
622 scanRemoteThreadCtx(hThread, my_report);
+
623 CloseHandle(hThread);
+
624 return my_report;
+
625}
pesieve::AreaStatsCalculator
A class responsible for filling in the statistics with the data from the particular buffer.
Definition stats.h:73
@@ -767,25 +777,26 @@ -
pesieve::ThreadScanReport::translate_wait_reason
static std::string translate_wait_reason(DWORD thread_wait_reason)
Definition thread_scanner.cpp:135
+
pesieve::ThreadScanReport::translate_wait_reason
static std::string translate_wait_reason(DWORD thread_wait_reason)
Definition thread_scanner.cpp:136
-
pesieve::ThreadScanReport::translate_thread_state
static std::string translate_thread_state(DWORD thread_state)
Definition thread_scanner.cpp:151
+
pesieve::ThreadScanReport::translate_thread_state
static std::string translate_thread_state(DWORD thread_state)
Definition thread_scanner.cpp:152
-
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:574
-
pesieve::ThreadScanner::reportSuspiciousAddr
bool reportSuspiciousAddr(ThreadScanReport *my_report, ULONGLONG susp_addr)
Definition thread_scanner.cpp:433
-
pesieve::ThreadScanner::fillCallStackInfo
size_t fillCallStackInfo(IN HANDLE hProcess, IN HANDLE hThread, IN LPVOID ctx, IN OUT ctx_details &cDetails)
Definition thread_scanner.cpp:268
-
pesieve::ThreadScanner::printThreadInfo
void printThreadInfo(const util::thread_info &threadi)
Definition thread_scanner.cpp:399
-
pesieve::ThreadScanner::fillAreaStats
bool fillAreaStats(ThreadScanReport *my_report)
Definition thread_scanner.cpp:420
-
pesieve::ThreadScanner::isAddrInShellcode
bool isAddrInShellcode(ULONGLONG addr)
Definition thread_scanner.cpp:357
-
pesieve::ThreadScanner::analyzeCallStack
size_t analyzeCallStack(IN const std::vector< ULONGLONG > stack_frame, IN OUT ctx_details &cDetails)
Definition thread_scanner.cpp:212
-
pesieve::ThreadScanner::fetchThreadCtxDetails
bool fetchThreadCtxDetails(IN HANDLE hProcess, IN HANDLE hThread, OUT ctx_details &c)
Definition thread_scanner.cpp:318
-
pesieve::ThreadScanner::printResolvedAddr
bool printResolvedAddr(ULONGLONG addr)
Definition thread_scanner.cpp:369
-
pesieve::ThreadScanner::scanRemoteThreadCtx
bool scanRemoteThreadCtx(HANDLE hThread, ThreadScanReport *my_report)
Definition thread_scanner.cpp:482
-
pesieve::ThreadScanner::checkReturnAddrIntegrity
bool checkReturnAddrIntegrity(IN const std::vector< ULONGLONG > &callStack)
Definition thread_scanner.cpp:172
+
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:584
+
pesieve::ThreadScanner::reportSuspiciousAddr
bool reportSuspiciousAddr(ThreadScanReport *my_report, ULONGLONG susp_addr)
Definition thread_scanner.cpp:443
+
pesieve::ThreadScanner::fillCallStackInfo
size_t fillCallStackInfo(IN HANDLE hProcess, IN HANDLE hThread, IN LPVOID ctx, IN OUT ctx_details &cDetails)
Definition thread_scanner.cpp:278
+
pesieve::ThreadScanner::printThreadInfo
void printThreadInfo(const util::thread_info &threadi)
Definition thread_scanner.cpp:409
+
pesieve::ThreadScanner::fillAreaStats
bool fillAreaStats(ThreadScanReport *my_report)
Definition thread_scanner.cpp:430
+
pesieve::ThreadScanner::isAddrInShellcode
bool isAddrInShellcode(ULONGLONG addr)
Definition thread_scanner.cpp:367
+
pesieve::ThreadScanner::analyzeCallStack
size_t analyzeCallStack(IN const std::vector< ULONGLONG > stack_frame, IN OUT ctx_details &cDetails)
Definition thread_scanner.cpp:222
+
pesieve::ThreadScanner::fetchThreadCtxDetails
bool fetchThreadCtxDetails(IN HANDLE hProcess, IN HANDLE hThread, OUT ctx_details &c)
Definition thread_scanner.cpp:328
+
pesieve::ThreadScanner::printResolvedAddr
bool printResolvedAddr(ULONGLONG addr)
Definition thread_scanner.cpp:379
+
pesieve::ThreadScanner::scanRemoteThreadCtx
bool scanRemoteThreadCtx(HANDLE hThread, ThreadScanReport *my_report)
Definition thread_scanner.cpp:492
+
pesieve::ThreadScanner::checkReturnAddrIntegrity
bool checkReturnAddrIntegrity(IN const std::vector< ULONGLONG > &callStack)
Definition thread_scanner.cpp:173
mempage_data.h
pesieve::util::is_process_wow64
BOOL is_process_wow64(IN HANDLE processHandle, OUT BOOL *isProcWow64)
Definition process_util.cpp:27
-
pesieve::util::wow64_get_thread_context
BOOL wow64_get_thread_context(IN HANDLE hThread, IN OUT PWOW64_CONTEXT lpContext)
Definition process_util.cpp:73
+
pesieve::util::is_current_wow64
bool is_current_wow64()
Definition process_util.cpp:73
+
pesieve::util::wow64_get_thread_context
BOOL wow64_get_thread_context(IN HANDLE hThread, IN OUT PWOW64_CONTEXT lpContext)
Definition process_util.cpp:86
@@ -830,13 +841,13 @@
pesieve::util::_thread_info::is_extended
bool is_extended
Definition threads_util.h:41
pesieve::util::_thread_info::ext
thread_info_ext ext
Definition threads_util.h:42
syscall_extractor.h
-
has_empty_gui_info
bool has_empty_gui_info(DWORD tid)
Definition thread_scanner.cpp:118
+
has_empty_gui_info
bool has_empty_gui_info(DWORD tid)
Definition thread_scanner.cpp:119
t_stack_enum_params
struct _t_stack_enum_params t_stack_enum_params
-
get_page_details
bool get_page_details(HANDLE processHandle, LPVOID start_va, MEMORY_BASIC_INFORMATION &page_info)
Definition thread_scanner.cpp:56
-
read_return_ptr
bool read_return_ptr(IN HANDLE hProcess, IN OUT ctx_details &cDetails)
Definition thread_scanner.cpp:308
-
enum_stack_thread
DWORD WINAPI enum_stack_thread(LPVOID lpParam)
Definition thread_scanner.cpp:69
+
get_page_details
bool get_page_details(HANDLE processHandle, LPVOID start_va, MEMORY_BASIC_INFORMATION &page_info)
Definition thread_scanner.cpp:57
+
read_return_ptr
bool read_return_ptr(IN HANDLE hProcess, IN OUT ctx_details &cDetails)
Definition thread_scanner.cpp:318
+
enum_stack_thread
DWORD WINAPI enum_stack_thread(LPVOID lpParam)
Definition thread_scanner.cpp:70
ENTROPY_TRESHOLD
#define ENTROPY_TRESHOLD
Definition thread_scanner.cpp:12
-
should_scan_context
bool should_scan_context(const util::thread_info &info)
Definition thread_scanner.cpp:464
+
should_scan_context
bool should_scan_context(const util::thread_info &info)
Definition thread_scanner.cpp:474
g_SyscallTable
pesieve::SyscallTable g_SyscallTable
Definition pe_sieve.cpp:24
thread_scanner.h
INVALID_SYSCALL
#define INVALID_SYSCALL
Definition threads_util.h:6
diff --git a/thread__scanner_8h_source.html b/thread__scanner_8h_source.html index 9155499ca..bb320319c 100644 --- a/thread__scanner_8h_source.html +++ b/thread__scanner_8h_source.html @@ -284,32 +284,32 @@
pesieve::ThreadScanReport::fieldsToJSON
virtual const void fieldsToJSON(std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails)
Definition thread_scanner.h:34
-
pesieve::ThreadScanReport::translate_wait_reason
static std::string translate_wait_reason(DWORD thread_wait_reason)
Definition thread_scanner.cpp:135
+
pesieve::ThreadScanReport::translate_wait_reason
static std::string translate_wait_reason(DWORD thread_wait_reason)
Definition thread_scanner.cpp:136
pesieve::ThreadScanReport::THREAD_STATE_UNKNOWN
static const DWORD THREAD_STATE_UNKNOWN
Definition thread_scanner.h:18
pesieve::ThreadScanReport::THREAD_STATE_WAITING
static const DWORD THREAD_STATE_WAITING
Definition thread_scanner.h:19
pesieve::ThreadScanReport::toJSON
virtual const bool toJSON(std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails)
Definition thread_scanner.h:77
-
pesieve::ThreadScanReport::translate_thread_state
static std::string translate_thread_state(DWORD thread_state)
Definition thread_scanner.cpp:151
+
pesieve::ThreadScanReport::translate_thread_state
static std::string translate_thread_state(DWORD thread_state)
Definition thread_scanner.cpp:152
pesieve::ThreadScanner::ThreadScanner
ThreadScanner(HANDLE hProc, bool _isReflection, const util::thread_info &_info, ModulesInfo &_modulesInfo, peconv::ExportsMapper *_exportsMap, ProcessSymbolsManager *_symbols)
Definition thread_scanner.h:132
-
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:574
-
pesieve::ThreadScanner::reportSuspiciousAddr
bool reportSuspiciousAddr(ThreadScanReport *my_report, ULONGLONG susp_addr)
Definition thread_scanner.cpp:433
-
pesieve::ThreadScanner::fillCallStackInfo
size_t fillCallStackInfo(IN HANDLE hProcess, IN HANDLE hThread, IN LPVOID ctx, IN OUT ctx_details &cDetails)
Definition thread_scanner.cpp:268
-
pesieve::ThreadScanner::printThreadInfo
void printThreadInfo(const util::thread_info &threadi)
Definition thread_scanner.cpp:399
-
pesieve::ThreadScanner::fillAreaStats
bool fillAreaStats(ThreadScanReport *my_report)
Definition thread_scanner.cpp:420
-
pesieve::ThreadScanner::isAddrInShellcode
bool isAddrInShellcode(ULONGLONG addr)
Definition thread_scanner.cpp:357
+
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:584
+
pesieve::ThreadScanner::reportSuspiciousAddr
bool reportSuspiciousAddr(ThreadScanReport *my_report, ULONGLONG susp_addr)
Definition thread_scanner.cpp:443
+
pesieve::ThreadScanner::fillCallStackInfo
size_t fillCallStackInfo(IN HANDLE hProcess, IN HANDLE hThread, IN LPVOID ctx, IN OUT ctx_details &cDetails)
Definition thread_scanner.cpp:278
+
pesieve::ThreadScanner::printThreadInfo
void printThreadInfo(const util::thread_info &threadi)
Definition thread_scanner.cpp:409
+
pesieve::ThreadScanner::fillAreaStats
bool fillAreaStats(ThreadScanReport *my_report)
Definition thread_scanner.cpp:430
+
pesieve::ThreadScanner::isAddrInShellcode
bool isAddrInShellcode(ULONGLONG addr)
Definition thread_scanner.cpp:367
pesieve::ThreadScanner::exportsMap
peconv::ExportsMapper * exportsMap
Definition thread_scanner.h:155
pesieve::ThreadScanner::info
const util::thread_info & info
Definition thread_scanner.h:153
-
pesieve::ThreadScanner::analyzeCallStack
size_t analyzeCallStack(IN const std::vector< ULONGLONG > stack_frame, IN OUT ctx_details &cDetails)
Definition thread_scanner.cpp:212
-
pesieve::ThreadScanner::fetchThreadCtxDetails
bool fetchThreadCtxDetails(IN HANDLE hProcess, IN HANDLE hThread, OUT ctx_details &c)
Definition thread_scanner.cpp:318
-
pesieve::ThreadScanner::printResolvedAddr
bool printResolvedAddr(ULONGLONG addr)
Definition thread_scanner.cpp:369
+
pesieve::ThreadScanner::analyzeCallStack
size_t analyzeCallStack(IN const std::vector< ULONGLONG > stack_frame, IN OUT ctx_details &cDetails)
Definition thread_scanner.cpp:222
+
pesieve::ThreadScanner::fetchThreadCtxDetails
bool fetchThreadCtxDetails(IN HANDLE hProcess, IN HANDLE hThread, OUT ctx_details &c)
Definition thread_scanner.cpp:328
+
pesieve::ThreadScanner::printResolvedAddr
bool printResolvedAddr(ULONGLONG addr)
Definition thread_scanner.cpp:379
pesieve::ThreadScanner::symbols
ProcessSymbolsManager * symbols
Definition thread_scanner.h:156
-
pesieve::ThreadScanner::scanRemoteThreadCtx
bool scanRemoteThreadCtx(HANDLE hThread, ThreadScanReport *my_report)
Definition thread_scanner.cpp:482
+
pesieve::ThreadScanner::scanRemoteThreadCtx
bool scanRemoteThreadCtx(HANDLE hThread, ThreadScanReport *my_report)
Definition thread_scanner.cpp:492
-
pesieve::ThreadScanner::checkReturnAddrIntegrity
bool checkReturnAddrIntegrity(IN const std::vector< ULONGLONG > &callStack)
Definition thread_scanner.cpp:172
+
pesieve::ThreadScanner::checkReturnAddrIntegrity
bool checkReturnAddrIntegrity(IN const std::vector< ULONGLONG > &callStack)
Definition thread_scanner.cpp:173
pesieve.t_json_level
Definition pesieve.py:82
entropy_stats.h
OUT_PADDED
#define OUT_PADDED(stream, field_size, str)
Definition format_util.h:12