[FEATURE] Updated pe-sieve. Added new argument: sym

hh_ver_short.h

@@ -3,6 +3,6 @@
 #define HH_MAJOR_VERSION 0
 #define HH_MINOR_VERSION 4
 #define HH_MICRO_VERSION 1
-#define HH_PATCH_VERSION 2
+#define HH_PATCH_VERSION 3
 
-#define HH_VERSION_STR	"0.4.1.2"
+#define HH_VERSION_STR	"0.4.1.3"

hollows_hunter.manifest

@@ -9,7 +9,6 @@
 	</dependency>
 	<file name="tdh.dll" loadFrom="%SystemRoot%\System32\"></file>
 	<file name="imagehlp.dll" loadFrom="%SystemRoot%\System32\"></file>
-	<file name="dbghelp.dll" loadFrom="%SystemRoot%\System32\"></file>
 	<file name="USERENV.dll" loadFrom="%SystemRoot%\System32\"></file>
 	<file name="VERSION.dll" loadFrom="%SystemRoot%\System32\"></file>
 	<file name="oleaut32.dll" loadFrom="%SystemRoot%\System32\"></file>

main.cpp

@@ -85,6 +85,8 @@ t_pesieve_res deploy_scan()
 
 int main(int argc, char *argv[])
 {
+    SetDefaultDllDirectories(LOAD_LIBRARY_SEARCH_SYSTEM32 | LOAD_LIBRARY_SEARCH_USER_DIRS);
+
     g_hh_args.init();
 
     bool info_req = false;

params_info/params.h

@@ -30,6 +30,7 @@ using namespace pesieve;
 #define PARAM_REFLECTION "refl"
 #define PARAM_CACHE "cache"
 #define PARAM_DOTNET_POLICY "dnet"
+#define PARAM_SYMBOLS "sym"
 #define PARAM_PTIMES "ptimes"
 
 //dump options:
@@ -296,6 +297,9 @@ public:
             }
         }
 
+        this->addParam(new BoolParam(PARAM_SYMBOLS, false));
+        this->setInfo(PARAM_SYMBOLS, "Autodownload symbols for scanned modules.");
+
         this->addParam(new StringParam(PARAM_PATTERN, false));
         this->setInfo(PARAM_PATTERN, "Set additional shellcode patterns (file in the SIG format).");
 
@@ -350,6 +354,7 @@ public:
         this->addGroup(new ParamGroup(str_group));
         this->addParamToGroup(PARAM_QUIET, str_group);
         this->addParamToGroup(PARAM_REFLECTION, str_group);
+        this->addParamToGroup(PARAM_SYMBOLS, str_group);
         this->addParamToGroup(PARAM_CACHE, str_group);
         this->addParamToGroup(PARAM_LOOP, str_group);
 
@@ -551,6 +556,8 @@ protected:
         copyVal<EnumParam>(PARAM_DUMP_MODE, ps.dump_mode);
 
         fillStringParam(PARAM_PATTERN, ps.pattern_file);
+
+        copyVal<BoolParam>(PARAM_SYMBOLS, ps.download_symbols);
     }
 
 };