|
|
|
@@ -95,471 +95,384 @@ $(function() { codefold.init(0); });
|
|
|
|
|
<div class="line"><a id="l00012" name="l00012"></a><span class="lineno"> 12</span><span class="preprocessor">#include "<a class="code" href="suspend_8h.html">util/suspend.h</a>"</span></div>
|
|
|
|
|
<div class="line"><a id="l00013" name="l00013"></a><span class="lineno"> 13</span><span class="preprocessor">#include "<a class="code" href="time__util_8h.html">util/time_util.h</a>"</span></div>
|
|
|
|
|
<div class="line"><a id="l00014" name="l00014"></a><span class="lineno"> 14</span><span class="preprocessor">#include "<a class="code" href="term__util_8h.html">term_util.h</a>"</span></div>
|
|
|
|
|
<div class="line"><a id="l00015" name="l00015"></a><span class="lineno"> 15</span> </div>
|
|
|
|
|
<div class="line"><a id="l00016" name="l00016"></a><span class="lineno"> 16</span><span class="preprocessor">#include <paramkit.h></span></div>
|
|
|
|
|
<div class="line"><a id="l00017" name="l00017"></a><span class="lineno"> 17</span> </div>
|
|
|
|
|
<div class="line"><a id="l00018" name="l00018"></a><span class="lineno"><a class="line" href="hh__scanner_8cpp.html#ac02ff12a84f72a554a357650a1631c2f"> 18</a></span><span class="preprocessor">#define PID_FIELD_SIZE 4</span></div>
|
|
|
|
|
<div class="line"><a id="l00019" name="l00019"></a><span class="lineno"> 19</span> </div>
|
|
|
|
|
<div class="line"><a id="l00020" name="l00020"></a><span class="lineno"> 20</span><span class="keyword">using namespace </span>pesieve;</div>
|
|
|
|
|
<div class="line"><a id="l00021" name="l00021"></a><span class="lineno"> 21</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00022" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00022" name="l00022"></a><span class="lineno"><a class="line" href="namespaceprocess__util.html"> 22</a></span><span class="keyword">namespace </span><a class="code hl_namespace" href="namespaceprocess__util.html">process_util</a> {</div>
|
|
|
|
|
<div class="line"><a id="l00023" name="l00023"></a><span class="lineno"> 23</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00024" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00024" name="l00024"></a><span class="lineno"><a class="line" href="namespaceprocess__util.html#a1550838f32323b66051e0d05a0acdb01"> 24</a></span> <span class="keywordtype">bool</span> <a class="code hl_function" href="namespaceprocess__util.html#a1550838f32323b66051e0d05a0acdb01">is_wow_64</a>(HANDLE process)</div>
|
|
|
|
|
<div class="line"><a id="l00025" name="l00025"></a><span class="lineno"> 25</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00026" name="l00026"></a><span class="lineno"> 26</span> FARPROC procPtr = GetProcAddress(GetModuleHandleA(<span class="stringliteral">"kernel32"</span>), <span class="stringliteral">"IsWow64Process"</span>);</div>
|
|
|
|
|
<div class="line"><a id="l00027" name="l00027"></a><span class="lineno"> 27</span> <span class="keywordflow">if</span> (!procPtr) {</div>
|
|
|
|
|
<div class="line"><a id="l00028" name="l00028"></a><span class="lineno"> 28</span> <span class="comment">//this system does not have a function IsWow64Process</span></div>
|
|
|
|
|
<div class="line"><a id="l00029" name="l00029"></a><span class="lineno"> 29</span> <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00030" name="l00030"></a><span class="lineno"> 30</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00031" name="l00031"></a><span class="lineno"> 31</span> BOOL(WINAPI * is_process_wow64)(IN HANDLE, OUT PBOOL)</div>
|
|
|
|
|
<div class="line"><a id="l00032" name="l00032"></a><span class="lineno"> 32</span> = (BOOL(WINAPI*)(IN HANDLE, OUT PBOOL))procPtr;</div>
|
|
|
|
|
<div class="line"><a id="l00033" name="l00033"></a><span class="lineno"> 33</span> </div>
|
|
|
|
|
<div class="line"><a id="l00034" name="l00034"></a><span class="lineno"> 34</span> BOOL isCurrWow64 = FALSE;</div>
|
|
|
|
|
<div class="line"><a id="l00035" name="l00035"></a><span class="lineno"> 35</span> <span class="keywordflow">if</span> (!is_process_wow64(process, &isCurrWow64)) {</div>
|
|
|
|
|
<div class="line"><a id="l00036" name="l00036"></a><span class="lineno"> 36</span> <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00037" name="l00037"></a><span class="lineno"> 37</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00038" name="l00038"></a><span class="lineno"> 38</span> <span class="keywordflow">return</span> isCurrWow64 ? true : <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00039" name="l00039"></a><span class="lineno"> 39</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00015" name="l00015"></a><span class="lineno"> 15</span><span class="preprocessor">#include "<a class="code" href="process__util_8h.html">util/process_util.h</a>"</span></div>
|
|
|
|
|
<div class="line"><a id="l00016" name="l00016"></a><span class="lineno"> 16</span> </div>
|
|
|
|
|
<div class="line"><a id="l00017" name="l00017"></a><span class="lineno"> 17</span><span class="preprocessor">#include <paramkit.h></span></div>
|
|
|
|
|
<div class="line"><a id="l00018" name="l00018"></a><span class="lineno"> 18</span> </div>
|
|
|
|
|
<div class="line"><a id="l00019" name="l00019"></a><span class="lineno"><a class="line" href="hh__scanner_8cpp.html#ac02ff12a84f72a554a357650a1631c2f"> 19</a></span><span class="preprocessor">#define PID_FIELD_SIZE 4</span></div>
|
|
|
|
|
<div class="line"><a id="l00020" name="l00020"></a><span class="lineno"> 20</span> </div>
|
|
|
|
|
<div class="line"><a id="l00021" name="l00021"></a><span class="lineno"> 21</span><span class="keyword">using namespace </span>pesieve;</div>
|
|
|
|
|
<div class="line"><a id="l00022" name="l00022"></a><span class="lineno"> 22</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00023" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00023" name="l00023"></a><span class="lineno"><a class="line" href="namespacefiles__util.html"> 23</a></span><span class="keyword">namespace </span><a class="code hl_namespace" href="namespacefiles__util.html">files_util</a> {</div>
|
|
|
|
|
<div class="line"><a id="l00024" name="l00024"></a><span class="lineno"> 24</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00025" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00025" name="l00025"></a><span class="lineno"><a class="line" href="namespacefiles__util.html#a9a7fcfd84189964e87c1b572f1fe8fbe"> 25</a></span> std::string <a class="code hl_function" href="namespacefiles__util.html#a9a7fcfd84189964e87c1b572f1fe8fbe">join_path</a>(<span class="keyword">const</span> std::string &baseDir, <span class="keyword">const</span> std::string &subpath)</div>
|
|
|
|
|
<div class="line"><a id="l00026" name="l00026"></a><span class="lineno"> 26</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00027" name="l00027"></a><span class="lineno"> 27</span> std::stringstream stream;</div>
|
|
|
|
|
<div class="line"><a id="l00028" name="l00028"></a><span class="lineno"> 28</span> <span class="keywordflow">if</span> (baseDir.length() > 0) {</div>
|
|
|
|
|
<div class="line"><a id="l00029" name="l00029"></a><span class="lineno"> 29</span> stream << baseDir;</div>
|
|
|
|
|
<div class="line"><a id="l00030" name="l00030"></a><span class="lineno"> 30</span> stream << <span class="stringliteral">"\\"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00031" name="l00031"></a><span class="lineno"> 31</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00032" name="l00032"></a><span class="lineno"> 32</span> stream << subpath;</div>
|
|
|
|
|
<div class="line"><a id="l00033" name="l00033"></a><span class="lineno"> 33</span> <span class="keywordflow">return</span> stream.str();</div>
|
|
|
|
|
<div class="line"><a id="l00034" name="l00034"></a><span class="lineno"> 34</span> }</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00035" name="l00035"></a><span class="lineno"> 35</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00036" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00036" name="l00036"></a><span class="lineno"><a class="line" href="namespacefiles__util.html#a9c2cf1240e4b850893c4e7a0a2ab641b"> 36</a></span> std::string <a class="code hl_function" href="namespacefiles__util.html#a9c2cf1240e4b850893c4e7a0a2ab641b">make_dir_name</a>(std::string baseDir, time_t timestamp)</div>
|
|
|
|
|
<div class="line"><a id="l00037" name="l00037"></a><span class="lineno"> 37</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00038" name="l00038"></a><span class="lineno"> 38</span> std::stringstream stream;</div>
|
|
|
|
|
<div class="line"><a id="l00039" name="l00039"></a><span class="lineno"> 39</span> <span class="keywordflow">if</span> (baseDir.length() > 0) {</div>
|
|
|
|
|
<div class="line"><a id="l00040" name="l00040"></a><span class="lineno"> 40</span> stream << baseDir;</div>
|
|
|
|
|
<div class="line"><a id="l00041" name="l00041"></a><span class="lineno"> 41</span> stream << <span class="stringliteral">"\\"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00042" name="l00042"></a><span class="lineno"> 42</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00043" name="l00043"></a><span class="lineno"> 43</span> stream << <span class="stringliteral">"scan_"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00044" name="l00044"></a><span class="lineno"> 44</span> stream << timestamp;</div>
|
|
|
|
|
<div class="line"><a id="l00045" name="l00045"></a><span class="lineno"> 45</span> <span class="keywordflow">return</span> stream.str();</div>
|
|
|
|
|
<div class="line"><a id="l00046" name="l00046"></a><span class="lineno"> 46</span> }</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00040" name="l00040"></a><span class="lineno"> 40</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00041" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00041" name="l00041"></a><span class="lineno"><a class="line" href="namespaceprocess__util.html#a4a258bf9fcaf9b1f5b6419f4e6a5d1e1"> 41</a></span> <span class="keywordtype">bool</span> <a class="code hl_function" href="namespaceprocess__util.html#a4a258bf9fcaf9b1f5b6419f4e6a5d1e1">get_process_info</a>(DWORD processID, <span class="keywordtype">bool</span> &isWow64, <span class="keywordtype">char</span>* szProcessName, DWORD processNameSize)</div>
|
|
|
|
|
<div class="line"><a id="l00042" name="l00042"></a><span class="lineno"> 42</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00043" name="l00043"></a><span class="lineno"> 43</span> HANDLE hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_VM_READ, FALSE, processID);</div>
|
|
|
|
|
<div class="line"><a id="l00044" name="l00044"></a><span class="lineno"> 44</span> <span class="keywordflow">if</span> (!hProcess) {</div>
|
|
|
|
|
<div class="line"><a id="l00045" name="l00045"></a><span class="lineno"> 45</span> <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00046" name="l00046"></a><span class="lineno"> 46</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00047" name="l00047"></a><span class="lineno"> 47</span> </div>
|
|
|
|
|
<div class="line"><a id="l00048" name="l00048"></a><span class="lineno"> 48</span> <span class="keywordtype">bool</span> is_ok = <span class="keyword">true</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00049" name="l00049"></a><span class="lineno"> 49</span> <span class="keywordflow">if</span> (szProcessName && processNameSize > 0) {</div>
|
|
|
|
|
<div class="line"><a id="l00050" name="l00050"></a><span class="lineno"> 50</span> DWORD cbNeeded = 0;</div>
|
|
|
|
|
<div class="line"><a id="l00051" name="l00051"></a><span class="lineno"> 51</span> HMODULE hMod = <span class="keyword">nullptr</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00052" name="l00052"></a><span class="lineno"> 52</span> memset(szProcessName, 0, processNameSize);</div>
|
|
|
|
|
<div class="line"><a id="l00053" name="l00053"></a><span class="lineno"> 53</span> <span class="keywordflow">if</span> (EnumProcessModules(hProcess, &hMod, <span class="keyword">sizeof</span>(hMod), &cbNeeded)) {</div>
|
|
|
|
|
<div class="line"><a id="l00054" name="l00054"></a><span class="lineno"> 54</span> GetModuleBaseNameA(hProcess, hMod, szProcessName, processNameSize);</div>
|
|
|
|
|
<div class="line"><a id="l00055" name="l00055"></a><span class="lineno"> 55</span> } <span class="keywordflow">else</span> { is_ok = <span class="keyword">false</span>; }</div>
|
|
|
|
|
<div class="line"><a id="l00056" name="l00056"></a><span class="lineno"> 56</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00057" name="l00057"></a><span class="lineno"> 57</span> isWow64 = <a class="code hl_function" href="namespaceprocess__util.html#a1550838f32323b66051e0d05a0acdb01">is_wow_64</a>(hProcess);</div>
|
|
|
|
|
<div class="line"><a id="l00058" name="l00058"></a><span class="lineno"> 58</span> CloseHandle(hProcess);</div>
|
|
|
|
|
<div class="line"><a id="l00059" name="l00059"></a><span class="lineno"> 59</span> <span class="keywordflow">return</span> is_ok;</div>
|
|
|
|
|
<div class="foldopen" id="foldopen00048" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00048" name="l00048"></a><span class="lineno"><a class="line" href="namespacefiles__util.html#abab65a3cbe43de11dd5d25ed5e4d47e5"> 48</a></span> <span class="keywordtype">bool</span> <a class="code hl_function" href="namespacefiles__util.html#abab65a3cbe43de11dd5d25ed5e4d47e5">set_output_dir</a>(t_params &args, <span class="keyword">const</span> std::string &new_dir)</div>
|
|
|
|
|
<div class="line"><a id="l00049" name="l00049"></a><span class="lineno"> 49</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00050" name="l00050"></a><span class="lineno"> 50</span> <span class="keyword">const</span> <span class="keywordtype">size_t</span> new_len = new_dir.length();</div>
|
|
|
|
|
<div class="line"><a id="l00051" name="l00051"></a><span class="lineno"> 51</span> <span class="keywordflow">if</span> (!new_len) <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00052" name="l00052"></a><span class="lineno"> 52</span> </div>
|
|
|
|
|
<div class="line"><a id="l00053" name="l00053"></a><span class="lineno"> 53</span> <span class="keyword">const</span> <span class="keywordtype">char</span>* new_dir_cstr = new_dir.c_str();</div>
|
|
|
|
|
<div class="line"><a id="l00054" name="l00054"></a><span class="lineno"> 54</span> <span class="keywordtype">size_t</span> buffer_len = <span class="keyword">sizeof</span>(args.output_dir) - 1; <span class="comment">//leave one char for '\0'</span></div>
|
|
|
|
|
<div class="line"><a id="l00055" name="l00055"></a><span class="lineno"> 55</span> <span class="keywordflow">if</span> (new_len > buffer_len) <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00056" name="l00056"></a><span class="lineno"> 56</span> </div>
|
|
|
|
|
<div class="line"><a id="l00057" name="l00057"></a><span class="lineno"> 57</span> memset(args.output_dir, 0, buffer_len);</div>
|
|
|
|
|
<div class="line"><a id="l00058" name="l00058"></a><span class="lineno"> 58</span> memcpy(args.output_dir, new_dir_cstr, new_len);</div>
|
|
|
|
|
<div class="line"><a id="l00059" name="l00059"></a><span class="lineno"> 59</span> <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00060" name="l00060"></a><span class="lineno"> 60</span> }</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00061" name="l00061"></a><span class="lineno"> 61</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00062" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00062" name="l00062"></a><span class="lineno"><a class="line" href="namespaceprocess__util.html#a9edce70fe41a8ec91d549fb9d71a3b10"> 62</a></span> <span class="keywordtype">size_t</span> <a class="code hl_function" href="namespaceprocess__util.html#a9edce70fe41a8ec91d549fb9d71a3b10">suspend_suspicious</a>(std::vector<DWORD> &suspicious_pids)</div>
|
|
|
|
|
<div class="line"><a id="l00062" name="l00062"></a><span class="lineno"><a class="line" href="namespacefiles__util.html#af87086ea253d2c9f93852ad9b40fd7ac"> 62</a></span> <span class="keywordtype">bool</span> <a class="code hl_function" href="namespacefiles__util.html#af87086ea253d2c9f93852ad9b40fd7ac">write_to_file</a>(<span class="keyword">const</span> std::string &report_path, <span class="keyword">const</span> std::string &summary_str, <span class="keyword">const</span> <span class="keywordtype">bool</span> append)</div>
|
|
|
|
|
<div class="line"><a id="l00063" name="l00063"></a><span class="lineno"> 63</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00064" name="l00064"></a><span class="lineno"> 64</span> <span class="keywordtype">size_t</span> done = 0;</div>
|
|
|
|
|
<div class="line"><a id="l00065" name="l00065"></a><span class="lineno"> 65</span> std::vector<DWORD>::iterator itr;</div>
|
|
|
|
|
<div class="line"><a id="l00066" name="l00066"></a><span class="lineno"> 66</span> <span class="keywordflow">for</span> (itr = suspicious_pids.begin(); itr != suspicious_pids.end(); ++itr) {</div>
|
|
|
|
|
<div class="line"><a id="l00067" name="l00067"></a><span class="lineno"> 67</span> DWORD pid = *itr;</div>
|
|
|
|
|
<div class="line"><a id="l00068" name="l00068"></a><span class="lineno"> 68</span> <span class="keywordflow">if</span> (!<a class="code hl_function" href="suspend_8cpp.html#a3c63f252433e6e7532e441ed5cacca9d">suspend_process</a>(pid)) {</div>
|
|
|
|
|
<div class="line"><a id="l00069" name="l00069"></a><span class="lineno"> 69</span> std::cerr << <span class="stringliteral">"Could not suspend the process. PID = "</span> << pid << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00070" name="l00070"></a><span class="lineno"> 70</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00071" name="l00071"></a><span class="lineno"> 71</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00072" name="l00072"></a><span class="lineno"> 72</span> <span class="keywordflow">return</span> done;</div>
|
|
|
|
|
<div class="line"><a id="l00073" name="l00073"></a><span class="lineno"> 73</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00064" name="l00064"></a><span class="lineno"> 64</span> std::ofstream final_report;</div>
|
|
|
|
|
<div class="line"><a id="l00065" name="l00065"></a><span class="lineno"> 65</span> <span class="keywordflow">if</span> (append) {</div>
|
|
|
|
|
<div class="line"><a id="l00066" name="l00066"></a><span class="lineno"> 66</span> final_report.open(report_path, std::ios_base::app);</div>
|
|
|
|
|
<div class="line"><a id="l00067" name="l00067"></a><span class="lineno"> 67</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00068" name="l00068"></a><span class="lineno"> 68</span> <span class="keywordflow">else</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00069" name="l00069"></a><span class="lineno"> 69</span> final_report.open(report_path);</div>
|
|
|
|
|
<div class="line"><a id="l00070" name="l00070"></a><span class="lineno"> 70</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00071" name="l00071"></a><span class="lineno"> 71</span> <span class="keywordflow">if</span> (final_report.is_open()) {</div>
|
|
|
|
|
<div class="line"><a id="l00072" name="l00072"></a><span class="lineno"> 72</span> final_report << summary_str;</div>
|
|
|
|
|
<div class="line"><a id="l00073" name="l00073"></a><span class="lineno"> 73</span> final_report.close();</div>
|
|
|
|
|
<div class="line"><a id="l00074" name="l00074"></a><span class="lineno"> 74</span> <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00075" name="l00075"></a><span class="lineno"> 75</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00076" name="l00076"></a><span class="lineno"> 76</span> <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00077" name="l00077"></a><span class="lineno"> 77</span> }</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00074" name="l00074"></a><span class="lineno"> 74</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00075" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00075" name="l00075"></a><span class="lineno"><a class="line" href="namespaceprocess__util.html#ad8765675543bcce40dec2c3207d76ce9"> 75</a></span> <span class="keywordtype">size_t</span> <a class="code hl_function" href="namespaceprocess__util.html#ad8765675543bcce40dec2c3207d76ce9">kill_suspicious</a>(std::vector<DWORD> &suspicious_pids)</div>
|
|
|
|
|
<div class="line"><a id="l00076" name="l00076"></a><span class="lineno"> 76</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00077" name="l00077"></a><span class="lineno"> 77</span> <span class="keywordtype">size_t</span> killed = 0;</div>
|
|
|
|
|
<div class="line"><a id="l00078" name="l00078"></a><span class="lineno"> 78</span> std::vector<DWORD>::iterator itr;</div>
|
|
|
|
|
<div class="line"><a id="l00079" name="l00079"></a><span class="lineno"> 79</span> <span class="keywordflow">for</span> (itr = suspicious_pids.begin(); itr != suspicious_pids.end(); ++itr) {</div>
|
|
|
|
|
<div class="line"><a id="l00080" name="l00080"></a><span class="lineno"> 80</span> DWORD pid = *itr;</div>
|
|
|
|
|
<div class="line"><a id="l00081" name="l00081"></a><span class="lineno"> 81</span> HANDLE hProcess = OpenProcess(PROCESS_TERMINATE, FALSE, pid);</div>
|
|
|
|
|
<div class="line"><a id="l00082" name="l00082"></a><span class="lineno"> 82</span> <span class="keywordflow">if</span> (!hProcess) {</div>
|
|
|
|
|
<div class="line"><a id="l00083" name="l00083"></a><span class="lineno"> 83</span> <span class="keywordflow">continue</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00084" name="l00084"></a><span class="lineno"> 84</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00085" name="l00085"></a><span class="lineno"> 85</span> <span class="keywordflow">if</span> (TerminateProcess(hProcess, 0)) {</div>
|
|
|
|
|
<div class="line"><a id="l00086" name="l00086"></a><span class="lineno"> 86</span> killed++;</div>
|
|
|
|
|
<div class="line"><a id="l00087" name="l00087"></a><span class="lineno"> 87</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00088" name="l00088"></a><span class="lineno"> 88</span> <span class="keywordflow">else</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00089" name="l00089"></a><span class="lineno"> 89</span> std::cerr << <span class="stringliteral">"Could not terminate the process. PID = "</span> << pid << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00090" name="l00090"></a><span class="lineno"> 90</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00091" name="l00091"></a><span class="lineno"> 91</span> CloseHandle(hProcess);</div>
|
|
|
|
|
<div class="line"><a id="l00092" name="l00092"></a><span class="lineno"> 92</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00093" name="l00093"></a><span class="lineno"> 93</span> <span class="keywordflow">return</span> killed;</div>
|
|
|
|
|
<div class="line"><a id="l00094" name="l00094"></a><span class="lineno"> 94</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00078" name="l00078"></a><span class="lineno"> 78</span>}; <span class="comment">// namespace files_util </span></div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00095" name="l00095"></a><span class="lineno"> 95</span> </div>
|
|
|
|
|
<div class="line"><a id="l00096" name="l00096"></a><span class="lineno"> 96</span>}; <span class="comment">// namespace process_util</span></div>
|
|
|
|
|
<div class="line"><a id="l00079" name="l00079"></a><span class="lineno"> 79</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00080" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00080" name="l00080"></a><span class="lineno"><a class="line" href="namespaceutil.html"> 80</a></span><span class="keyword">namespace </span><a class="code hl_namespace" href="namespaceutil.html">util</a> {</div>
|
|
|
|
|
<div class="line"><a id="l00081" name="l00081"></a><span class="lineno"> 81</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00082" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00082" name="l00082"></a><span class="lineno"><a class="line" href="namespaceutil.html#a3849afaac9ec9e32eadd5e0abe8e1aa7"> 82</a></span> <span class="keywordtype">bool</span> <a class="code hl_function" href="namespaceutil.html#a3849afaac9ec9e32eadd5e0abe8e1aa7">is_searched_name</a>(<span class="keyword">const</span> WCHAR* processName, std::set<std::wstring> &names_list)</div>
|
|
|
|
|
<div class="line"><a id="l00083" name="l00083"></a><span class="lineno"> 83</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00084" name="l00084"></a><span class="lineno"> 84</span> std::set<std::wstring>::iterator itr;</div>
|
|
|
|
|
<div class="line"><a id="l00085" name="l00085"></a><span class="lineno"> 85</span> <span class="keywordflow">for</span> (itr = names_list.begin(); itr != names_list.end(); ++itr) {</div>
|
|
|
|
|
<div class="line"><a id="l00086" name="l00086"></a><span class="lineno"> 86</span> <span class="keyword">const</span> WCHAR* searchedName = itr->c_str();</div>
|
|
|
|
|
<div class="line"><a id="l00087" name="l00087"></a><span class="lineno"> 87</span> <span class="keywordflow">if</span> (_wcsicmp(processName, searchedName) == 0) {</div>
|
|
|
|
|
<div class="line"><a id="l00088" name="l00088"></a><span class="lineno"> 88</span> <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00089" name="l00089"></a><span class="lineno"> 89</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00090" name="l00090"></a><span class="lineno"> 90</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00091" name="l00091"></a><span class="lineno"> 91</span> <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00092" name="l00092"></a><span class="lineno"> 92</span> }</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00097" name="l00097"></a><span class="lineno"> 97</span> </div>
|
|
|
|
|
<div class="line"><a id="l00098" name="l00098"></a><span class="lineno"> 98</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00099" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00099" name="l00099"></a><span class="lineno"><a class="line" href="namespacefiles__util.html"> 99</a></span><span class="keyword">namespace </span><a class="code hl_namespace" href="namespacefiles__util.html">files_util</a> {</div>
|
|
|
|
|
<div class="line"><a id="l00100" name="l00100"></a><span class="lineno"> 100</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00101" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00101" name="l00101"></a><span class="lineno"><a class="line" href="namespacefiles__util.html#a9a7fcfd84189964e87c1b572f1fe8fbe"> 101</a></span> std::string <a class="code hl_function" href="namespacefiles__util.html#a9a7fcfd84189964e87c1b572f1fe8fbe">join_path</a>(<span class="keyword">const</span> std::string &baseDir, <span class="keyword">const</span> std::string &subpath)</div>
|
|
|
|
|
<div class="line"><a id="l00102" name="l00102"></a><span class="lineno"> 102</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00103" name="l00103"></a><span class="lineno"> 103</span> std::stringstream stream;</div>
|
|
|
|
|
<div class="line"><a id="l00104" name="l00104"></a><span class="lineno"> 104</span> <span class="keywordflow">if</span> (baseDir.length() > 0) {</div>
|
|
|
|
|
<div class="line"><a id="l00105" name="l00105"></a><span class="lineno"> 105</span> stream << baseDir;</div>
|
|
|
|
|
<div class="line"><a id="l00106" name="l00106"></a><span class="lineno"> 106</span> stream << <span class="stringliteral">"\\"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00107" name="l00107"></a><span class="lineno"> 107</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00108" name="l00108"></a><span class="lineno"> 108</span> stream << subpath;</div>
|
|
|
|
|
<div class="line"><a id="l00109" name="l00109"></a><span class="lineno"> 109</span> <span class="keywordflow">return</span> stream.str();</div>
|
|
|
|
|
<div class="line"><a id="l00110" name="l00110"></a><span class="lineno"> 110</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00093" name="l00093"></a><span class="lineno"> 93</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00094" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00094" name="l00094"></a><span class="lineno"><a class="line" href="namespaceutil.html#afe3e470c6b385ed25f7d5f1d93b420cd"> 94</a></span> <span class="keywordtype">bool</span> <a class="code hl_function" href="namespaceutil.html#afe3e470c6b385ed25f7d5f1d93b420cd">is_searched_pid</a>(<span class="keywordtype">long</span> pid, std::set<long> &pids_list)</div>
|
|
|
|
|
<div class="line"><a id="l00095" name="l00095"></a><span class="lineno"> 95</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00096" name="l00096"></a><span class="lineno"> 96</span> std::set<long>::iterator found = pids_list.find(pid);</div>
|
|
|
|
|
<div class="line"><a id="l00097" name="l00097"></a><span class="lineno"> 97</span> <span class="keywordflow">if</span> (found != pids_list.end()) {</div>
|
|
|
|
|
<div class="line"><a id="l00098" name="l00098"></a><span class="lineno"> 98</span> <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00099" name="l00099"></a><span class="lineno"> 99</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00100" name="l00100"></a><span class="lineno"> 100</span> <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00101" name="l00101"></a><span class="lineno"> 101</span> }</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00111" name="l00111"></a><span class="lineno"> 111</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00112" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00112" name="l00112"></a><span class="lineno"><a class="line" href="namespacefiles__util.html#a9c2cf1240e4b850893c4e7a0a2ab641b"> 112</a></span> std::string <a class="code hl_function" href="namespacefiles__util.html#a9c2cf1240e4b850893c4e7a0a2ab641b">make_dir_name</a>(std::string baseDir, time_t timestamp)</div>
|
|
|
|
|
<div class="line"><a id="l00113" name="l00113"></a><span class="lineno"> 113</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00114" name="l00114"></a><span class="lineno"> 114</span> std::stringstream stream;</div>
|
|
|
|
|
<div class="line"><a id="l00115" name="l00115"></a><span class="lineno"> 115</span> <span class="keywordflow">if</span> (baseDir.length() > 0) {</div>
|
|
|
|
|
<div class="line"><a id="l00116" name="l00116"></a><span class="lineno"> 116</span> stream << baseDir;</div>
|
|
|
|
|
<div class="line"><a id="l00117" name="l00117"></a><span class="lineno"> 117</span> stream << <span class="stringliteral">"\\"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00118" name="l00118"></a><span class="lineno"> 118</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00119" name="l00119"></a><span class="lineno"> 119</span> stream << <span class="stringliteral">"scan_"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00120" name="l00120"></a><span class="lineno"> 120</span> stream << timestamp;</div>
|
|
|
|
|
<div class="line"><a id="l00121" name="l00121"></a><span class="lineno"> 121</span> <span class="keywordflow">return</span> stream.str();</div>
|
|
|
|
|
<div class="line"><a id="l00122" name="l00122"></a><span class="lineno"> 122</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00102" name="l00102"></a><span class="lineno"> 102</span> </div>
|
|
|
|
|
<div class="line"><a id="l00103" name="l00103"></a><span class="lineno"> 103</span> <span class="keyword">template</span> <<span class="keyword">typename</span> TYPE_T></div>
|
|
|
|
|
<div class="foldopen" id="foldopen00104" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00104" name="l00104"></a><span class="lineno"><a class="line" href="namespaceutil.html#a4afca6eda8fe7bc220cfdb824b79fd8b"> 104</a></span> std::string <a class="code hl_function" href="namespaceutil.html#a4afca6eda8fe7bc220cfdb824b79fd8b">list_to_str</a>(std::set<TYPE_T> &list)</div>
|
|
|
|
|
<div class="line"><a id="l00105" name="l00105"></a><span class="lineno"> 105</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00106" name="l00106"></a><span class="lineno"> 106</span> std::wstringstream stream;</div>
|
|
|
|
|
<div class="line"><a id="l00107" name="l00107"></a><span class="lineno"> 107</span> </div>
|
|
|
|
|
<div class="line"><a id="l00108" name="l00108"></a><span class="lineno"> 108</span> std::set<TYPE_T>::iterator itr;</div>
|
|
|
|
|
<div class="line"><a id="l00109" name="l00109"></a><span class="lineno"> 109</span> <span class="keywordflow">for</span> (itr = list.begin(); itr != list.end(); ) {</div>
|
|
|
|
|
<div class="line"><a id="l00110" name="l00110"></a><span class="lineno"> 110</span> stream << *itr;</div>
|
|
|
|
|
<div class="line"><a id="l00111" name="l00111"></a><span class="lineno"> 111</span> ++itr;</div>
|
|
|
|
|
<div class="line"><a id="l00112" name="l00112"></a><span class="lineno"> 112</span> <span class="keywordflow">if</span> (itr != list.end()) {</div>
|
|
|
|
|
<div class="line"><a id="l00113" name="l00113"></a><span class="lineno"> 113</span> stream << <span class="stringliteral">", "</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00114" name="l00114"></a><span class="lineno"> 114</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00115" name="l00115"></a><span class="lineno"> 115</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00116" name="l00116"></a><span class="lineno"> 116</span> <span class="keywordflow">return</span> std::wstring_convert<std::codecvt_utf8<wchar_t>>().to_bytes(stream.str());</div>
|
|
|
|
|
<div class="line"><a id="l00117" name="l00117"></a><span class="lineno"> 117</span> }</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00123" name="l00123"></a><span class="lineno"> 123</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00124" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00124" name="l00124"></a><span class="lineno"><a class="line" href="namespacefiles__util.html#abab65a3cbe43de11dd5d25ed5e4d47e5"> 124</a></span> <span class="keywordtype">bool</span> <a class="code hl_function" href="namespacefiles__util.html#abab65a3cbe43de11dd5d25ed5e4d47e5">set_output_dir</a>(t_params &args, <span class="keyword">const</span> std::string &new_dir)</div>
|
|
|
|
|
<div class="line"><a id="l00125" name="l00125"></a><span class="lineno"> 125</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00126" name="l00126"></a><span class="lineno"> 126</span> <span class="keyword">const</span> <span class="keywordtype">size_t</span> new_len = new_dir.length();</div>
|
|
|
|
|
<div class="line"><a id="l00127" name="l00127"></a><span class="lineno"> 127</span> <span class="keywordflow">if</span> (!new_len) <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00128" name="l00128"></a><span class="lineno"> 128</span> </div>
|
|
|
|
|
<div class="line"><a id="l00129" name="l00129"></a><span class="lineno"> 129</span> <span class="keyword">const</span> <span class="keywordtype">char</span>* new_dir_cstr = new_dir.c_str();</div>
|
|
|
|
|
<div class="line"><a id="l00130" name="l00130"></a><span class="lineno"> 130</span> <span class="keywordtype">size_t</span> buffer_len = <span class="keyword">sizeof</span>(args.output_dir) - 1; <span class="comment">//leave one char for '\0'</span></div>
|
|
|
|
|
<div class="line"><a id="l00131" name="l00131"></a><span class="lineno"> 131</span> <span class="keywordflow">if</span> (new_len > buffer_len) <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00132" name="l00132"></a><span class="lineno"> 132</span> </div>
|
|
|
|
|
<div class="line"><a id="l00133" name="l00133"></a><span class="lineno"> 133</span> memset(args.output_dir, 0, buffer_len);</div>
|
|
|
|
|
<div class="line"><a id="l00134" name="l00134"></a><span class="lineno"> 134</span> memcpy(args.output_dir, new_dir_cstr, new_len);</div>
|
|
|
|
|
<div class="line"><a id="l00135" name="l00135"></a><span class="lineno"> 135</span> <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00136" name="l00136"></a><span class="lineno"> 136</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00118" name="l00118"></a><span class="lineno"> 118</span> </div>
|
|
|
|
|
<div class="line"><a id="l00119" name="l00119"></a><span class="lineno"> 119</span>}; <span class="comment">//namespace util</span></div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00137" name="l00137"></a><span class="lineno"> 137</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00138" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00138" name="l00138"></a><span class="lineno"><a class="line" href="namespacefiles__util.html#af87086ea253d2c9f93852ad9b40fd7ac"> 138</a></span> <span class="keywordtype">bool</span> <a class="code hl_function" href="namespacefiles__util.html#af87086ea253d2c9f93852ad9b40fd7ac">write_to_file</a>(<span class="keyword">const</span> std::string &report_path, <span class="keyword">const</span> std::string &summary_str, <span class="keyword">const</span> <span class="keywordtype">bool</span> append)</div>
|
|
|
|
|
<div class="line"><a id="l00139" name="l00139"></a><span class="lineno"> 139</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00140" name="l00140"></a><span class="lineno"> 140</span> std::ofstream final_report;</div>
|
|
|
|
|
<div class="line"><a id="l00141" name="l00141"></a><span class="lineno"> 141</span> <span class="keywordflow">if</span> (append) {</div>
|
|
|
|
|
<div class="line"><a id="l00142" name="l00142"></a><span class="lineno"> 142</span> final_report.open(report_path, std::ios_base::app);</div>
|
|
|
|
|
<div class="line"><a id="l00143" name="l00143"></a><span class="lineno"> 143</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00144" name="l00144"></a><span class="lineno"> 144</span> <span class="keywordflow">else</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00145" name="l00145"></a><span class="lineno"> 145</span> final_report.open(report_path);</div>
|
|
|
|
|
<div class="line"><a id="l00146" name="l00146"></a><span class="lineno"> 146</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00147" name="l00147"></a><span class="lineno"> 147</span> <span class="keywordflow">if</span> (final_report.is_open()) {</div>
|
|
|
|
|
<div class="line"><a id="l00148" name="l00148"></a><span class="lineno"> 148</span> final_report << summary_str;</div>
|
|
|
|
|
<div class="line"><a id="l00149" name="l00149"></a><span class="lineno"> 149</span> final_report.close();</div>
|
|
|
|
|
<div class="line"><a id="l00150" name="l00150"></a><span class="lineno"> 150</span> <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00151" name="l00151"></a><span class="lineno"> 151</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00152" name="l00152"></a><span class="lineno"> 152</span> <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00153" name="l00153"></a><span class="lineno"> 153</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00120" name="l00120"></a><span class="lineno"> 120</span> </div>
|
|
|
|
|
<div class="line"><a id="l00121" name="l00121"></a><span class="lineno"> 121</span><span class="comment">//----</span></div>
|
|
|
|
|
<div class="line"><a id="l00122" name="l00122"></a><span class="lineno"> 122</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00123" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00123" name="l00123"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#abae28bb490b101cb3d1136eb76a5df33"> 123</a></span><a class="code hl_function" href="class_h_h_scanner.html#abae28bb490b101cb3d1136eb76a5df33">HHScanner::HHScanner</a>(<a class="code hl_struct" href="structhh__params.html">t_hh_params</a> &_args)</div>
|
|
|
|
|
<div class="line"><a id="l00124" name="l00124"></a><span class="lineno"> 124</span> : hh_args(_args)</div>
|
|
|
|
|
<div class="line"><a id="l00125" name="l00125"></a><span class="lineno"> 125</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00126" name="l00126"></a><span class="lineno"> 126</span> <a class="code hl_variable" href="class_h_h_scanner.html#a989d1551cc43e9497ca232db41ee9e5b">initTime</a> = time(NULL);</div>
|
|
|
|
|
<div class="line"><a id="l00127" name="l00127"></a><span class="lineno"> 127</span> <a class="code hl_variable" href="class_h_h_scanner.html#a64bb7d15ea59c9fe7e25f266e05005b9">isScannerWow64</a> = <a class="code hl_function" href="namespaceprocess__util.html#a1550838f32323b66051e0d05a0acdb01">process_util::is_wow_64</a>(GetCurrentProcess());</div>
|
|
|
|
|
<div class="line"><a id="l00128" name="l00128"></a><span class="lineno"> 128</span>}</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00154" name="l00154"></a><span class="lineno"> 154</span>}; <span class="comment">// namespace files_util </span></div>
|
|
|
|
|
<div class="line"><a id="l00129" name="l00129"></a><span class="lineno"> 129</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00130" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00130" name="l00130"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#adec367c7541ba8e334c7f674e57f429a"> 130</a></span><span class="keywordtype">bool</span> <a class="code hl_function" href="class_h_h_scanner.html#adec367c7541ba8e334c7f674e57f429a">HHScanner::isScannerCompatibile</a>()</div>
|
|
|
|
|
<div class="line"><a id="l00131" name="l00131"></a><span class="lineno"> 131</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00132" name="l00132"></a><span class="lineno"> 132</span><span class="preprocessor">#ifndef _WIN64</span></div>
|
|
|
|
|
<div class="line"><a id="l00133" name="l00133"></a><span class="lineno"> 133</span> <span class="keywordflow">if</span> (<a class="code hl_function" href="namespaceprocess__util.html#a1550838f32323b66051e0d05a0acdb01">process_util::is_wow_64</a>(GetCurrentProcess())) {</div>
|
|
|
|
|
<div class="line"><a id="l00134" name="l00134"></a><span class="lineno"> 134</span> <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00135" name="l00135"></a><span class="lineno"> 135</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00136" name="l00136"></a><span class="lineno"> 136</span><span class="preprocessor">#endif</span></div>
|
|
|
|
|
<div class="line"><a id="l00137" name="l00137"></a><span class="lineno"> 137</span> <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00138" name="l00138"></a><span class="lineno"> 138</span>}</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00155" name="l00155"></a><span class="lineno"> 155</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00156" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00156" name="l00156"></a><span class="lineno"><a class="line" href="namespaceutil.html"> 156</a></span><span class="keyword">namespace </span><a class="code hl_namespace" href="namespaceutil.html">util</a> {</div>
|
|
|
|
|
<div class="line"><a id="l00157" name="l00157"></a><span class="lineno"> 157</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00158" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00158" name="l00158"></a><span class="lineno"><a class="line" href="namespaceutil.html#a3849afaac9ec9e32eadd5e0abe8e1aa7"> 158</a></span> <span class="keywordtype">bool</span> <a class="code hl_function" href="namespaceutil.html#a3849afaac9ec9e32eadd5e0abe8e1aa7">is_searched_name</a>(<span class="keyword">const</span> WCHAR* processName, std::set<std::wstring> &names_list)</div>
|
|
|
|
|
<div class="line"><a id="l00159" name="l00159"></a><span class="lineno"> 159</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00160" name="l00160"></a><span class="lineno"> 160</span> std::set<std::wstring>::iterator itr;</div>
|
|
|
|
|
<div class="line"><a id="l00161" name="l00161"></a><span class="lineno"> 161</span> <span class="keywordflow">for</span> (itr = names_list.begin(); itr != names_list.end(); ++itr) {</div>
|
|
|
|
|
<div class="line"><a id="l00162" name="l00162"></a><span class="lineno"> 162</span> <span class="keyword">const</span> WCHAR* searchedName = itr->c_str();</div>
|
|
|
|
|
<div class="line"><a id="l00163" name="l00163"></a><span class="lineno"> 163</span> <span class="keywordflow">if</span> (_wcsicmp(processName, searchedName) == 0) {</div>
|
|
|
|
|
<div class="line"><a id="l00164" name="l00164"></a><span class="lineno"> 164</span> <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00165" name="l00165"></a><span class="lineno"> 165</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00166" name="l00166"></a><span class="lineno"> 166</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00167" name="l00167"></a><span class="lineno"> 167</span> <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00168" name="l00168"></a><span class="lineno"> 168</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00139" name="l00139"></a><span class="lineno"> 139</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00140" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00140" name="l00140"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#ab704a295bea1cea7d7b7d00fc97a5683"> 140</a></span><span class="keywordtype">void</span> <a class="code hl_function" href="class_h_h_scanner.html#ab704a295bea1cea7d7b7d00fc97a5683">HHScanner::initOutDir</a>(time_t scan_time, pesieve::t_params &pesieve_args)</div>
|
|
|
|
|
<div class="line"><a id="l00141" name="l00141"></a><span class="lineno"> 141</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00142" name="l00142"></a><span class="lineno"> 142</span> <span class="comment">//set unique path</span></div>
|
|
|
|
|
<div class="line"><a id="l00143" name="l00143"></a><span class="lineno"> 143</span> <span class="keywordflow">if</span> (<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#adc6d18cfa1bcec72107e2022418bf8f3">unique_dir</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00144" name="l00144"></a><span class="lineno"> 144</span> this-><a class="code hl_variable" href="class_h_h_scanner.html#a238a4958607b0f74d44c27c1505b1906">outDir</a> = <a class="code hl_function" href="namespacefiles__util.html#a9c2cf1240e4b850893c4e7a0a2ab641b">files_util::make_dir_name</a>(<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a7777b45895ca0788d061e1f4c5f60a7b">out_dir</a>, scan_time);</div>
|
|
|
|
|
<div class="line"><a id="l00145" name="l00145"></a><span class="lineno"> 145</span> <a class="code hl_function" href="namespacefiles__util.html#abab65a3cbe43de11dd5d25ed5e4d47e5">files_util::set_output_dir</a>(pesieve_args, <a class="code hl_variable" href="class_h_h_scanner.html#a238a4958607b0f74d44c27c1505b1906">outDir</a>);</div>
|
|
|
|
|
<div class="line"><a id="l00146" name="l00146"></a><span class="lineno"> 146</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00147" name="l00147"></a><span class="lineno"> 147</span> <span class="keywordflow">else</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00148" name="l00148"></a><span class="lineno"> 148</span> this-><a class="code hl_variable" href="class_h_h_scanner.html#a238a4958607b0f74d44c27c1505b1906">outDir</a> = <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a7777b45895ca0788d061e1f4c5f60a7b">out_dir</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00149" name="l00149"></a><span class="lineno"> 149</span> <a class="code hl_function" href="namespacefiles__util.html#abab65a3cbe43de11dd5d25ed5e4d47e5">files_util::set_output_dir</a>(pesieve_args, <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a7777b45895ca0788d061e1f4c5f60a7b">out_dir</a>);</div>
|
|
|
|
|
<div class="line"><a id="l00150" name="l00150"></a><span class="lineno"> 150</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00151" name="l00151"></a><span class="lineno"> 151</span>}</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00169" name="l00169"></a><span class="lineno"> 169</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00170" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00170" name="l00170"></a><span class="lineno"><a class="line" href="namespaceutil.html#afe3e470c6b385ed25f7d5f1d93b420cd"> 170</a></span> <span class="keywordtype">bool</span> <a class="code hl_function" href="namespaceutil.html#afe3e470c6b385ed25f7d5f1d93b420cd">is_searched_pid</a>(<span class="keywordtype">long</span> pid, std::set<long> &pids_list)</div>
|
|
|
|
|
<div class="line"><a id="l00171" name="l00171"></a><span class="lineno"> 171</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00172" name="l00172"></a><span class="lineno"> 172</span> std::set<long>::iterator found = pids_list.find(pid);</div>
|
|
|
|
|
<div class="line"><a id="l00173" name="l00173"></a><span class="lineno"> 173</span> <span class="keywordflow">if</span> (found != pids_list.end()) {</div>
|
|
|
|
|
<div class="line"><a id="l00174" name="l00174"></a><span class="lineno"> 174</span> <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00175" name="l00175"></a><span class="lineno"> 175</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00176" name="l00176"></a><span class="lineno"> 176</span> <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00177" name="l00177"></a><span class="lineno"> 177</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00152" name="l00152"></a><span class="lineno"> 152</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00153" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00153" name="l00153"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#a6700be392afaa57e77ddc4c649e718f1"> 153</a></span><span class="keywordtype">void</span> <a class="code hl_function" href="class_h_h_scanner.html#a6700be392afaa57e77ddc4c649e718f1">HHScanner::printScanRoundStats</a>(<span class="keywordtype">size_t</span> found, <span class="keywordtype">size_t</span> ignored_count)</div>
|
|
|
|
|
<div class="line"><a id="l00154" name="l00154"></a><span class="lineno"> 154</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00155" name="l00155"></a><span class="lineno"> 155</span> <span class="keywordflow">if</span> (!found && <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#aaada133523530dfd49401621b336d74b">names_list</a>.size() > 0) {</div>
|
|
|
|
|
<div class="line"><a id="l00156" name="l00156"></a><span class="lineno"> 156</span> <span class="keywordflow">if</span> (!<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a9c00556752d2c127c5c5b205c166976b">quiet</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00157" name="l00157"></a><span class="lineno"> 157</span> std::cout << <span class="stringliteral">"[WARNING] No process from the list: {"</span> << <a class="code hl_function" href="namespaceutil.html#a4afca6eda8fe7bc220cfdb824b79fd8b">util::list_to_str</a>(<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#aaada133523530dfd49401621b336d74b">names_list</a>) << <span class="stringliteral">"} was found!"</span> << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00158" name="l00158"></a><span class="lineno"> 158</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00159" name="l00159"></a><span class="lineno"> 159</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00160" name="l00160"></a><span class="lineno"> 160</span> <span class="keywordflow">if</span> (!found && <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a179cffc6577cad21f16e07ca3ae14a67">pids_list</a>.size() > 0) {</div>
|
|
|
|
|
<div class="line"><a id="l00161" name="l00161"></a><span class="lineno"> 161</span> <span class="keywordflow">if</span> (!<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a9c00556752d2c127c5c5b205c166976b">quiet</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00162" name="l00162"></a><span class="lineno"> 162</span> std::cout << <span class="stringliteral">"[WARNING] No process from the list: {"</span> << <a class="code hl_function" href="namespaceutil.html#a4afca6eda8fe7bc220cfdb824b79fd8b">util::list_to_str</a>(<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a179cffc6577cad21f16e07ca3ae14a67">pids_list</a>) << <span class="stringliteral">"} was found!"</span> << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00163" name="l00163"></a><span class="lineno"> 163</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00164" name="l00164"></a><span class="lineno"> 164</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00165" name="l00165"></a><span class="lineno"> 165</span> <span class="keywordflow">if</span> (ignored_count > 0) {</div>
|
|
|
|
|
<div class="line"><a id="l00166" name="l00166"></a><span class="lineno"> 166</span> <span class="keywordflow">if</span> (!<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a9c00556752d2c127c5c5b205c166976b">quiet</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00167" name="l00167"></a><span class="lineno"> 167</span> std::string info1 = (ignored_count > 1) ? <span class="stringliteral">"processes"</span> : <span class="stringliteral">"process"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00168" name="l00168"></a><span class="lineno"> 168</span> std::string info2 = (ignored_count > 1) ? <span class="stringliteral">"were"</span> : <span class="stringliteral">"was"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00169" name="l00169"></a><span class="lineno"> 169</span> std::cout << <span class="stringliteral">"[INFO] "</span> << std::dec << ignored_count << <span class="stringliteral">" "</span> << info1 << <span class="stringliteral">" from the list : {"</span> << <a class="code hl_function" href="namespaceutil.html#a4afca6eda8fe7bc220cfdb824b79fd8b">util::list_to_str</a>(<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a5d1f3507578157518e3104ca58696003">ignored_names_list</a>) << <span class="stringliteral">"} "</span> << info2 << <span class="stringliteral">" ignored!"</span> << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00170" name="l00170"></a><span class="lineno"> 170</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00171" name="l00171"></a><span class="lineno"> 171</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00172" name="l00172"></a><span class="lineno"> 172</span>}</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00178" name="l00178"></a><span class="lineno"> 178</span> </div>
|
|
|
|
|
<div class="line"><a id="l00179" name="l00179"></a><span class="lineno"> 179</span> <span class="keyword">template</span> <<span class="keyword">typename</span> TYPE_T></div>
|
|
|
|
|
<div class="foldopen" id="foldopen00180" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00180" name="l00180"></a><span class="lineno"><a class="line" href="namespaceutil.html#a4afca6eda8fe7bc220cfdb824b79fd8b"> 180</a></span> std::string <a class="code hl_function" href="namespaceutil.html#a4afca6eda8fe7bc220cfdb824b79fd8b">list_to_str</a>(std::set<TYPE_T> &list)</div>
|
|
|
|
|
<div class="line"><a id="l00181" name="l00181"></a><span class="lineno"> 181</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00182" name="l00182"></a><span class="lineno"> 182</span> std::wstringstream stream;</div>
|
|
|
|
|
<div class="line"><a id="l00183" name="l00183"></a><span class="lineno"> 183</span> </div>
|
|
|
|
|
<div class="line"><a id="l00184" name="l00184"></a><span class="lineno"> 184</span> std::set<TYPE_T>::iterator itr;</div>
|
|
|
|
|
<div class="line"><a id="l00185" name="l00185"></a><span class="lineno"> 185</span> <span class="keywordflow">for</span> (itr = list.begin(); itr != list.end(); ) {</div>
|
|
|
|
|
<div class="line"><a id="l00186" name="l00186"></a><span class="lineno"> 186</span> stream << *itr;</div>
|
|
|
|
|
<div class="line"><a id="l00187" name="l00187"></a><span class="lineno"> 187</span> ++itr;</div>
|
|
|
|
|
<div class="line"><a id="l00188" name="l00188"></a><span class="lineno"> 188</span> <span class="keywordflow">if</span> (itr != list.end()) {</div>
|
|
|
|
|
<div class="line"><a id="l00189" name="l00189"></a><span class="lineno"> 189</span> stream << <span class="stringliteral">", "</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00190" name="l00190"></a><span class="lineno"> 190</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00191" name="l00191"></a><span class="lineno"> 191</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00192" name="l00192"></a><span class="lineno"> 192</span> <span class="keywordflow">return</span> std::wstring_convert<std::codecvt_utf8<wchar_t>>().to_bytes(stream.str());</div>
|
|
|
|
|
<div class="line"><a id="l00193" name="l00193"></a><span class="lineno"> 193</span> }</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00194" name="l00194"></a><span class="lineno"> 194</span> </div>
|
|
|
|
|
<div class="line"><a id="l00195" name="l00195"></a><span class="lineno"> 195</span>}; <span class="comment">//namespace util</span></div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00196" name="l00196"></a><span class="lineno"> 196</span> </div>
|
|
|
|
|
<div class="line"><a id="l00197" name="l00197"></a><span class="lineno"> 197</span><span class="comment">//----</span></div>
|
|
|
|
|
<div class="line"><a id="l00198" name="l00198"></a><span class="lineno"> 198</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00199" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00199" name="l00199"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#abae28bb490b101cb3d1136eb76a5df33"> 199</a></span><a class="code hl_function" href="class_h_h_scanner.html#abae28bb490b101cb3d1136eb76a5df33">HHScanner::HHScanner</a>(<a class="code hl_struct" href="structhh__params.html">t_hh_params</a> &_args)</div>
|
|
|
|
|
<div class="line"><a id="l00200" name="l00200"></a><span class="lineno"> 200</span> : hh_args(_args)</div>
|
|
|
|
|
<div class="line"><a id="l00201" name="l00201"></a><span class="lineno"> 201</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00202" name="l00202"></a><span class="lineno"> 202</span> <a class="code hl_variable" href="class_h_h_scanner.html#a989d1551cc43e9497ca232db41ee9e5b">initTime</a> = time(NULL);</div>
|
|
|
|
|
<div class="line"><a id="l00203" name="l00203"></a><span class="lineno"> 203</span> <a class="code hl_variable" href="class_h_h_scanner.html#a64bb7d15ea59c9fe7e25f266e05005b9">isScannerWow64</a> = <a class="code hl_function" href="namespaceprocess__util.html#a1550838f32323b66051e0d05a0acdb01">process_util::is_wow_64</a>(GetCurrentProcess());</div>
|
|
|
|
|
<div class="line"><a id="l00204" name="l00204"></a><span class="lineno"> 204</span>}</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00205" name="l00205"></a><span class="lineno"> 205</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00206" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00206" name="l00206"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#adec367c7541ba8e334c7f674e57f429a"> 206</a></span><span class="keywordtype">bool</span> <a class="code hl_function" href="class_h_h_scanner.html#adec367c7541ba8e334c7f674e57f429a">HHScanner::isScannerCompatibile</a>()</div>
|
|
|
|
|
<div class="line"><a id="l00207" name="l00207"></a><span class="lineno"> 207</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00208" name="l00208"></a><span class="lineno"> 208</span><span class="preprocessor">#ifndef _WIN64</span></div>
|
|
|
|
|
<div class="line"><a id="l00209" name="l00209"></a><span class="lineno"> 209</span> <span class="keywordflow">if</span> (<a class="code hl_function" href="namespaceprocess__util.html#a1550838f32323b66051e0d05a0acdb01">process_util::is_wow_64</a>(GetCurrentProcess())) {</div>
|
|
|
|
|
<div class="line"><a id="l00210" name="l00210"></a><span class="lineno"> 210</span> <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00211" name="l00211"></a><span class="lineno"> 211</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00212" name="l00212"></a><span class="lineno"> 212</span><span class="preprocessor">#endif</span></div>
|
|
|
|
|
<div class="line"><a id="l00213" name="l00213"></a><span class="lineno"> 213</span> <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00214" name="l00214"></a><span class="lineno"> 214</span>}</div>
|
|
|
|
|
<div class="line"><a id="l00173" name="l00173"></a><span class="lineno"> 173</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00174" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00174" name="l00174"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#a8528d5f27f05bfefcd2278318dc61846"> 174</a></span><span class="keywordtype">size_t</span> <a class="code hl_function" href="class_h_h_scanner.html#a8528d5f27f05bfefcd2278318dc61846">HHScanner::scanProcesses</a>(<a class="code hl_class" href="class_h_h_scan_report.html">HHScanReport</a> &my_report)</div>
|
|
|
|
|
<div class="line"><a id="l00175" name="l00175"></a><span class="lineno"> 175</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00176" name="l00176"></a><span class="lineno"> 176</span> <span class="keywordtype">size_t</span> count = 0;</div>
|
|
|
|
|
<div class="line"><a id="l00177" name="l00177"></a><span class="lineno"> 177</span> <span class="keywordtype">size_t</span> scanned_count = 0;</div>
|
|
|
|
|
<div class="line"><a id="l00178" name="l00178"></a><span class="lineno"> 178</span> <span class="keywordtype">size_t</span> ignored_count = 0;</div>
|
|
|
|
|
<div class="line"><a id="l00179" name="l00179"></a><span class="lineno"> 179</span> </div>
|
|
|
|
|
<div class="line"><a id="l00180" name="l00180"></a><span class="lineno"> 180</span> HANDLE hProcessSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);</div>
|
|
|
|
|
<div class="line"><a id="l00181" name="l00181"></a><span class="lineno"> 181</span> <span class="keywordflow">if</span> (hProcessSnapShot == INVALID_HANDLE_VALUE) {</div>
|
|
|
|
|
<div class="line"><a id="l00182" name="l00182"></a><span class="lineno"> 182</span> <span class="keyword">const</span> DWORD err = GetLastError();</div>
|
|
|
|
|
<div class="line"><a id="l00183" name="l00183"></a><span class="lineno"> 183</span> std::cerr << <span class="stringliteral">"[-] Could not create modules snapshot. Error: "</span> << std::dec << err << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00184" name="l00184"></a><span class="lineno"> 184</span> <span class="keywordflow">return</span> 0;</div>
|
|
|
|
|
<div class="line"><a id="l00185" name="l00185"></a><span class="lineno"> 185</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00186" name="l00186"></a><span class="lineno"> 186</span> </div>
|
|
|
|
|
<div class="line"><a id="l00187" name="l00187"></a><span class="lineno"> 187</span> PROCESSENTRY32 pe32 = { 0 };</div>
|
|
|
|
|
<div class="line"><a id="l00188" name="l00188"></a><span class="lineno"> 188</span> pe32.dwSize = <span class="keyword">sizeof</span>(PROCESSENTRY32);</div>
|
|
|
|
|
<div class="line"><a id="l00189" name="l00189"></a><span class="lineno"> 189</span> </div>
|
|
|
|
|
<div class="line"><a id="l00190" name="l00190"></a><span class="lineno"> 190</span> <span class="comment">//check all modules in the process, including the main module:</span></div>
|
|
|
|
|
<div class="line"><a id="l00191" name="l00191"></a><span class="lineno"> 191</span> <span class="keywordflow">if</span> (!Process32First(hProcessSnapShot, &pe32)) {</div>
|
|
|
|
|
<div class="line"><a id="l00192" name="l00192"></a><span class="lineno"> 192</span> CloseHandle(hProcessSnapShot);</div>
|
|
|
|
|
<div class="line"><a id="l00193" name="l00193"></a><span class="lineno"> 193</span> std::cerr << <span class="stringliteral">"[-] Could not enumerate processes. Error: "</span> << GetLastError() << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00194" name="l00194"></a><span class="lineno"> 194</span> <span class="keywordflow">return</span> 0;</div>
|
|
|
|
|
<div class="line"><a id="l00195" name="l00195"></a><span class="lineno"> 195</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00196" name="l00196"></a><span class="lineno"> 196</span> <span class="keywordflow">do</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00197" name="l00197"></a><span class="lineno"> 197</span> <span class="comment">// scan callback</span></div>
|
|
|
|
|
<div class="line"><a id="l00198" name="l00198"></a><span class="lineno"> 198</span> <span class="keyword">const</span> <a class="code hl_typedef" href="hh__scanner_8h.html#ad5caa6b1d4b11989c8ff90d46fc231aa">t_single_scan_status</a> stat = <a class="code hl_function" href="class_h_h_scanner.html#a4881091d77448e0812ab5581f01893c7">scanNextProcess</a>(pe32.th32ProcessID, pe32.szExeFile, my_report);</div>
|
|
|
|
|
<div class="line"><a id="l00199" name="l00199"></a><span class="lineno"> 199</span> <span class="keywordflow">if</span> (stat == <a class="code hl_enumvalue" href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4a92a79c026616fa779bd92df2b65a626b">SSCAN_IGNORED</a>) ignored_count++;</div>
|
|
|
|
|
<div class="line"><a id="l00200" name="l00200"></a><span class="lineno"> 200</span> <span class="keywordflow">if</span> (stat == <a class="code hl_enumvalue" href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4af8af3004a5fccfada6848162d6bb2202">SSCAN_SUCCESS</a>) scanned_count++;</div>
|
|
|
|
|
<div class="line"><a id="l00201" name="l00201"></a><span class="lineno"> 201</span> count++;</div>
|
|
|
|
|
<div class="line"><a id="l00202" name="l00202"></a><span class="lineno"> 202</span> </div>
|
|
|
|
|
<div class="line"><a id="l00203" name="l00203"></a><span class="lineno"> 203</span> } <span class="keywordflow">while</span> (Process32Next(hProcessSnapShot, &pe32));</div>
|
|
|
|
|
<div class="line"><a id="l00204" name="l00204"></a><span class="lineno"> 204</span> </div>
|
|
|
|
|
<div class="line"><a id="l00205" name="l00205"></a><span class="lineno"> 205</span> <span class="comment">//close the handles</span></div>
|
|
|
|
|
<div class="line"><a id="l00206" name="l00206"></a><span class="lineno"> 206</span> CloseHandle(hProcessSnapShot);</div>
|
|
|
|
|
<div class="line"><a id="l00207" name="l00207"></a><span class="lineno"> 207</span> </div>
|
|
|
|
|
<div class="line"><a id="l00208" name="l00208"></a><span class="lineno"> 208</span> <a class="code hl_function" href="class_h_h_scanner.html#a6700be392afaa57e77ddc4c649e718f1">printScanRoundStats</a>(scanned_count, ignored_count);</div>
|
|
|
|
|
<div class="line"><a id="l00209" name="l00209"></a><span class="lineno"> 209</span> <span class="keywordflow">return</span> count;</div>
|
|
|
|
|
<div class="line"><a id="l00210" name="l00210"></a><span class="lineno"> 210</span>}</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00211" name="l00211"></a><span class="lineno"> 211</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00212" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00212" name="l00212"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#af1a026170edfe507268e6e21c5052bbb"> 212</a></span><span class="keywordtype">void</span> <a class="code hl_function" href="class_h_h_scanner.html#af1a026170edfe507268e6e21c5052bbb">HHScanner::printSingleReport</a>(pesieve::t_report& report)</div>
|
|
|
|
|
<div class="line"><a id="l00213" name="l00213"></a><span class="lineno"> 213</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00214" name="l00214"></a><span class="lineno"> 214</span> <span class="keywordflow">if</span> (<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a9c00556752d2c127c5c5b205c166976b">quiet</a>) <span class="keywordflow">return</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00215" name="l00215"></a><span class="lineno"> 215</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00216" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00216" name="l00216"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#ab704a295bea1cea7d7b7d00fc97a5683"> 216</a></span><span class="keywordtype">void</span> <a class="code hl_function" href="class_h_h_scanner.html#ab704a295bea1cea7d7b7d00fc97a5683">HHScanner::initOutDir</a>(time_t scan_time, pesieve::t_params &pesieve_args)</div>
|
|
|
|
|
<div class="line"><a id="l00217" name="l00217"></a><span class="lineno"> 217</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00218" name="l00218"></a><span class="lineno"> 218</span> <span class="comment">//set unique path</span></div>
|
|
|
|
|
<div class="line"><a id="l00219" name="l00219"></a><span class="lineno"> 219</span> <span class="keywordflow">if</span> (<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#adc6d18cfa1bcec72107e2022418bf8f3">unique_dir</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00220" name="l00220"></a><span class="lineno"> 220</span> this-><a class="code hl_variable" href="class_h_h_scanner.html#a238a4958607b0f74d44c27c1505b1906">outDir</a> = <a class="code hl_function" href="namespacefiles__util.html#a9c2cf1240e4b850893c4e7a0a2ab641b">files_util::make_dir_name</a>(<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a7777b45895ca0788d061e1f4c5f60a7b">out_dir</a>, scan_time);</div>
|
|
|
|
|
<div class="line"><a id="l00221" name="l00221"></a><span class="lineno"> 221</span> <a class="code hl_function" href="namespacefiles__util.html#abab65a3cbe43de11dd5d25ed5e4d47e5">files_util::set_output_dir</a>(pesieve_args, <a class="code hl_variable" href="class_h_h_scanner.html#a238a4958607b0f74d44c27c1505b1906">outDir</a>);</div>
|
|
|
|
|
<div class="line"><a id="l00222" name="l00222"></a><span class="lineno"> 222</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00223" name="l00223"></a><span class="lineno"> 223</span> <span class="keywordflow">else</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00224" name="l00224"></a><span class="lineno"> 224</span> this-><a class="code hl_variable" href="class_h_h_scanner.html#a238a4958607b0f74d44c27c1505b1906">outDir</a> = <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a7777b45895ca0788d061e1f4c5f60a7b">out_dir</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00225" name="l00225"></a><span class="lineno"> 225</span> <a class="code hl_function" href="namespacefiles__util.html#abab65a3cbe43de11dd5d25ed5e4d47e5">files_util::set_output_dir</a>(pesieve_args, <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a7777b45895ca0788d061e1f4c5f60a7b">out_dir</a>);</div>
|
|
|
|
|
<div class="line"><a id="l00226" name="l00226"></a><span class="lineno"> 226</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00227" name="l00227"></a><span class="lineno"> 227</span>}</div>
|
|
|
|
|
<div class="line"><a id="l00216" name="l00216"></a><span class="lineno"> 216</span> <span class="keywordflow">if</span> (report.errors == pesieve::ERROR_SCAN_FAILURE) {</div>
|
|
|
|
|
<div class="line"><a id="l00217" name="l00217"></a><span class="lineno"> 217</span> WORD old_color = <a class="code hl_function" href="term__util_8cpp.html#a72fb5a7886c4d8ed5e351d64ad5c536b">set_color</a>(<a class="code hl_define" href="term__util_8h.html#a57815732ee1775789c29534c08b0a856">MAKE_COLOR</a>(<a class="code hl_define" href="term__util_8h.html#a7e76a14a479114a4b9b20782bb00e69a">SILVER</a>, <a class="code hl_define" href="term__util_8h.html#adf1abd1d6844a43cca874c266bb57b9b">DARK_RED</a>));</div>
|
|
|
|
|
<div class="line"><a id="l00218" name="l00218"></a><span class="lineno"> 218</span> <span class="keywordflow">if</span> (report.errors == pesieve::ERROR_SCAN_FAILURE) {</div>
|
|
|
|
|
<div class="line"><a id="l00219" name="l00219"></a><span class="lineno"> 219</span> std::cout << <span class="stringliteral">"[!] Could not access: "</span> << std::dec << report.pid;</div>
|
|
|
|
|
<div class="line"><a id="l00220" name="l00220"></a><span class="lineno"> 220</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00221" name="l00221"></a><span class="lineno"> 221</span> <a class="code hl_function" href="term__util_8cpp.html#a72fb5a7886c4d8ed5e351d64ad5c536b">set_color</a>(old_color);</div>
|
|
|
|
|
<div class="line"><a id="l00222" name="l00222"></a><span class="lineno"> 222</span> std::cout << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00223" name="l00223"></a><span class="lineno"> 223</span> <span class="keywordflow">return</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00224" name="l00224"></a><span class="lineno"> 224</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00225" name="l00225"></a><span class="lineno"> 225</span><span class="preprocessor">#ifndef _WIN64</span></div>
|
|
|
|
|
<div class="line"><a id="l00226" name="l00226"></a><span class="lineno"> 226</span> <span class="keywordflow">if</span> (report.is_64bit) {</div>
|
|
|
|
|
<div class="line"><a id="l00227" name="l00227"></a><span class="lineno"> 227</span> WORD old_color = <a class="code hl_function" href="term__util_8cpp.html#a72fb5a7886c4d8ed5e351d64ad5c536b">set_color</a>(<a class="code hl_define" href="term__util_8h.html#a57815732ee1775789c29534c08b0a856">MAKE_COLOR</a>(<a class="code hl_define" href="term__util_8h.html#a7e76a14a479114a4b9b20782bb00e69a">SILVER</a>, <a class="code hl_define" href="term__util_8h.html#a908d63d1e1a62efbe7c61685f9144a7d">DARK_MAGENTA</a>));</div>
|
|
|
|
|
<div class="line"><a id="l00228" name="l00228"></a><span class="lineno"> 228</span> std::cout << <span class="stringliteral">"[!] Partial scan: "</span> << std::dec << report.pid << <span class="stringliteral">" : "</span> << (report.is_64bit ? 64 : 32) << <span class="stringliteral">"b"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00229" name="l00229"></a><span class="lineno"> 229</span> <a class="code hl_function" href="term__util_8cpp.html#a72fb5a7886c4d8ed5e351d64ad5c536b">set_color</a>(old_color);</div>
|
|
|
|
|
<div class="line"><a id="l00230" name="l00230"></a><span class="lineno"> 230</span> std::cout << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00231" name="l00231"></a><span class="lineno"> 231</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00232" name="l00232"></a><span class="lineno"> 232</span><span class="preprocessor">#endif</span></div>
|
|
|
|
|
<div class="line"><a id="l00233" name="l00233"></a><span class="lineno"> 233</span> <span class="keywordflow">if</span> (report.suspicious) {</div>
|
|
|
|
|
<div class="line"><a id="l00234" name="l00234"></a><span class="lineno"> 234</span> <span class="keywordtype">int</span> color = <a class="code hl_define" href="term__util_8h.html#abf681265909adf3d3e8116c93c0ba179">YELLOW</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00235" name="l00235"></a><span class="lineno"> 235</span> <span class="keywordflow">if</span> (report.replaced || report.implanted) {</div>
|
|
|
|
|
<div class="line"><a id="l00236" name="l00236"></a><span class="lineno"> 236</span> color = <a class="code hl_define" href="term__util_8h.html#a8d23feea868a983c8c2b661e1e16972f">RED</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00237" name="l00237"></a><span class="lineno"> 237</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00238" name="l00238"></a><span class="lineno"> 238</span> <span class="keywordflow">if</span> (report.is_managed) {</div>
|
|
|
|
|
<div class="line"><a id="l00239" name="l00239"></a><span class="lineno"> 239</span> color = <a class="code hl_define" href="term__util_8h.html#a57815732ee1775789c29534c08b0a856">MAKE_COLOR</a>(color, <a class="code hl_define" href="term__util_8h.html#ab17de36a1b487f9ad9ef7dabd63531ab">DARK_BLUE</a>);</div>
|
|
|
|
|
<div class="line"><a id="l00240" name="l00240"></a><span class="lineno"> 240</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00241" name="l00241"></a><span class="lineno"> 241</span> WORD old_color = <a class="code hl_function" href="term__util_8cpp.html#a72fb5a7886c4d8ed5e351d64ad5c536b">set_color</a>(color);</div>
|
|
|
|
|
<div class="line"><a id="l00242" name="l00242"></a><span class="lineno"> 242</span> std::cout << <span class="stringliteral">">> Detected: "</span> << std::dec << report.pid;</div>
|
|
|
|
|
<div class="line"><a id="l00243" name="l00243"></a><span class="lineno"> 243</span> <span class="keywordflow">if</span> (report.is_managed) {</div>
|
|
|
|
|
<div class="line"><a id="l00244" name="l00244"></a><span class="lineno"> 244</span> std::cout << <span class="stringliteral">" [.NET]"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00245" name="l00245"></a><span class="lineno"> 245</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00246" name="l00246"></a><span class="lineno"> 246</span> <a class="code hl_function" href="term__util_8cpp.html#a72fb5a7886c4d8ed5e351d64ad5c536b">set_color</a>(old_color);</div>
|
|
|
|
|
<div class="line"><a id="l00247" name="l00247"></a><span class="lineno"> 247</span> std::cout << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00248" name="l00248"></a><span class="lineno"> 248</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00249" name="l00249"></a><span class="lineno"> 249</span>}</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00228" name="l00228"></a><span class="lineno"> 228</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00229" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00229" name="l00229"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#a6700be392afaa57e77ddc4c649e718f1"> 229</a></span><span class="keywordtype">void</span> <a class="code hl_function" href="class_h_h_scanner.html#a6700be392afaa57e77ddc4c649e718f1">HHScanner::printScanRoundStats</a>(<span class="keywordtype">size_t</span> found, <span class="keywordtype">size_t</span> ignored_count)</div>
|
|
|
|
|
<div class="line"><a id="l00230" name="l00230"></a><span class="lineno"> 230</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00231" name="l00231"></a><span class="lineno"> 231</span> <span class="keywordflow">if</span> (!found && <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#aaada133523530dfd49401621b336d74b">names_list</a>.size() > 0) {</div>
|
|
|
|
|
<div class="line"><a id="l00232" name="l00232"></a><span class="lineno"> 232</span> <span class="keywordflow">if</span> (!<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a9c00556752d2c127c5c5b205c166976b">quiet</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00233" name="l00233"></a><span class="lineno"> 233</span> std::cout << <span class="stringliteral">"[WARNING] No process from the list: {"</span> << <a class="code hl_function" href="namespaceutil.html#a4afca6eda8fe7bc220cfdb824b79fd8b">util::list_to_str</a>(<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#aaada133523530dfd49401621b336d74b">names_list</a>) << <span class="stringliteral">"} was found!"</span> << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00234" name="l00234"></a><span class="lineno"> 234</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00235" name="l00235"></a><span class="lineno"> 235</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00236" name="l00236"></a><span class="lineno"> 236</span> <span class="keywordflow">if</span> (!found && <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a179cffc6577cad21f16e07ca3ae14a67">pids_list</a>.size() > 0) {</div>
|
|
|
|
|
<div class="line"><a id="l00237" name="l00237"></a><span class="lineno"> 237</span> <span class="keywordflow">if</span> (!<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a9c00556752d2c127c5c5b205c166976b">quiet</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00238" name="l00238"></a><span class="lineno"> 238</span> std::cout << <span class="stringliteral">"[WARNING] No process from the list: {"</span> << <a class="code hl_function" href="namespaceutil.html#a4afca6eda8fe7bc220cfdb824b79fd8b">util::list_to_str</a>(<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a179cffc6577cad21f16e07ca3ae14a67">pids_list</a>) << <span class="stringliteral">"} was found!"</span> << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00239" name="l00239"></a><span class="lineno"> 239</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00240" name="l00240"></a><span class="lineno"> 240</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00241" name="l00241"></a><span class="lineno"> 241</span> <span class="keywordflow">if</span> (ignored_count > 0) {</div>
|
|
|
|
|
<div class="line"><a id="l00242" name="l00242"></a><span class="lineno"> 242</span> <span class="keywordflow">if</span> (!<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a9c00556752d2c127c5c5b205c166976b">quiet</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00243" name="l00243"></a><span class="lineno"> 243</span> std::string info1 = (ignored_count > 1) ? <span class="stringliteral">"processes"</span> : <span class="stringliteral">"process"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00244" name="l00244"></a><span class="lineno"> 244</span> std::string info2 = (ignored_count > 1) ? <span class="stringliteral">"were"</span> : <span class="stringliteral">"was"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00245" name="l00245"></a><span class="lineno"> 245</span> std::cout << <span class="stringliteral">"[INFO] "</span> << std::dec << ignored_count << <span class="stringliteral">" "</span> << info1 << <span class="stringliteral">" from the list : {"</span> << <a class="code hl_function" href="namespaceutil.html#a4afca6eda8fe7bc220cfdb824b79fd8b">util::list_to_str</a>(<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a5d1f3507578157518e3104ca58696003">ignored_names_list</a>) << <span class="stringliteral">"} "</span> << info2 << <span class="stringliteral">" ignored!"</span> << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00246" name="l00246"></a><span class="lineno"> 246</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00247" name="l00247"></a><span class="lineno"> 247</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00248" name="l00248"></a><span class="lineno"> 248</span>}</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00249" name="l00249"></a><span class="lineno"> 249</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00250" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00250" name="l00250"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#a8528d5f27f05bfefcd2278318dc61846"> 250</a></span><span class="keywordtype">size_t</span> <a class="code hl_function" href="class_h_h_scanner.html#a8528d5f27f05bfefcd2278318dc61846">HHScanner::scanProcesses</a>(<a class="code hl_class" href="class_h_h_scan_report.html">HHScanReport</a> &my_report)</div>
|
|
|
|
|
<div class="line"><a id="l00251" name="l00251"></a><span class="lineno"> 251</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00252" name="l00252"></a><span class="lineno"> 252</span> <span class="keywordtype">size_t</span> count = 0;</div>
|
|
|
|
|
<div class="line"><a id="l00253" name="l00253"></a><span class="lineno"> 253</span> <span class="keywordtype">size_t</span> scanned_count = 0;</div>
|
|
|
|
|
<div class="line"><a id="l00254" name="l00254"></a><span class="lineno"> 254</span> <span class="keywordtype">size_t</span> ignored_count = 0;</div>
|
|
|
|
|
<div class="line"><a id="l00255" name="l00255"></a><span class="lineno"> 255</span> </div>
|
|
|
|
|
<div class="line"><a id="l00256" name="l00256"></a><span class="lineno"> 256</span> HANDLE hProcessSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);</div>
|
|
|
|
|
<div class="line"><a id="l00257" name="l00257"></a><span class="lineno"> 257</span> <span class="keywordflow">if</span> (hProcessSnapShot == INVALID_HANDLE_VALUE) {</div>
|
|
|
|
|
<div class="line"><a id="l00258" name="l00258"></a><span class="lineno"> 258</span> <span class="keyword">const</span> DWORD err = GetLastError();</div>
|
|
|
|
|
<div class="line"><a id="l00259" name="l00259"></a><span class="lineno"> 259</span> std::cerr << <span class="stringliteral">"[-] Could not create modules snapshot. Error: "</span> << std::dec << err << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00260" name="l00260"></a><span class="lineno"> 260</span> <span class="keywordflow">return</span> 0;</div>
|
|
|
|
|
<div class="line"><a id="l00250" name="l00250"></a><span class="lineno"> 250</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00251" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00251" name="l00251"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#a4881091d77448e0812ab5581f01893c7"> 251</a></span><a class="code hl_typedef" href="hh__scanner_8h.html#ad5caa6b1d4b11989c8ff90d46fc231aa">t_single_scan_status</a> <a class="code hl_function" href="class_h_h_scanner.html#a4881091d77448e0812ab5581f01893c7">HHScanner::scanNextProcess</a>(DWORD pid, WCHAR* exe_file, <a class="code hl_class" href="class_h_h_scan_report.html">HHScanReport</a> &my_report)</div>
|
|
|
|
|
<div class="line"><a id="l00252" name="l00252"></a><span class="lineno"> 252</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00253" name="l00253"></a><span class="lineno"> 253</span> <span class="keywordtype">bool</span> found = <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00254" name="l00254"></a><span class="lineno"> 254</span> </div>
|
|
|
|
|
<div class="line"><a id="l00255" name="l00255"></a><span class="lineno"> 255</span> <span class="keyword">const</span> <span class="keywordtype">bool</span> is_process_wow64 = <a class="code hl_function" href="namespaceprocess__util.html#af9bdd83e9c8262ef548737112964d2f9">process_util::is_wow_64_by_pid</a>(pid);</div>
|
|
|
|
|
<div class="line"><a id="l00256" name="l00256"></a><span class="lineno"> 256</span> </div>
|
|
|
|
|
<div class="line"><a id="l00257" name="l00257"></a><span class="lineno"> 257</span> <span class="keyword">const</span> <span class="keywordtype">bool</span> check_time = (<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#aeaa430eb92a01d64b063bc3537ceb4c8">ptimes</a> != <a class="code hl_define" href="hh__params_8h.html#a6144407ab3bcb041574c2367ac1e455f">TIME_UNDEFINED</a>) ? <span class="keyword">true</span> : <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00258" name="l00258"></a><span class="lineno"> 258</span><span class="preprocessor">#ifdef _DEBUG</span></div>
|
|
|
|
|
<div class="line"><a id="l00259" name="l00259"></a><span class="lineno"> 259</span> <span class="keywordflow">if</span> (check_time) {</div>
|
|
|
|
|
<div class="line"><a id="l00260" name="l00260"></a><span class="lineno"> 260</span> std::cout << <span class="stringliteral">"Init Time: "</span> << std::hex << this-><a class="code hl_variable" href="class_h_h_scanner.html#a989d1551cc43e9497ca232db41ee9e5b">initTime</a> << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00261" name="l00261"></a><span class="lineno"> 261</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00262" name="l00262"></a><span class="lineno"> 262</span> </div>
|
|
|
|
|
<div class="line"><a id="l00263" name="l00263"></a><span class="lineno"> 263</span> PROCESSENTRY32 pe32 = { 0 };</div>
|
|
|
|
|
<div class="line"><a id="l00264" name="l00264"></a><span class="lineno"> 264</span> pe32.dwSize = <span class="keyword">sizeof</span>(PROCESSENTRY32);</div>
|
|
|
|
|
<div class="line"><a id="l00265" name="l00265"></a><span class="lineno"> 265</span> </div>
|
|
|
|
|
<div class="line"><a id="l00266" name="l00266"></a><span class="lineno"> 266</span> <span class="comment">//check all modules in the process, including the main module:</span></div>
|
|
|
|
|
<div class="line"><a id="l00267" name="l00267"></a><span class="lineno"> 267</span> <span class="keywordflow">if</span> (!Process32First(hProcessSnapShot, &pe32)) {</div>
|
|
|
|
|
<div class="line"><a id="l00268" name="l00268"></a><span class="lineno"> 268</span> CloseHandle(hProcessSnapShot);</div>
|
|
|
|
|
<div class="line"><a id="l00269" name="l00269"></a><span class="lineno"> 269</span> std::cerr << <span class="stringliteral">"[-] Could not enumerate processes. Error: "</span> << GetLastError() << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00270" name="l00270"></a><span class="lineno"> 270</span> <span class="keywordflow">return</span> 0;</div>
|
|
|
|
|
<div class="line"><a id="l00271" name="l00271"></a><span class="lineno"> 271</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00272" name="l00272"></a><span class="lineno"> 272</span> <span class="keywordflow">do</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00273" name="l00273"></a><span class="lineno"> 273</span> <span class="comment">// scan callback</span></div>
|
|
|
|
|
<div class="line"><a id="l00274" name="l00274"></a><span class="lineno"> 274</span> <span class="keyword">const</span> <a class="code hl_typedef" href="hh__scanner_8h.html#ad5caa6b1d4b11989c8ff90d46fc231aa">t_single_scan_status</a> stat = <a class="code hl_function" href="class_h_h_scanner.html#a4881091d77448e0812ab5581f01893c7">scanNextProcess</a>(pe32.th32ProcessID, pe32.szExeFile, my_report);</div>
|
|
|
|
|
<div class="line"><a id="l00275" name="l00275"></a><span class="lineno"> 275</span> <span class="keywordflow">if</span> (stat == <a class="code hl_enumvalue" href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4a92a79c026616fa779bd92df2b65a626b">SSCAN_IGNORED</a>) ignored_count++;</div>
|
|
|
|
|
<div class="line"><a id="l00276" name="l00276"></a><span class="lineno"> 276</span> <span class="keywordflow">if</span> (stat == <a class="code hl_enumvalue" href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4af8af3004a5fccfada6848162d6bb2202">SSCAN_SUCCESS</a>) scanned_count++;</div>
|
|
|
|
|
<div class="line"><a id="l00277" name="l00277"></a><span class="lineno"> 277</span> count++;</div>
|
|
|
|
|
<div class="line"><a id="l00278" name="l00278"></a><span class="lineno"> 278</span> </div>
|
|
|
|
|
<div class="line"><a id="l00279" name="l00279"></a><span class="lineno"> 279</span> } <span class="keywordflow">while</span> (Process32Next(hProcessSnapShot, &pe32));</div>
|
|
|
|
|
<div class="line"><a id="l00280" name="l00280"></a><span class="lineno"> 280</span> </div>
|
|
|
|
|
<div class="line"><a id="l00281" name="l00281"></a><span class="lineno"> 281</span> <span class="comment">//close the handles</span></div>
|
|
|
|
|
<div class="line"><a id="l00282" name="l00282"></a><span class="lineno"> 282</span> CloseHandle(hProcessSnapShot);</div>
|
|
|
|
|
<div class="line"><a id="l00283" name="l00283"></a><span class="lineno"> 283</span> </div>
|
|
|
|
|
<div class="line"><a id="l00284" name="l00284"></a><span class="lineno"> 284</span> <a class="code hl_function" href="class_h_h_scanner.html#a6700be392afaa57e77ddc4c649e718f1">printScanRoundStats</a>(scanned_count, ignored_count);</div>
|
|
|
|
|
<div class="line"><a id="l00285" name="l00285"></a><span class="lineno"> 285</span> <span class="keywordflow">return</span> count;</div>
|
|
|
|
|
<div class="line"><a id="l00286" name="l00286"></a><span class="lineno"> 286</span>}</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00287" name="l00287"></a><span class="lineno"> 287</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00288" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00288" name="l00288"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#af1a026170edfe507268e6e21c5052bbb"> 288</a></span><span class="keywordtype">void</span> <a class="code hl_function" href="class_h_h_scanner.html#af1a026170edfe507268e6e21c5052bbb">HHScanner::printSingleReport</a>(pesieve::t_report& report)</div>
|
|
|
|
|
<div class="line"><a id="l00289" name="l00289"></a><span class="lineno"> 289</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00290" name="l00290"></a><span class="lineno"> 290</span> <span class="keywordflow">if</span> (<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a9c00556752d2c127c5c5b205c166976b">quiet</a>) <span class="keywordflow">return</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00262" name="l00262"></a><span class="lineno"> 262</span><span class="preprocessor">#endif</span></div>
|
|
|
|
|
<div class="line"><a id="l00263" name="l00263"></a><span class="lineno"> 263</span> <span class="comment">// filter by the time</span></div>
|
|
|
|
|
<div class="line"><a id="l00264" name="l00264"></a><span class="lineno"> 264</span> time_t time_diff = 0;</div>
|
|
|
|
|
<div class="line"><a id="l00265" name="l00265"></a><span class="lineno"> 265</span> <span class="keywordflow">if</span> (check_time) { <span class="comment">// if the parameter was set</span></div>
|
|
|
|
|
<div class="line"><a id="l00266" name="l00266"></a><span class="lineno"> 266</span> <span class="keyword">const</span> time_t process_time = <a class="code hl_function" href="namespaceutil.html#a1b58bbd7118af7892e3926017211542b">util::process_start_time</a>(pid);</div>
|
|
|
|
|
<div class="line"><a id="l00267" name="l00267"></a><span class="lineno"> 267</span> <span class="keywordflow">if</span> (process_time == <a class="code hl_define" href="time__util_8h.html#a0dd0def9d0d1f83eab3aa811bedbc3e4">INVALID_TIME</a>) <span class="keywordflow">return</span> <a class="code hl_enumvalue" href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4ae5df3c6d61ca83c8c222906ea943c7c8">SSCAN_ERROR0</a>; <span class="comment">//skip process if cannot retrieve the time</span></div>
|
|
|
|
|
<div class="line"><a id="l00268" name="l00268"></a><span class="lineno"> 268</span> </div>
|
|
|
|
|
<div class="line"><a id="l00269" name="l00269"></a><span class="lineno"> 269</span> <span class="comment">// if HH was started after the process</span></div>
|
|
|
|
|
<div class="line"><a id="l00270" name="l00270"></a><span class="lineno"> 270</span> <span class="keywordflow">if</span> (this-><a class="code hl_variable" href="class_h_h_scanner.html#a989d1551cc43e9497ca232db41ee9e5b">initTime</a> > process_time) {</div>
|
|
|
|
|
<div class="line"><a id="l00271" name="l00271"></a><span class="lineno"> 271</span> time_diff = this-><a class="code hl_variable" href="class_h_h_scanner.html#a989d1551cc43e9497ca232db41ee9e5b">initTime</a> - process_time;</div>
|
|
|
|
|
<div class="line"><a id="l00272" name="l00272"></a><span class="lineno"> 272</span> <span class="keywordflow">if</span> (time_diff > <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#aeaa430eb92a01d64b063bc3537ceb4c8">ptimes</a>) <span class="keywordflow">return</span> <a class="code hl_enumvalue" href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4a4cd58d13fa112594c7c4a6800e445842">SSCAN_NOT_MATCH</a>; <span class="comment">// skip process created before the supplied time</span></div>
|
|
|
|
|
<div class="line"><a id="l00273" name="l00273"></a><span class="lineno"> 273</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00274" name="l00274"></a><span class="lineno"> 274</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00275" name="l00275"></a><span class="lineno"> 275</span> <span class="comment">//filter by the names/PIDs</span></div>
|
|
|
|
|
<div class="line"><a id="l00276" name="l00276"></a><span class="lineno"> 276</span> <span class="keywordflow">if</span> (<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#aaada133523530dfd49401621b336d74b">names_list</a>.size() || <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a179cffc6577cad21f16e07ca3ae14a67">pids_list</a>.size()) {</div>
|
|
|
|
|
<div class="line"><a id="l00277" name="l00277"></a><span class="lineno"> 277</span> <span class="keywordflow">if</span> (!<a class="code hl_function" href="namespaceutil.html#a3849afaac9ec9e32eadd5e0abe8e1aa7">util::is_searched_name</a>(exe_file, <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#aaada133523530dfd49401621b336d74b">names_list</a>) && !<a class="code hl_function" href="namespaceutil.html#afe3e470c6b385ed25f7d5f1d93b420cd">util::is_searched_pid</a>(pid, <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a179cffc6577cad21f16e07ca3ae14a67">pids_list</a>)) {</div>
|
|
|
|
|
<div class="line"><a id="l00278" name="l00278"></a><span class="lineno"> 278</span> <span class="comment">//it is not the searched process, so skip it</span></div>
|
|
|
|
|
<div class="line"><a id="l00279" name="l00279"></a><span class="lineno"> 279</span> <span class="keywordflow">return</span> <a class="code hl_enumvalue" href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4a4cd58d13fa112594c7c4a6800e445842">SSCAN_NOT_MATCH</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00280" name="l00280"></a><span class="lineno"> 280</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00281" name="l00281"></a><span class="lineno"> 281</span> found = <span class="keyword">true</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00282" name="l00282"></a><span class="lineno"> 282</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00283" name="l00283"></a><span class="lineno"> 283</span> <span class="keywordflow">if</span> (!found && <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a5d1f3507578157518e3104ca58696003">ignored_names_list</a>.size()) {</div>
|
|
|
|
|
<div class="line"><a id="l00284" name="l00284"></a><span class="lineno"> 284</span> <span class="keywordflow">if</span> (<a class="code hl_function" href="namespaceutil.html#a3849afaac9ec9e32eadd5e0abe8e1aa7">util::is_searched_name</a>(exe_file, <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a5d1f3507578157518e3104ca58696003">ignored_names_list</a>)) {</div>
|
|
|
|
|
<div class="line"><a id="l00285" name="l00285"></a><span class="lineno"> 285</span> <span class="keywordflow">return</span> <a class="code hl_enumvalue" href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4a92a79c026616fa779bd92df2b65a626b">SSCAN_IGNORED</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00286" name="l00286"></a><span class="lineno"> 286</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00287" name="l00287"></a><span class="lineno"> 287</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00288" name="l00288"></a><span class="lineno"> 288</span> <span class="keywordflow">if</span> (!<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a9c00556752d2c127c5c5b205c166976b">quiet</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00289" name="l00289"></a><span class="lineno"> 289</span> std::cout << <span class="stringliteral">">> Scanning PID: "</span> << std::setw(<a class="code hl_define" href="hh__scanner_8cpp.html#ac02ff12a84f72a554a357650a1631c2f">PID_FIELD_SIZE</a>) << std::dec << pid;</div>
|
|
|
|
|
<div class="line"><a id="l00290" name="l00290"></a><span class="lineno"> 290</span> std::wcout << <span class="stringliteral">" : "</span> << exe_file;</div>
|
|
|
|
|
<div class="line"><a id="l00291" name="l00291"></a><span class="lineno"> 291</span> </div>
|
|
|
|
|
<div class="line"><a id="l00292" name="l00292"></a><span class="lineno"> 292</span> <span class="keywordflow">if</span> (report.errors == pesieve::ERROR_SCAN_FAILURE) {</div>
|
|
|
|
|
<div class="line"><a id="l00293" name="l00293"></a><span class="lineno"> 293</span> WORD old_color = <a class="code hl_function" href="term__util_8cpp.html#a72fb5a7886c4d8ed5e351d64ad5c536b">set_color</a>(<a class="code hl_define" href="term__util_8h.html#a57815732ee1775789c29534c08b0a856">MAKE_COLOR</a>(<a class="code hl_define" href="term__util_8h.html#a7e76a14a479114a4b9b20782bb00e69a">SILVER</a>, <a class="code hl_define" href="term__util_8h.html#adf1abd1d6844a43cca874c266bb57b9b">DARK_RED</a>));</div>
|
|
|
|
|
<div class="line"><a id="l00294" name="l00294"></a><span class="lineno"> 294</span> <span class="keywordflow">if</span> (report.errors == pesieve::ERROR_SCAN_FAILURE) {</div>
|
|
|
|
|
<div class="line"><a id="l00295" name="l00295"></a><span class="lineno"> 295</span> std::cout << <span class="stringliteral">"[!] Could not access: "</span> << std::dec << report.pid;</div>
|
|
|
|
|
<div class="line"><a id="l00296" name="l00296"></a><span class="lineno"> 296</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00297" name="l00297"></a><span class="lineno"> 297</span> <a class="code hl_function" href="term__util_8cpp.html#a72fb5a7886c4d8ed5e351d64ad5c536b">set_color</a>(old_color);</div>
|
|
|
|
|
<div class="line"><a id="l00292" name="l00292"></a><span class="lineno"> 292</span> <span class="keywordflow">if</span> (is_process_wow64) {</div>
|
|
|
|
|
<div class="line"><a id="l00293" name="l00293"></a><span class="lineno"> 293</span> std::cout << <span class="stringliteral">" : 32b"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00294" name="l00294"></a><span class="lineno"> 294</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00295" name="l00295"></a><span class="lineno"> 295</span> <span class="keywordflow">if</span> (check_time) {</div>
|
|
|
|
|
<div class="line"><a id="l00296" name="l00296"></a><span class="lineno"> 296</span> std::cout << <span class="stringliteral">" : "</span> << time_diff << <span class="stringliteral">"s"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00297" name="l00297"></a><span class="lineno"> 297</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00298" name="l00298"></a><span class="lineno"> 298</span> std::cout << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00299" name="l00299"></a><span class="lineno"> 299</span> <span class="keywordflow">return</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00300" name="l00300"></a><span class="lineno"> 300</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00301" name="l00301"></a><span class="lineno"> 301</span><span class="preprocessor">#ifndef _WIN64</span></div>
|
|
|
|
|
<div class="line"><a id="l00302" name="l00302"></a><span class="lineno"> 302</span> <span class="keywordflow">if</span> (report.is_64bit) {</div>
|
|
|
|
|
<div class="line"><a id="l00303" name="l00303"></a><span class="lineno"> 303</span> WORD old_color = <a class="code hl_function" href="term__util_8cpp.html#a72fb5a7886c4d8ed5e351d64ad5c536b">set_color</a>(<a class="code hl_define" href="term__util_8h.html#a57815732ee1775789c29534c08b0a856">MAKE_COLOR</a>(<a class="code hl_define" href="term__util_8h.html#a7e76a14a479114a4b9b20782bb00e69a">SILVER</a>, <a class="code hl_define" href="term__util_8h.html#a908d63d1e1a62efbe7c61685f9144a7d">DARK_MAGENTA</a>));</div>
|
|
|
|
|
<div class="line"><a id="l00304" name="l00304"></a><span class="lineno"> 304</span> std::cout << <span class="stringliteral">"[!] Partial scan: "</span> << std::dec << report.pid << <span class="stringliteral">" : "</span> << (report.is_64bit ? 64 : 32) << <span class="stringliteral">"b"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00305" name="l00305"></a><span class="lineno"> 305</span> <a class="code hl_function" href="term__util_8cpp.html#a72fb5a7886c4d8ed5e351d64ad5c536b">set_color</a>(old_color);</div>
|
|
|
|
|
<div class="line"><a id="l00306" name="l00306"></a><span class="lineno"> 306</span> std::cout << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00307" name="l00307"></a><span class="lineno"> 307</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00308" name="l00308"></a><span class="lineno"> 308</span><span class="preprocessor">#endif</span></div>
|
|
|
|
|
<div class="line"><a id="l00309" name="l00309"></a><span class="lineno"> 309</span> <span class="keywordflow">if</span> (report.suspicious) {</div>
|
|
|
|
|
<div class="line"><a id="l00310" name="l00310"></a><span class="lineno"> 310</span> <span class="keywordtype">int</span> color = <a class="code hl_define" href="term__util_8h.html#abf681265909adf3d3e8116c93c0ba179">YELLOW</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00311" name="l00311"></a><span class="lineno"> 311</span> <span class="keywordflow">if</span> (report.replaced || report.implanted) {</div>
|
|
|
|
|
<div class="line"><a id="l00312" name="l00312"></a><span class="lineno"> 312</span> color = <a class="code hl_define" href="term__util_8h.html#a8d23feea868a983c8c2b661e1e16972f">RED</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00313" name="l00313"></a><span class="lineno"> 313</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00314" name="l00314"></a><span class="lineno"> 314</span> <span class="keywordflow">if</span> (report.is_managed) {</div>
|
|
|
|
|
<div class="line"><a id="l00315" name="l00315"></a><span class="lineno"> 315</span> color = <a class="code hl_define" href="term__util_8h.html#a57815732ee1775789c29534c08b0a856">MAKE_COLOR</a>(color, <a class="code hl_define" href="term__util_8h.html#ab17de36a1b487f9ad9ef7dabd63531ab">DARK_BLUE</a>);</div>
|
|
|
|
|
<div class="line"><a id="l00316" name="l00316"></a><span class="lineno"> 316</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00317" name="l00317"></a><span class="lineno"> 317</span> WORD old_color = <a class="code hl_function" href="term__util_8cpp.html#a72fb5a7886c4d8ed5e351d64ad5c536b">set_color</a>(color);</div>
|
|
|
|
|
<div class="line"><a id="l00318" name="l00318"></a><span class="lineno"> 318</span> std::cout << <span class="stringliteral">">> Detected: "</span> << std::dec << report.pid;</div>
|
|
|
|
|
<div class="line"><a id="l00319" name="l00319"></a><span class="lineno"> 319</span> <span class="keywordflow">if</span> (report.is_managed) {</div>
|
|
|
|
|
<div class="line"><a id="l00320" name="l00320"></a><span class="lineno"> 320</span> std::cout << <span class="stringliteral">" [.NET]"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00321" name="l00321"></a><span class="lineno"> 321</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00322" name="l00322"></a><span class="lineno"> 322</span> <a class="code hl_function" href="term__util_8cpp.html#a72fb5a7886c4d8ed5e351d64ad5c536b">set_color</a>(old_color);</div>
|
|
|
|
|
<div class="line"><a id="l00323" name="l00323"></a><span class="lineno"> 323</span> std::cout << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00324" name="l00324"></a><span class="lineno"> 324</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00299" name="l00299"></a><span class="lineno"> 299</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00300" name="l00300"></a><span class="lineno"> 300</span> <span class="comment">//perform the scan:</span></div>
|
|
|
|
|
<div class="line"><a id="l00301" name="l00301"></a><span class="lineno"> 301</span> pesieve::t_params &pesieve_args = this-><a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a6e835a4060ea3db6af99e5ff8aae8834">pesieve_args</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00302" name="l00302"></a><span class="lineno"> 302</span> pesieve_args.pid = pid;</div>
|
|
|
|
|
<div class="line"><a id="l00303" name="l00303"></a><span class="lineno"> 303</span> </div>
|
|
|
|
|
<div class="line"><a id="l00304" name="l00304"></a><span class="lineno"> 304</span> pesieve::t_report report = PESieve_scan(pesieve_args);</div>
|
|
|
|
|
<div class="line"><a id="l00305" name="l00305"></a><span class="lineno"> 305</span> my_report.<a class="code hl_function" href="class_h_h_scan_report.html#a003c9bdcd02586fe059ce5cbf9200c94">appendReport</a>(report, exe_file);</div>
|
|
|
|
|
<div class="line"><a id="l00306" name="l00306"></a><span class="lineno"> 306</span> </div>
|
|
|
|
|
<div class="line"><a id="l00307" name="l00307"></a><span class="lineno"> 307</span> <a class="code hl_function" href="class_h_h_scanner.html#af1a026170edfe507268e6e21c5052bbb">printSingleReport</a>(report);</div>
|
|
|
|
|
<div class="line"><a id="l00308" name="l00308"></a><span class="lineno"> 308</span> <span class="keywordflow">if</span> (report.scanned > 0) {</div>
|
|
|
|
|
<div class="line"><a id="l00309" name="l00309"></a><span class="lineno"> 309</span> <span class="keywordflow">return</span> <a class="code hl_enumvalue" href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4af8af3004a5fccfada6848162d6bb2202">SSCAN_SUCCESS</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00310" name="l00310"></a><span class="lineno"> 310</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00311" name="l00311"></a><span class="lineno"> 311</span> <span class="keywordflow">return</span> <a class="code hl_enumvalue" href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4abbe276584c09951446b598f9ff89246b">SSCAN_ERROR1</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00312" name="l00312"></a><span class="lineno"> 312</span>}</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00313" name="l00313"></a><span class="lineno"> 313</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00314" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00314" name="l00314"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#ab4515f951cf9a9c2f1761493e6f9b9eb"> 314</a></span><a class="code hl_class" href="class_h_h_scan_report.html">HHScanReport</a>* <a class="code hl_function" href="class_h_h_scanner.html#ab4515f951cf9a9c2f1761493e6f9b9eb">HHScanner::scan</a>()</div>
|
|
|
|
|
<div class="line"><a id="l00315" name="l00315"></a><span class="lineno"> 315</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00316" name="l00316"></a><span class="lineno"> 316</span> <span class="keyword">const</span> time_t scan_start = time(NULL); <span class="comment">//start time of the current scan</span></div>
|
|
|
|
|
<div class="line"><a id="l00317" name="l00317"></a><span class="lineno"> 317</span> pesieve::t_params &pesieve_args = this-><a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a6e835a4060ea3db6af99e5ff8aae8834">pesieve_args</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00318" name="l00318"></a><span class="lineno"> 318</span> <a class="code hl_function" href="class_h_h_scanner.html#ab704a295bea1cea7d7b7d00fc97a5683">initOutDir</a>(scan_start, pesieve_args);</div>
|
|
|
|
|
<div class="line"><a id="l00319" name="l00319"></a><span class="lineno"> 319</span> </div>
|
|
|
|
|
<div class="line"><a id="l00320" name="l00320"></a><span class="lineno"> 320</span> <a class="code hl_class" href="class_h_h_scan_report.html">HHScanReport</a> *my_report = <span class="keyword">new</span> <a class="code hl_class" href="class_h_h_scan_report.html">HHScanReport</a>(GetTickCount(), scan_start);</div>
|
|
|
|
|
<div class="line"><a id="l00321" name="l00321"></a><span class="lineno"> 321</span> <a class="code hl_function" href="class_h_h_scanner.html#a8528d5f27f05bfefcd2278318dc61846">scanProcesses</a>(*my_report);</div>
|
|
|
|
|
<div class="line"><a id="l00322" name="l00322"></a><span class="lineno"> 322</span> </div>
|
|
|
|
|
<div class="line"><a id="l00323" name="l00323"></a><span class="lineno"> 323</span> my_report-><a class="code hl_function" href="class_h_h_scan_report.html#a15b2afc2c28036efa8e034a2ecf3ff0c">setEndTick</a>(GetTickCount(), time(NULL));</div>
|
|
|
|
|
<div class="line"><a id="l00324" name="l00324"></a><span class="lineno"> 324</span> <span class="keywordflow">return</span> my_report;</div>
|
|
|
|
|
<div class="line"><a id="l00325" name="l00325"></a><span class="lineno"> 325</span>}</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00326" name="l00326"></a><span class="lineno"> 326</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00327" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00327" name="l00327"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#a4881091d77448e0812ab5581f01893c7"> 327</a></span><a class="code hl_typedef" href="hh__scanner_8h.html#ad5caa6b1d4b11989c8ff90d46fc231aa">t_single_scan_status</a> <a class="code hl_function" href="class_h_h_scanner.html#a4881091d77448e0812ab5581f01893c7">HHScanner::scanNextProcess</a>(DWORD pid, WCHAR* exe_file, <a class="code hl_class" href="class_h_h_scan_report.html">HHScanReport</a> &my_report)</div>
|
|
|
|
|
<div class="line"><a id="l00327" name="l00327"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#a6c20de8e1a13034173c42c2e87267af3"> 327</a></span><span class="keywordtype">void</span> <a class="code hl_function" href="class_h_h_scanner.html#a6c20de8e1a13034173c42c2e87267af3">HHScanner::summarizeScan</a>(<a class="code hl_class" href="class_h_h_scan_report.html">HHScanReport</a> *hh_report)</div>
|
|
|
|
|
<div class="line"><a id="l00328" name="l00328"></a><span class="lineno"> 328</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00329" name="l00329"></a><span class="lineno"> 329</span> <span class="keywordtype">bool</span> found = <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00330" name="l00330"></a><span class="lineno"> 330</span> </div>
|
|
|
|
|
<div class="line"><a id="l00331" name="l00331"></a><span class="lineno"> 331</span> <span class="keywordtype">bool</span> is_process_wow64 = <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00332" name="l00332"></a><span class="lineno"> 332</span> <a class="code hl_function" href="namespaceprocess__util.html#a4a258bf9fcaf9b1f5b6419f4e6a5d1e1">process_util::get_process_info</a>(pid, is_process_wow64, <span class="keyword">nullptr</span>, 0);</div>
|
|
|
|
|
<div class="line"><a id="l00333" name="l00333"></a><span class="lineno"> 333</span> </div>
|
|
|
|
|
<div class="line"><a id="l00334" name="l00334"></a><span class="lineno"> 334</span> <span class="keyword">const</span> <span class="keywordtype">bool</span> check_time = (<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#aeaa430eb92a01d64b063bc3537ceb4c8">ptimes</a> != <a class="code hl_define" href="hh__params_8h.html#a6144407ab3bcb041574c2367ac1e455f">TIME_UNDEFINED</a>) ? <span class="keyword">true</span> : <span class="keyword">false</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00335" name="l00335"></a><span class="lineno"> 335</span><span class="preprocessor">#ifdef _DEBUG</span></div>
|
|
|
|
|
<div class="line"><a id="l00336" name="l00336"></a><span class="lineno"> 336</span> <span class="keywordflow">if</span> (check_time) {</div>
|
|
|
|
|
<div class="line"><a id="l00337" name="l00337"></a><span class="lineno"> 337</span> std::cout << <span class="stringliteral">"Init Time: "</span> << std::hex << this-><a class="code hl_variable" href="class_h_h_scanner.html#a989d1551cc43e9497ca232db41ee9e5b">initTime</a> << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00338" name="l00338"></a><span class="lineno"> 338</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00339" name="l00339"></a><span class="lineno"> 339</span><span class="preprocessor">#endif</span></div>
|
|
|
|
|
<div class="line"><a id="l00340" name="l00340"></a><span class="lineno"> 340</span> <span class="comment">// filter by the time</span></div>
|
|
|
|
|
<div class="line"><a id="l00341" name="l00341"></a><span class="lineno"> 341</span> time_t time_diff = 0;</div>
|
|
|
|
|
<div class="line"><a id="l00342" name="l00342"></a><span class="lineno"> 342</span> <span class="keywordflow">if</span> (check_time) { <span class="comment">// if the parameter was set</span></div>
|
|
|
|
|
<div class="line"><a id="l00343" name="l00343"></a><span class="lineno"> 343</span> <span class="keyword">const</span> time_t process_time = <a class="code hl_function" href="namespaceutil.html#a1b58bbd7118af7892e3926017211542b">util::process_start_time</a>(pid);</div>
|
|
|
|
|
<div class="line"><a id="l00344" name="l00344"></a><span class="lineno"> 344</span> <span class="keywordflow">if</span> (process_time == <a class="code hl_define" href="time__util_8h.html#a0dd0def9d0d1f83eab3aa811bedbc3e4">INVALID_TIME</a>) <span class="keywordflow">return</span> <a class="code hl_enumvalue" href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4ae5df3c6d61ca83c8c222906ea943c7c8">SSCAN_ERROR0</a>; <span class="comment">//skip process if cannot retrieve the time</span></div>
|
|
|
|
|
<div class="line"><a id="l00345" name="l00345"></a><span class="lineno"> 345</span> </div>
|
|
|
|
|
<div class="line"><a id="l00346" name="l00346"></a><span class="lineno"> 346</span> <span class="comment">// if HH was started after the process</span></div>
|
|
|
|
|
<div class="line"><a id="l00347" name="l00347"></a><span class="lineno"> 347</span> <span class="keywordflow">if</span> (this-><a class="code hl_variable" href="class_h_h_scanner.html#a989d1551cc43e9497ca232db41ee9e5b">initTime</a> > process_time) {</div>
|
|
|
|
|
<div class="line"><a id="l00348" name="l00348"></a><span class="lineno"> 348</span> time_diff = this-><a class="code hl_variable" href="class_h_h_scanner.html#a989d1551cc43e9497ca232db41ee9e5b">initTime</a> - process_time;</div>
|
|
|
|
|
<div class="line"><a id="l00349" name="l00349"></a><span class="lineno"> 349</span> <span class="keywordflow">if</span> (time_diff > <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#aeaa430eb92a01d64b063bc3537ceb4c8">ptimes</a>) <span class="keywordflow">return</span> <a class="code hl_enumvalue" href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4a4cd58d13fa112594c7c4a6800e445842">SSCAN_NOT_MATCH</a>; <span class="comment">// skip process created before the supplied time</span></div>
|
|
|
|
|
<div class="line"><a id="l00350" name="l00350"></a><span class="lineno"> 350</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00351" name="l00351"></a><span class="lineno"> 351</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00352" name="l00352"></a><span class="lineno"> 352</span> <span class="comment">//filter by the names/PIDs</span></div>
|
|
|
|
|
<div class="line"><a id="l00353" name="l00353"></a><span class="lineno"> 353</span> <span class="keywordflow">if</span> (<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#aaada133523530dfd49401621b336d74b">names_list</a>.size() || <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a179cffc6577cad21f16e07ca3ae14a67">pids_list</a>.size()) {</div>
|
|
|
|
|
<div class="line"><a id="l00354" name="l00354"></a><span class="lineno"> 354</span> <span class="keywordflow">if</span> (!<a class="code hl_function" href="namespaceutil.html#a3849afaac9ec9e32eadd5e0abe8e1aa7">util::is_searched_name</a>(exe_file, <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#aaada133523530dfd49401621b336d74b">names_list</a>) && !<a class="code hl_function" href="namespaceutil.html#afe3e470c6b385ed25f7d5f1d93b420cd">util::is_searched_pid</a>(pid, <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a179cffc6577cad21f16e07ca3ae14a67">pids_list</a>)) {</div>
|
|
|
|
|
<div class="line"><a id="l00355" name="l00355"></a><span class="lineno"> 355</span> <span class="comment">//it is not the searched process, so skip it</span></div>
|
|
|
|
|
<div class="line"><a id="l00356" name="l00356"></a><span class="lineno"> 356</span> <span class="keywordflow">return</span> <a class="code hl_enumvalue" href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4a4cd58d13fa112594c7c4a6800e445842">SSCAN_NOT_MATCH</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00357" name="l00357"></a><span class="lineno"> 357</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00358" name="l00358"></a><span class="lineno"> 358</span> found = <span class="keyword">true</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00359" name="l00359"></a><span class="lineno"> 359</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00360" name="l00360"></a><span class="lineno"> 360</span> <span class="keywordflow">if</span> (!found && <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a5d1f3507578157518e3104ca58696003">ignored_names_list</a>.size()) {</div>
|
|
|
|
|
<div class="line"><a id="l00361" name="l00361"></a><span class="lineno"> 361</span> <span class="keywordflow">if</span> (<a class="code hl_function" href="namespaceutil.html#a3849afaac9ec9e32eadd5e0abe8e1aa7">util::is_searched_name</a>(exe_file, <a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a5d1f3507578157518e3104ca58696003">ignored_names_list</a>)) {</div>
|
|
|
|
|
<div class="line"><a id="l00362" name="l00362"></a><span class="lineno"> 362</span> <span class="keywordflow">return</span> <a class="code hl_enumvalue" href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4a92a79c026616fa779bd92df2b65a626b">SSCAN_IGNORED</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00363" name="l00363"></a><span class="lineno"> 363</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00364" name="l00364"></a><span class="lineno"> 364</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00365" name="l00365"></a><span class="lineno"> 365</span> <span class="keywordflow">if</span> (!<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a9c00556752d2c127c5c5b205c166976b">quiet</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00366" name="l00366"></a><span class="lineno"> 366</span> std::cout << <span class="stringliteral">">> Scanning PID: "</span> << std::setw(<a class="code hl_define" href="hh__scanner_8cpp.html#ac02ff12a84f72a554a357650a1631c2f">PID_FIELD_SIZE</a>) << std::dec << pid;</div>
|
|
|
|
|
<div class="line"><a id="l00367" name="l00367"></a><span class="lineno"> 367</span> std::wcout << <span class="stringliteral">" : "</span> << exe_file;</div>
|
|
|
|
|
<div class="line"><a id="l00368" name="l00368"></a><span class="lineno"> 368</span> </div>
|
|
|
|
|
<div class="line"><a id="l00369" name="l00369"></a><span class="lineno"> 369</span> <span class="keywordflow">if</span> (is_process_wow64) {</div>
|
|
|
|
|
<div class="line"><a id="l00370" name="l00370"></a><span class="lineno"> 370</span> std::cout << <span class="stringliteral">" : 32b"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00371" name="l00371"></a><span class="lineno"> 371</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00372" name="l00372"></a><span class="lineno"> 372</span> <span class="keywordflow">if</span> (check_time) {</div>
|
|
|
|
|
<div class="line"><a id="l00373" name="l00373"></a><span class="lineno"> 373</span> std::cout << <span class="stringliteral">" : "</span> << time_diff << <span class="stringliteral">"s"</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00374" name="l00374"></a><span class="lineno"> 374</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00375" name="l00375"></a><span class="lineno"> 375</span> std::cout << std::endl;</div>
|
|
|
|
|
<div class="line"><a id="l00376" name="l00376"></a><span class="lineno"> 376</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00377" name="l00377"></a><span class="lineno"> 377</span> <span class="comment">//perform the scan:</span></div>
|
|
|
|
|
<div class="line"><a id="l00378" name="l00378"></a><span class="lineno"> 378</span> pesieve::t_params &pesieve_args = this-><a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a6e835a4060ea3db6af99e5ff8aae8834">pesieve_args</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00379" name="l00379"></a><span class="lineno"> 379</span> pesieve_args.pid = pid;</div>
|
|
|
|
|
<div class="line"><a id="l00380" name="l00380"></a><span class="lineno"> 380</span> </div>
|
|
|
|
|
<div class="line"><a id="l00381" name="l00381"></a><span class="lineno"> 381</span> pesieve::t_report report = PESieve_scan(pesieve_args);</div>
|
|
|
|
|
<div class="line"><a id="l00382" name="l00382"></a><span class="lineno"> 382</span> my_report.<a class="code hl_function" href="class_h_h_scan_report.html#a003c9bdcd02586fe059ce5cbf9200c94">appendReport</a>(report, exe_file);</div>
|
|
|
|
|
<div class="line"><a id="l00383" name="l00383"></a><span class="lineno"> 383</span> </div>
|
|
|
|
|
<div class="line"><a id="l00384" name="l00384"></a><span class="lineno"> 384</span> <a class="code hl_function" href="class_h_h_scanner.html#af1a026170edfe507268e6e21c5052bbb">printSingleReport</a>(report);</div>
|
|
|
|
|
<div class="line"><a id="l00385" name="l00385"></a><span class="lineno"> 385</span> <span class="keywordflow">if</span> (report.scanned > 0) {</div>
|
|
|
|
|
<div class="line"><a id="l00386" name="l00386"></a><span class="lineno"> 386</span> <span class="keywordflow">return</span> <a class="code hl_enumvalue" href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4af8af3004a5fccfada6848162d6bb2202">SSCAN_SUCCESS</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00387" name="l00387"></a><span class="lineno"> 387</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00388" name="l00388"></a><span class="lineno"> 388</span> <span class="keywordflow">return</span> <a class="code hl_enumvalue" href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4abbe276584c09951446b598f9ff89246b">SSCAN_ERROR1</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00389" name="l00389"></a><span class="lineno"> 389</span>}</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00390" name="l00390"></a><span class="lineno"> 390</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00391" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00391" name="l00391"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#ab4515f951cf9a9c2f1761493e6f9b9eb"> 391</a></span><a class="code hl_class" href="class_h_h_scan_report.html">HHScanReport</a>* <a class="code hl_function" href="class_h_h_scanner.html#ab4515f951cf9a9c2f1761493e6f9b9eb">HHScanner::scan</a>()</div>
|
|
|
|
|
<div class="line"><a id="l00392" name="l00392"></a><span class="lineno"> 392</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00393" name="l00393"></a><span class="lineno"> 393</span> <span class="keyword">const</span> time_t scan_start = time(NULL); <span class="comment">//start time of the current scan</span></div>
|
|
|
|
|
<div class="line"><a id="l00394" name="l00394"></a><span class="lineno"> 394</span> pesieve::t_params &pesieve_args = this-><a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a6e835a4060ea3db6af99e5ff8aae8834">pesieve_args</a>;</div>
|
|
|
|
|
<div class="line"><a id="l00395" name="l00395"></a><span class="lineno"> 395</span> <a class="code hl_function" href="class_h_h_scanner.html#ab704a295bea1cea7d7b7d00fc97a5683">initOutDir</a>(scan_start, pesieve_args);</div>
|
|
|
|
|
<div class="line"><a id="l00396" name="l00396"></a><span class="lineno"> 396</span> </div>
|
|
|
|
|
<div class="line"><a id="l00397" name="l00397"></a><span class="lineno"> 397</span> <a class="code hl_class" href="class_h_h_scan_report.html">HHScanReport</a> *my_report = <span class="keyword">new</span> <a class="code hl_class" href="class_h_h_scan_report.html">HHScanReport</a>(GetTickCount(), scan_start);</div>
|
|
|
|
|
<div class="line"><a id="l00398" name="l00398"></a><span class="lineno"> 398</span> <a class="code hl_function" href="class_h_h_scanner.html#a8528d5f27f05bfefcd2278318dc61846">scanProcesses</a>(*my_report);</div>
|
|
|
|
|
<div class="line"><a id="l00399" name="l00399"></a><span class="lineno"> 399</span> </div>
|
|
|
|
|
<div class="line"><a id="l00400" name="l00400"></a><span class="lineno"> 400</span> my_report-><a class="code hl_function" href="class_h_h_scan_report.html#a15b2afc2c28036efa8e034a2ecf3ff0c">setEndTick</a>(GetTickCount(), time(NULL));</div>
|
|
|
|
|
<div class="line"><a id="l00401" name="l00401"></a><span class="lineno"> 401</span> <span class="keywordflow">return</span> my_report;</div>
|
|
|
|
|
<div class="line"><a id="l00402" name="l00402"></a><span class="lineno"> 402</span>}</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="line"><a id="l00403" name="l00403"></a><span class="lineno"> 403</span> </div>
|
|
|
|
|
<div class="foldopen" id="foldopen00404" data-start="{" data-end="}">
|
|
|
|
|
<div class="line"><a id="l00404" name="l00404"></a><span class="lineno"><a class="line" href="class_h_h_scanner.html#a6c20de8e1a13034173c42c2e87267af3"> 404</a></span><span class="keywordtype">void</span> <a class="code hl_function" href="class_h_h_scanner.html#a6c20de8e1a13034173c42c2e87267af3">HHScanner::summarizeScan</a>(<a class="code hl_class" href="class_h_h_scan_report.html">HHScanReport</a> *hh_report)</div>
|
|
|
|
|
<div class="line"><a id="l00405" name="l00405"></a><span class="lineno"> 405</span>{</div>
|
|
|
|
|
<div class="line"><a id="l00406" name="l00406"></a><span class="lineno"> 406</span> <span class="keywordflow">if</span> (!hh_report) <span class="keywordflow">return</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00407" name="l00407"></a><span class="lineno"> 407</span> std::string summary_str;</div>
|
|
|
|
|
<div class="line"><a id="l00408" name="l00408"></a><span class="lineno"> 408</span> </div>
|
|
|
|
|
<div class="line"><a id="l00409" name="l00409"></a><span class="lineno"> 409</span> <span class="keywordflow">if</span> (!this-><a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a4c710dd9009a2ee6a31580ca62c200de">json_output</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00410" name="l00410"></a><span class="lineno"> 410</span> summary_str = hh_report-><a class="code hl_function" href="class_h_h_scan_report.html#ad7283b381ccf47bc892e264ddd6eae90">toString</a>();</div>
|
|
|
|
|
<div class="line"><a id="l00411" name="l00411"></a><span class="lineno"> 411</span> std::cout << summary_str;</div>
|
|
|
|
|
<div class="line"><a id="l00412" name="l00412"></a><span class="lineno"> 412</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00413" name="l00413"></a><span class="lineno"> 413</span> <span class="keywordflow">else</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00414" name="l00414"></a><span class="lineno"> 414</span> summary_str = hh_report-><a class="code hl_function" href="class_h_h_scan_report.html#a9d63466cb4cb100244b164ae5e7cc846">toJSON</a>(this-><a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>);</div>
|
|
|
|
|
<div class="line"><a id="l00415" name="l00415"></a><span class="lineno"> 415</span> std::cout << summary_str;</div>
|
|
|
|
|
<div class="line"><a id="l00416" name="l00416"></a><span class="lineno"> 416</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00417" name="l00417"></a><span class="lineno"> 417</span> </div>
|
|
|
|
|
<div class="line"><a id="l00418" name="l00418"></a><span class="lineno"> 418</span> <span class="keywordflow">if</span> (<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a6e835a4060ea3db6af99e5ff8aae8834">pesieve_args</a>.out_filter != OUT_NO_DIR) {</div>
|
|
|
|
|
<div class="line"><a id="l00419" name="l00419"></a><span class="lineno"> 419</span> <span class="comment">//file the same report into the directory with dumps:</span></div>
|
|
|
|
|
<div class="line"><a id="l00420" name="l00420"></a><span class="lineno"> 420</span> <span class="keywordflow">if</span> (hh_report-><a class="code hl_variable" href="class_h_h_scan_report.html#a8ec4849570e43fbf4a915300becceb92">suspicious</a>.size()) {</div>
|
|
|
|
|
<div class="line"><a id="l00421" name="l00421"></a><span class="lineno"> 421</span> std::string report_path = <a class="code hl_function" href="namespacefiles__util.html#a9a7fcfd84189964e87c1b572f1fe8fbe">files_util::join_path</a>(this-><a class="code hl_variable" href="class_h_h_scanner.html#a238a4958607b0f74d44c27c1505b1906">outDir</a>, <span class="stringliteral">"summary.json"</span>);</div>
|
|
|
|
|
<div class="line"><a id="l00422" name="l00422"></a><span class="lineno"> 422</span> <a class="code hl_function" href="namespacefiles__util.html#af87086ea253d2c9f93852ad9b40fd7ac">files_util::write_to_file</a>(report_path, hh_report-><a class="code hl_function" href="class_h_h_scan_report.html#a9d63466cb4cb100244b164ae5e7cc846">toJSON</a>(this->hh_args), <span class="keyword">false</span>);</div>
|
|
|
|
|
<div class="line"><a id="l00423" name="l00423"></a><span class="lineno"> 423</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00424" name="l00424"></a><span class="lineno"> 424</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00425" name="l00425"></a><span class="lineno"> 425</span> <span class="keywordflow">if</span> (<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a48a6a280e36ad9430b9be539faff3f5c">log</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00426" name="l00426"></a><span class="lineno"> 426</span> <a class="code hl_function" href="namespacefiles__util.html#af87086ea253d2c9f93852ad9b40fd7ac">files_util::write_to_file</a>(<span class="stringliteral">"hollows_hunter.log"</span>, summary_str, <span class="keyword">true</span>);</div>
|
|
|
|
|
<div class="line"><a id="l00427" name="l00427"></a><span class="lineno"> 427</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00428" name="l00428"></a><span class="lineno"> 428</span> <span class="keywordflow">if</span> (<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#ada2ba65bfb7d9e5395dd38ad4003d1cd">suspend_suspicious</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00429" name="l00429"></a><span class="lineno"> 429</span> <a class="code hl_function" href="namespaceprocess__util.html#a9edce70fe41a8ec91d549fb9d71a3b10">process_util::suspend_suspicious</a>(hh_report-><a class="code hl_variable" href="class_h_h_scan_report.html#a8ec4849570e43fbf4a915300becceb92">suspicious</a>);</div>
|
|
|
|
|
<div class="line"><a id="l00430" name="l00430"></a><span class="lineno"> 430</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00431" name="l00431"></a><span class="lineno"> 431</span> <span class="keywordflow">if</span> (<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a4c77070993ef883769c1dfb8c2092c88">kill_suspicious</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00432" name="l00432"></a><span class="lineno"> 432</span> <a class="code hl_function" href="namespaceprocess__util.html#ad8765675543bcce40dec2c3207d76ce9">process_util::kill_suspicious</a>(hh_report-><a class="code hl_variable" href="class_h_h_scan_report.html#a8ec4849570e43fbf4a915300becceb92">suspicious</a>);</div>
|
|
|
|
|
<div class="line"><a id="l00433" name="l00433"></a><span class="lineno"> 433</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00434" name="l00434"></a><span class="lineno"> 434</span>}</div>
|
|
|
|
|
<div class="line"><a id="l00329" name="l00329"></a><span class="lineno"> 329</span> <span class="keywordflow">if</span> (!hh_report) <span class="keywordflow">return</span>;</div>
|
|
|
|
|
<div class="line"><a id="l00330" name="l00330"></a><span class="lineno"> 330</span> std::string summary_str;</div>
|
|
|
|
|
<div class="line"><a id="l00331" name="l00331"></a><span class="lineno"> 331</span> </div>
|
|
|
|
|
<div class="line"><a id="l00332" name="l00332"></a><span class="lineno"> 332</span> <span class="keywordflow">if</span> (!this-><a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a4c710dd9009a2ee6a31580ca62c200de">json_output</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00333" name="l00333"></a><span class="lineno"> 333</span> summary_str = hh_report-><a class="code hl_function" href="class_h_h_scan_report.html#ad7283b381ccf47bc892e264ddd6eae90">toString</a>();</div>
|
|
|
|
|
<div class="line"><a id="l00334" name="l00334"></a><span class="lineno"> 334</span> std::cout << summary_str;</div>
|
|
|
|
|
<div class="line"><a id="l00335" name="l00335"></a><span class="lineno"> 335</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00336" name="l00336"></a><span class="lineno"> 336</span> <span class="keywordflow">else</span> {</div>
|
|
|
|
|
<div class="line"><a id="l00337" name="l00337"></a><span class="lineno"> 337</span> summary_str = hh_report-><a class="code hl_function" href="class_h_h_scan_report.html#a9d63466cb4cb100244b164ae5e7cc846">toJSON</a>(this-><a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>);</div>
|
|
|
|
|
<div class="line"><a id="l00338" name="l00338"></a><span class="lineno"> 338</span> std::cout << summary_str;</div>
|
|
|
|
|
<div class="line"><a id="l00339" name="l00339"></a><span class="lineno"> 339</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00340" name="l00340"></a><span class="lineno"> 340</span> </div>
|
|
|
|
|
<div class="line"><a id="l00341" name="l00341"></a><span class="lineno"> 341</span> <span class="keywordflow">if</span> (<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a6e835a4060ea3db6af99e5ff8aae8834">pesieve_args</a>.out_filter != OUT_NO_DIR) {</div>
|
|
|
|
|
<div class="line"><a id="l00342" name="l00342"></a><span class="lineno"> 342</span> <span class="comment">//file the same report into the directory with dumps:</span></div>
|
|
|
|
|
<div class="line"><a id="l00343" name="l00343"></a><span class="lineno"> 343</span> <span class="keywordflow">if</span> (hh_report-><a class="code hl_variable" href="class_h_h_scan_report.html#a8ec4849570e43fbf4a915300becceb92">suspicious</a>.size()) {</div>
|
|
|
|
|
<div class="line"><a id="l00344" name="l00344"></a><span class="lineno"> 344</span> std::string report_path = <a class="code hl_function" href="namespacefiles__util.html#a9a7fcfd84189964e87c1b572f1fe8fbe">files_util::join_path</a>(this-><a class="code hl_variable" href="class_h_h_scanner.html#a238a4958607b0f74d44c27c1505b1906">outDir</a>, <span class="stringliteral">"summary.json"</span>);</div>
|
|
|
|
|
<div class="line"><a id="l00345" name="l00345"></a><span class="lineno"> 345</span> <a class="code hl_function" href="namespacefiles__util.html#af87086ea253d2c9f93852ad9b40fd7ac">files_util::write_to_file</a>(report_path, hh_report-><a class="code hl_function" href="class_h_h_scan_report.html#a9d63466cb4cb100244b164ae5e7cc846">toJSON</a>(this->hh_args), <span class="keyword">false</span>);</div>
|
|
|
|
|
<div class="line"><a id="l00346" name="l00346"></a><span class="lineno"> 346</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00347" name="l00347"></a><span class="lineno"> 347</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00348" name="l00348"></a><span class="lineno"> 348</span> <span class="keywordflow">if</span> (<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a48a6a280e36ad9430b9be539faff3f5c">log</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00349" name="l00349"></a><span class="lineno"> 349</span> <a class="code hl_function" href="namespacefiles__util.html#af87086ea253d2c9f93852ad9b40fd7ac">files_util::write_to_file</a>(<span class="stringliteral">"hollows_hunter.log"</span>, summary_str, <span class="keyword">true</span>);</div>
|
|
|
|
|
<div class="line"><a id="l00350" name="l00350"></a><span class="lineno"> 350</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00351" name="l00351"></a><span class="lineno"> 351</span> <span class="keywordflow">if</span> (<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#ada2ba65bfb7d9e5395dd38ad4003d1cd">suspend_suspicious</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00352" name="l00352"></a><span class="lineno"> 352</span> <a class="code hl_function" href="namespaceprocess__util.html#a9edce70fe41a8ec91d549fb9d71a3b10">process_util::suspend_suspicious</a>(hh_report-><a class="code hl_variable" href="class_h_h_scan_report.html#a8ec4849570e43fbf4a915300becceb92">suspicious</a>);</div>
|
|
|
|
|
<div class="line"><a id="l00353" name="l00353"></a><span class="lineno"> 353</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00354" name="l00354"></a><span class="lineno"> 354</span> <span class="keywordflow">if</span> (<a class="code hl_variable" href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">hh_args</a>.<a class="code hl_variable" href="structhh__params.html#a4c77070993ef883769c1dfb8c2092c88">kill_suspicious</a>) {</div>
|
|
|
|
|
<div class="line"><a id="l00355" name="l00355"></a><span class="lineno"> 355</span> <a class="code hl_function" href="namespaceprocess__util.html#ad8765675543bcce40dec2c3207d76ce9">process_util::kill_suspicious</a>(hh_report-><a class="code hl_variable" href="class_h_h_scan_report.html#a8ec4849570e43fbf4a915300becceb92">suspicious</a>);</div>
|
|
|
|
|
<div class="line"><a id="l00356" name="l00356"></a><span class="lineno"> 356</span> }</div>
|
|
|
|
|
<div class="line"><a id="l00357" name="l00357"></a><span class="lineno"> 357</span>}</div>
|
|
|
|
|
</div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scan_report_html"><div class="ttname"><a href="class_h_h_scan_report.html">HHScanReport</a></div><div class="ttdef"><b>Definition</b> <a href="hh__report_8h_source.html#l00012">hh_report.h:13</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scan_report_html_a003c9bdcd02586fe059ce5cbf9200c94"><div class="ttname"><a href="class_h_h_scan_report.html#a003c9bdcd02586fe059ce5cbf9200c94">HHScanReport::appendReport</a></div><div class="ttdeci">bool appendReport(pesieve::t_report &scan_report, const std::wstring &img_name)</div><div class="ttdef"><b>Definition</b> <a href="hh__report_8cpp_source.html#l00026">hh_report.cpp:26</a></div></div>
|
|
|
|
@@ -568,20 +481,20 @@ $(function() { codefold.init(0); });
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scan_report_html_a9d63466cb4cb100244b164ae5e7cc846"><div class="ttname"><a href="class_h_h_scan_report.html#a9d63466cb4cb100244b164ae5e7cc846">HHScanReport::toJSON</a></div><div class="ttdeci">std::string toJSON(const t_hh_params &params)</div><div class="ttdef"><b>Definition</b> <a href="hh__report_8cpp_source.html#l00102">hh_report.cpp:102</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scan_report_html_ad7283b381ccf47bc892e264ddd6eae90"><div class="ttname"><a href="class_h_h_scan_report.html#ad7283b381ccf47bc892e264ddd6eae90">HHScanReport::toString</a></div><div class="ttdeci">std::string toString()</div><div class="ttdef"><b>Definition</b> <a href="hh__report_8cpp_source.html#l00147">hh_report.cpp:147</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_a238a4958607b0f74d44c27c1505b1906"><div class="ttname"><a href="class_h_h_scanner.html#a238a4958607b0f74d44c27c1505b1906">HHScanner::outDir</a></div><div class="ttdeci">std::string outDir</div><div class="ttdef"><b>Definition</b> <a href="hh__scanner_8h_source.html#l00042">hh_scanner.h:42</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_a4881091d77448e0812ab5581f01893c7"><div class="ttname"><a href="class_h_h_scanner.html#a4881091d77448e0812ab5581f01893c7">HHScanner::scanNextProcess</a></div><div class="ttdeci">t_single_scan_status scanNextProcess(DWORD pid, WCHAR *image_buf, HHScanReport &report)</div><div class="ttdef"><b>Definition</b> <a href="#l00327">hh_scanner.cpp:327</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_a4881091d77448e0812ab5581f01893c7"><div class="ttname"><a href="class_h_h_scanner.html#a4881091d77448e0812ab5581f01893c7">HHScanner::scanNextProcess</a></div><div class="ttdeci">t_single_scan_status scanNextProcess(DWORD pid, WCHAR *image_buf, HHScanReport &report)</div><div class="ttdef"><b>Definition</b> <a href="#l00251">hh_scanner.cpp:251</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_a64bb7d15ea59c9fe7e25f266e05005b9"><div class="ttname"><a href="class_h_h_scanner.html#a64bb7d15ea59c9fe7e25f266e05005b9">HHScanner::isScannerWow64</a></div><div class="ttdeci">bool isScannerWow64</div><div class="ttdef"><b>Definition</b> <a href="hh__scanner_8h_source.html#l00046">hh_scanner.h:46</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_a6700be392afaa57e77ddc4c649e718f1"><div class="ttname"><a href="class_h_h_scanner.html#a6700be392afaa57e77ddc4c649e718f1">HHScanner::printScanRoundStats</a></div><div class="ttdeci">void printScanRoundStats(size_t found, size_t ignored_count)</div><div class="ttdef"><b>Definition</b> <a href="#l00229">hh_scanner.cpp:229</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_a6c20de8e1a13034173c42c2e87267af3"><div class="ttname"><a href="class_h_h_scanner.html#a6c20de8e1a13034173c42c2e87267af3">HHScanner::summarizeScan</a></div><div class="ttdeci">void summarizeScan(HHScanReport *hh_report)</div><div class="ttdef"><b>Definition</b> <a href="#l00404">hh_scanner.cpp:404</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_a8528d5f27f05bfefcd2278318dc61846"><div class="ttname"><a href="class_h_h_scanner.html#a8528d5f27f05bfefcd2278318dc61846">HHScanner::scanProcesses</a></div><div class="ttdeci">size_t scanProcesses(HHScanReport &my_report)</div><div class="ttdef"><b>Definition</b> <a href="#l00250">hh_scanner.cpp:250</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_a6700be392afaa57e77ddc4c649e718f1"><div class="ttname"><a href="class_h_h_scanner.html#a6700be392afaa57e77ddc4c649e718f1">HHScanner::printScanRoundStats</a></div><div class="ttdeci">void printScanRoundStats(size_t found, size_t ignored_count)</div><div class="ttdef"><b>Definition</b> <a href="#l00153">hh_scanner.cpp:153</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_a6c20de8e1a13034173c42c2e87267af3"><div class="ttname"><a href="class_h_h_scanner.html#a6c20de8e1a13034173c42c2e87267af3">HHScanner::summarizeScan</a></div><div class="ttdeci">void summarizeScan(HHScanReport *hh_report)</div><div class="ttdef"><b>Definition</b> <a href="#l00327">hh_scanner.cpp:327</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_a8528d5f27f05bfefcd2278318dc61846"><div class="ttname"><a href="class_h_h_scanner.html#a8528d5f27f05bfefcd2278318dc61846">HHScanner::scanProcesses</a></div><div class="ttdeci">size_t scanProcesses(HHScanReport &my_report)</div><div class="ttdef"><b>Definition</b> <a href="#l00174">hh_scanner.cpp:174</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_a989d1551cc43e9497ca232db41ee9e5b"><div class="ttname"><a href="class_h_h_scanner.html#a989d1551cc43e9497ca232db41ee9e5b">HHScanner::initTime</a></div><div class="ttdeci">time_t initTime</div><div class="ttdef"><b>Definition</b> <a href="hh__scanner_8h_source.html#l00045">hh_scanner.h:45</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_aa9841ff29a663251372cf65e2db3cbef"><div class="ttname"><a href="class_h_h_scanner.html#aa9841ff29a663251372cf65e2db3cbef">HHScanner::hh_args</a></div><div class="ttdeci">t_hh_params & hh_args</div><div class="ttdef"><b>Definition</b> <a href="hh__scanner_8h_source.html#l00041">hh_scanner.h:41</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_ab4515f951cf9a9c2f1761493e6f9b9eb"><div class="ttname"><a href="class_h_h_scanner.html#ab4515f951cf9a9c2f1761493e6f9b9eb">HHScanner::scan</a></div><div class="ttdeci">HHScanReport * scan()</div><div class="ttdef"><b>Definition</b> <a href="#l00391">hh_scanner.cpp:391</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_ab704a295bea1cea7d7b7d00fc97a5683"><div class="ttname"><a href="class_h_h_scanner.html#ab704a295bea1cea7d7b7d00fc97a5683">HHScanner::initOutDir</a></div><div class="ttdeci">void initOutDir(time_t scan_time, pesieve::t_params &pesieve_args)</div><div class="ttdef"><b>Definition</b> <a href="#l00216">hh_scanner.cpp:216</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_abae28bb490b101cb3d1136eb76a5df33"><div class="ttname"><a href="class_h_h_scanner.html#abae28bb490b101cb3d1136eb76a5df33">HHScanner::HHScanner</a></div><div class="ttdeci">HHScanner(t_hh_params &_args)</div><div class="ttdef"><b>Definition</b> <a href="#l00199">hh_scanner.cpp:199</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_adec367c7541ba8e334c7f674e57f429a"><div class="ttname"><a href="class_h_h_scanner.html#adec367c7541ba8e334c7f674e57f429a">HHScanner::isScannerCompatibile</a></div><div class="ttdeci">static bool isScannerCompatibile()</div><div class="ttdef"><b>Definition</b> <a href="#l00206">hh_scanner.cpp:206</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_af1a026170edfe507268e6e21c5052bbb"><div class="ttname"><a href="class_h_h_scanner.html#af1a026170edfe507268e6e21c5052bbb">HHScanner::printSingleReport</a></div><div class="ttdeci">void printSingleReport(pesieve::t_report &report)</div><div class="ttdef"><b>Definition</b> <a href="#l00288">hh_scanner.cpp:288</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_ab4515f951cf9a9c2f1761493e6f9b9eb"><div class="ttname"><a href="class_h_h_scanner.html#ab4515f951cf9a9c2f1761493e6f9b9eb">HHScanner::scan</a></div><div class="ttdeci">HHScanReport * scan()</div><div class="ttdef"><b>Definition</b> <a href="#l00314">hh_scanner.cpp:314</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_ab704a295bea1cea7d7b7d00fc97a5683"><div class="ttname"><a href="class_h_h_scanner.html#ab704a295bea1cea7d7b7d00fc97a5683">HHScanner::initOutDir</a></div><div class="ttdeci">void initOutDir(time_t scan_time, pesieve::t_params &pesieve_args)</div><div class="ttdef"><b>Definition</b> <a href="#l00140">hh_scanner.cpp:140</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_abae28bb490b101cb3d1136eb76a5df33"><div class="ttname"><a href="class_h_h_scanner.html#abae28bb490b101cb3d1136eb76a5df33">HHScanner::HHScanner</a></div><div class="ttdeci">HHScanner(t_hh_params &_args)</div><div class="ttdef"><b>Definition</b> <a href="#l00123">hh_scanner.cpp:123</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_adec367c7541ba8e334c7f674e57f429a"><div class="ttname"><a href="class_h_h_scanner.html#adec367c7541ba8e334c7f674e57f429a">HHScanner::isScannerCompatibile</a></div><div class="ttdeci">static bool isScannerCompatibile()</div><div class="ttdef"><b>Definition</b> <a href="#l00130">hh_scanner.cpp:130</a></div></div>
|
|
|
|
|
<div class="ttc" id="aclass_h_h_scanner_html_af1a026170edfe507268e6e21c5052bbb"><div class="ttname"><a href="class_h_h_scanner.html#af1a026170edfe507268e6e21c5052bbb">HHScanner::printSingleReport</a></div><div class="ttdeci">void printSingleReport(pesieve::t_report &report)</div><div class="ttdef"><b>Definition</b> <a href="#l00212">hh_scanner.cpp:212</a></div></div>
|
|
|
|
|
<div class="ttc" id="ahh__params_8h_html_a6144407ab3bcb041574c2367ac1e455f"><div class="ttname"><a href="hh__params_8h.html#a6144407ab3bcb041574c2367ac1e455f">TIME_UNDEFINED</a></div><div class="ttdeci">#define TIME_UNDEFINED</div><div class="ttdef"><b>Definition</b> <a href="hh__params_8h_source.html#l00007">hh_params.h:7</a></div></div>
|
|
|
|
|
<div class="ttc" id="ahh__scanner_8cpp_html_ac02ff12a84f72a554a357650a1631c2f"><div class="ttname"><a href="hh__scanner_8cpp.html#ac02ff12a84f72a554a357650a1631c2f">PID_FIELD_SIZE</a></div><div class="ttdeci">#define PID_FIELD_SIZE</div><div class="ttdef"><b>Definition</b> <a href="#l00018">hh_scanner.cpp:18</a></div></div>
|
|
|
|
|
<div class="ttc" id="ahh__scanner_8cpp_html_ac02ff12a84f72a554a357650a1631c2f"><div class="ttname"><a href="hh__scanner_8cpp.html#ac02ff12a84f72a554a357650a1631c2f">PID_FIELD_SIZE</a></div><div class="ttdeci">#define PID_FIELD_SIZE</div><div class="ttdef"><b>Definition</b> <a href="#l00019">hh_scanner.cpp:19</a></div></div>
|
|
|
|
|
<div class="ttc" id="ahh__scanner_8h_html"><div class="ttname"><a href="hh__scanner_8h.html">hh_scanner.h</a></div></div>
|
|
|
|
|
<div class="ttc" id="ahh__scanner_8h_html_a71125474e5d0570a7970dbfeac97d2d4a4cd58d13fa112594c7c4a6800e445842"><div class="ttname"><a href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4a4cd58d13fa112594c7c4a6800e445842">SSCAN_NOT_MATCH</a></div><div class="ttdeci">@ SSCAN_NOT_MATCH</div><div class="ttdef"><b>Definition</b> <a href="hh__scanner_8h_source.html#l00018">hh_scanner.h:18</a></div></div>
|
|
|
|
|
<div class="ttc" id="ahh__scanner_8h_html_a71125474e5d0570a7970dbfeac97d2d4a92a79c026616fa779bd92df2b65a626b"><div class="ttname"><a href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4a92a79c026616fa779bd92df2b65a626b">SSCAN_IGNORED</a></div><div class="ttdeci">@ SSCAN_IGNORED</div><div class="ttdef"><b>Definition</b> <a href="hh__scanner_8h_source.html#l00019">hh_scanner.h:19</a></div></div>
|
|
|
|
@@ -589,21 +502,21 @@ $(function() { codefold.init(0); });
|
|
|
|
|
<div class="ttc" id="ahh__scanner_8h_html_a71125474e5d0570a7970dbfeac97d2d4ae5df3c6d61ca83c8c222906ea943c7c8"><div class="ttname"><a href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4ae5df3c6d61ca83c8c222906ea943c7c8">SSCAN_ERROR0</a></div><div class="ttdeci">@ SSCAN_ERROR0</div><div class="ttdef"><b>Definition</b> <a href="hh__scanner_8h_source.html#l00017">hh_scanner.h:17</a></div></div>
|
|
|
|
|
<div class="ttc" id="ahh__scanner_8h_html_a71125474e5d0570a7970dbfeac97d2d4af8af3004a5fccfada6848162d6bb2202"><div class="ttname"><a href="hh__scanner_8h.html#a71125474e5d0570a7970dbfeac97d2d4af8af3004a5fccfada6848162d6bb2202">SSCAN_SUCCESS</a></div><div class="ttdeci">@ SSCAN_SUCCESS</div><div class="ttdef"><b>Definition</b> <a href="hh__scanner_8h_source.html#l00021">hh_scanner.h:20</a></div></div>
|
|
|
|
|
<div class="ttc" id="ahh__scanner_8h_html_ad5caa6b1d4b11989c8ff90d46fc231aa"><div class="ttname"><a href="hh__scanner_8h.html#ad5caa6b1d4b11989c8ff90d46fc231aa">t_single_scan_status</a></div><div class="ttdeci">enum single_status t_single_scan_status</div></div>
|
|
|
|
|
<div class="ttc" id="anamespacefiles__util_html"><div class="ttname"><a href="namespacefiles__util.html">files_util</a></div><div class="ttdef"><b>Definition</b> <a href="#l00099">hh_scanner.cpp:99</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespacefiles__util_html_a9a7fcfd84189964e87c1b572f1fe8fbe"><div class="ttname"><a href="namespacefiles__util.html#a9a7fcfd84189964e87c1b572f1fe8fbe">files_util::join_path</a></div><div class="ttdeci">std::string join_path(const std::string &baseDir, const std::string &subpath)</div><div class="ttdef"><b>Definition</b> <a href="#l00101">hh_scanner.cpp:101</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespacefiles__util_html_a9c2cf1240e4b850893c4e7a0a2ab641b"><div class="ttname"><a href="namespacefiles__util.html#a9c2cf1240e4b850893c4e7a0a2ab641b">files_util::make_dir_name</a></div><div class="ttdeci">std::string make_dir_name(std::string baseDir, time_t timestamp)</div><div class="ttdef"><b>Definition</b> <a href="#l00112">hh_scanner.cpp:112</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespacefiles__util_html_abab65a3cbe43de11dd5d25ed5e4d47e5"><div class="ttname"><a href="namespacefiles__util.html#abab65a3cbe43de11dd5d25ed5e4d47e5">files_util::set_output_dir</a></div><div class="ttdeci">bool set_output_dir(t_params &args, const std::string &new_dir)</div><div class="ttdef"><b>Definition</b> <a href="#l00124">hh_scanner.cpp:124</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespacefiles__util_html_af87086ea253d2c9f93852ad9b40fd7ac"><div class="ttname"><a href="namespacefiles__util.html#af87086ea253d2c9f93852ad9b40fd7ac">files_util::write_to_file</a></div><div class="ttdeci">bool write_to_file(const std::string &report_path, const std::string &summary_str, const bool append)</div><div class="ttdef"><b>Definition</b> <a href="#l00138">hh_scanner.cpp:138</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceprocess__util_html"><div class="ttname"><a href="namespaceprocess__util.html">process_util</a></div><div class="ttdef"><b>Definition</b> <a href="#l00022">hh_scanner.cpp:22</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceprocess__util_html_a1550838f32323b66051e0d05a0acdb01"><div class="ttname"><a href="namespaceprocess__util.html#a1550838f32323b66051e0d05a0acdb01">process_util::is_wow_64</a></div><div class="ttdeci">bool is_wow_64(HANDLE process)</div><div class="ttdef"><b>Definition</b> <a href="#l00024">hh_scanner.cpp:24</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceprocess__util_html_a4a258bf9fcaf9b1f5b6419f4e6a5d1e1"><div class="ttname"><a href="namespaceprocess__util.html#a4a258bf9fcaf9b1f5b6419f4e6a5d1e1">process_util::get_process_info</a></div><div class="ttdeci">bool get_process_info(DWORD processID, bool &isWow64, char *szProcessName, DWORD processNameSize)</div><div class="ttdef"><b>Definition</b> <a href="#l00041">hh_scanner.cpp:41</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceprocess__util_html_a9edce70fe41a8ec91d549fb9d71a3b10"><div class="ttname"><a href="namespaceprocess__util.html#a9edce70fe41a8ec91d549fb9d71a3b10">process_util::suspend_suspicious</a></div><div class="ttdeci">size_t suspend_suspicious(std::vector< DWORD > &suspicious_pids)</div><div class="ttdef"><b>Definition</b> <a href="#l00062">hh_scanner.cpp:62</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceprocess__util_html_ad8765675543bcce40dec2c3207d76ce9"><div class="ttname"><a href="namespaceprocess__util.html#ad8765675543bcce40dec2c3207d76ce9">process_util::kill_suspicious</a></div><div class="ttdeci">size_t kill_suspicious(std::vector< DWORD > &suspicious_pids)</div><div class="ttdef"><b>Definition</b> <a href="#l00075">hh_scanner.cpp:75</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceutil_html"><div class="ttname"><a href="namespaceutil.html">util</a></div><div class="ttdef"><b>Definition</b> <a href="#l00156">hh_scanner.cpp:156</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespacefiles__util_html"><div class="ttname"><a href="namespacefiles__util.html">files_util</a></div><div class="ttdef"><b>Definition</b> <a href="#l00023">hh_scanner.cpp:23</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespacefiles__util_html_a9a7fcfd84189964e87c1b572f1fe8fbe"><div class="ttname"><a href="namespacefiles__util.html#a9a7fcfd84189964e87c1b572f1fe8fbe">files_util::join_path</a></div><div class="ttdeci">std::string join_path(const std::string &baseDir, const std::string &subpath)</div><div class="ttdef"><b>Definition</b> <a href="#l00025">hh_scanner.cpp:25</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespacefiles__util_html_a9c2cf1240e4b850893c4e7a0a2ab641b"><div class="ttname"><a href="namespacefiles__util.html#a9c2cf1240e4b850893c4e7a0a2ab641b">files_util::make_dir_name</a></div><div class="ttdeci">std::string make_dir_name(std::string baseDir, time_t timestamp)</div><div class="ttdef"><b>Definition</b> <a href="#l00036">hh_scanner.cpp:36</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespacefiles__util_html_abab65a3cbe43de11dd5d25ed5e4d47e5"><div class="ttname"><a href="namespacefiles__util.html#abab65a3cbe43de11dd5d25ed5e4d47e5">files_util::set_output_dir</a></div><div class="ttdeci">bool set_output_dir(t_params &args, const std::string &new_dir)</div><div class="ttdef"><b>Definition</b> <a href="#l00048">hh_scanner.cpp:48</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespacefiles__util_html_af87086ea253d2c9f93852ad9b40fd7ac"><div class="ttname"><a href="namespacefiles__util.html#af87086ea253d2c9f93852ad9b40fd7ac">files_util::write_to_file</a></div><div class="ttdeci">bool write_to_file(const std::string &report_path, const std::string &summary_str, const bool append)</div><div class="ttdef"><b>Definition</b> <a href="#l00062">hh_scanner.cpp:62</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceprocess__util_html_a1550838f32323b66051e0d05a0acdb01"><div class="ttname"><a href="namespaceprocess__util.html#a1550838f32323b66051e0d05a0acdb01">process_util::is_wow_64</a></div><div class="ttdeci">bool is_wow_64(HANDLE process)</div><div class="ttdef"><b>Definition</b> <a href="process__util_8h_source.html#l00009">process_util.h:9</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceprocess__util_html_a9edce70fe41a8ec91d549fb9d71a3b10"><div class="ttname"><a href="namespaceprocess__util.html#a9edce70fe41a8ec91d549fb9d71a3b10">process_util::suspend_suspicious</a></div><div class="ttdeci">size_t suspend_suspicious(std::vector< DWORD > &suspicious_pids)</div><div class="ttdef"><b>Definition</b> <a href="process__util_8h_source.html#l00057">process_util.h:57</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceprocess__util_html_ad8765675543bcce40dec2c3207d76ce9"><div class="ttname"><a href="namespaceprocess__util.html#ad8765675543bcce40dec2c3207d76ce9">process_util::kill_suspicious</a></div><div class="ttdeci">size_t kill_suspicious(std::vector< DWORD > &suspicious_pids)</div><div class="ttdef"><b>Definition</b> <a href="process__util_8h_source.html#l00070">process_util.h:70</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceprocess__util_html_af9bdd83e9c8262ef548737112964d2f9"><div class="ttname"><a href="namespaceprocess__util.html#af9bdd83e9c8262ef548737112964d2f9">process_util::is_wow_64_by_pid</a></div><div class="ttdeci">bool is_wow_64_by_pid(DWORD processID)</div><div class="ttdef"><b>Definition</b> <a href="process__util_8h_source.html#l00027">process_util.h:27</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceutil_html"><div class="ttname"><a href="namespaceutil.html">util</a></div><div class="ttdef"><b>Definition</b> <a href="#l00080">hh_scanner.cpp:80</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceutil_html_a1b58bbd7118af7892e3926017211542b"><div class="ttname"><a href="namespaceutil.html#a1b58bbd7118af7892e3926017211542b">util::process_start_time</a></div><div class="ttdeci">LONGLONG process_start_time(DWORD processID)</div><div class="ttdef"><b>Definition</b> <a href="time__util_8cpp_source.html#l00042">time_util.cpp:42</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceutil_html_a3849afaac9ec9e32eadd5e0abe8e1aa7"><div class="ttname"><a href="namespaceutil.html#a3849afaac9ec9e32eadd5e0abe8e1aa7">util::is_searched_name</a></div><div class="ttdeci">bool is_searched_name(const WCHAR *processName, std::set< std::wstring > &names_list)</div><div class="ttdef"><b>Definition</b> <a href="#l00158">hh_scanner.cpp:158</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceutil_html_a4afca6eda8fe7bc220cfdb824b79fd8b"><div class="ttname"><a href="namespaceutil.html#a4afca6eda8fe7bc220cfdb824b79fd8b">util::list_to_str</a></div><div class="ttdeci">std::string list_to_str(std::set< TYPE_T > &list)</div><div class="ttdef"><b>Definition</b> <a href="#l00180">hh_scanner.cpp:180</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceutil_html_afe3e470c6b385ed25f7d5f1d93b420cd"><div class="ttname"><a href="namespaceutil.html#afe3e470c6b385ed25f7d5f1d93b420cd">util::is_searched_pid</a></div><div class="ttdeci">bool is_searched_pid(long pid, std::set< long > &pids_list)</div><div class="ttdef"><b>Definition</b> <a href="#l00170">hh_scanner.cpp:170</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceutil_html_a3849afaac9ec9e32eadd5e0abe8e1aa7"><div class="ttname"><a href="namespaceutil.html#a3849afaac9ec9e32eadd5e0abe8e1aa7">util::is_searched_name</a></div><div class="ttdeci">bool is_searched_name(const WCHAR *processName, std::set< std::wstring > &names_list)</div><div class="ttdef"><b>Definition</b> <a href="#l00082">hh_scanner.cpp:82</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceutil_html_a4afca6eda8fe7bc220cfdb824b79fd8b"><div class="ttname"><a href="namespaceutil.html#a4afca6eda8fe7bc220cfdb824b79fd8b">util::list_to_str</a></div><div class="ttdeci">std::string list_to_str(std::set< TYPE_T > &list)</div><div class="ttdef"><b>Definition</b> <a href="#l00104">hh_scanner.cpp:104</a></div></div>
|
|
|
|
|
<div class="ttc" id="anamespaceutil_html_afe3e470c6b385ed25f7d5f1d93b420cd"><div class="ttname"><a href="namespaceutil.html#afe3e470c6b385ed25f7d5f1d93b420cd">util::is_searched_pid</a></div><div class="ttdeci">bool is_searched_pid(long pid, std::set< long > &pids_list)</div><div class="ttdef"><b>Definition</b> <a href="#l00094">hh_scanner.cpp:94</a></div></div>
|
|
|
|
|
<div class="ttc" id="aprocess__util_8h_html"><div class="ttname"><a href="process__util_8h.html">process_util.h</a></div></div>
|
|
|
|
|
<div class="ttc" id="astructhh__params_html"><div class="ttname"><a href="structhh__params.html">hh_params</a></div><div class="ttdef"><b>Definition</b> <a href="hh__params_8h_source.html#l00011">hh_params.h:12</a></div></div>
|
|
|
|
|
<div class="ttc" id="astructhh__params_html_a179cffc6577cad21f16e07ca3ae14a67"><div class="ttname"><a href="structhh__params.html#a179cffc6577cad21f16e07ca3ae14a67">hh_params::pids_list</a></div><div class="ttdeci">std::set< long > pids_list</div><div class="ttdef"><b>Definition</b> <a href="hh__params_8h_source.html#l00025">hh_params.h:25</a></div></div>
|
|
|
|
|
<div class="ttc" id="astructhh__params_html_a48a6a280e36ad9430b9be539faff3f5c"><div class="ttname"><a href="structhh__params.html#a48a6a280e36ad9430b9be539faff3f5c">hh_params::log</a></div><div class="ttdeci">bool log</div><div class="ttdef"><b>Definition</b> <a href="hh__params_8h_source.html#l00021">hh_params.h:21</a></div></div>
|
|
|
|
@@ -617,7 +530,6 @@ $(function() { codefold.init(0); });
|
|
|
|
|
<div class="ttc" id="astructhh__params_html_ada2ba65bfb7d9e5395dd38ad4003d1cd"><div class="ttname"><a href="structhh__params.html#ada2ba65bfb7d9e5395dd38ad4003d1cd">hh_params::suspend_suspicious</a></div><div class="ttdeci">bool suspend_suspicious</div><div class="ttdef"><b>Definition</b> <a href="hh__params_8h_source.html#l00018">hh_params.h:18</a></div></div>
|
|
|
|
|
<div class="ttc" id="astructhh__params_html_adc6d18cfa1bcec72107e2022418bf8f3"><div class="ttname"><a href="structhh__params.html#adc6d18cfa1bcec72107e2022418bf8f3">hh_params::unique_dir</a></div><div class="ttdeci">bool unique_dir</div><div class="ttdef"><b>Definition</b> <a href="hh__params_8h_source.html#l00015">hh_params.h:15</a></div></div>
|
|
|
|
|
<div class="ttc" id="astructhh__params_html_aeaa430eb92a01d64b063bc3537ceb4c8"><div class="ttname"><a href="structhh__params.html#aeaa430eb92a01d64b063bc3537ceb4c8">hh_params::ptimes</a></div><div class="ttdeci">LONGLONG ptimes</div><div class="ttdef"><b>Definition</b> <a href="hh__params_8h_source.html#l00023">hh_params.h:23</a></div></div>
|
|
|
|
|
<div class="ttc" id="asuspend_8cpp_html_a3c63f252433e6e7532e441ed5cacca9d"><div class="ttname"><a href="suspend_8cpp.html#a3c63f252433e6e7532e441ed5cacca9d">suspend_process</a></div><div class="ttdeci">bool suspend_process(DWORD processId)</div><div class="ttdef"><b>Definition</b> <a href="suspend_8cpp_source.html#l00007">suspend.cpp:7</a></div></div>
|
|
|
|
|
<div class="ttc" id="asuspend_8h_html"><div class="ttname"><a href="suspend_8h.html">suspend.h</a></div></div>
|
|
|
|
|
<div class="ttc" id="aterm__util_8cpp_html_a72fb5a7886c4d8ed5e351d64ad5c536b"><div class="ttname"><a href="term__util_8cpp.html#a72fb5a7886c4d8ed5e351d64ad5c536b">set_color</a></div><div class="ttdeci">WORD set_color(WORD color)</div><div class="ttdef"><b>Definition</b> <a href="term__util_8cpp_source.html#l00017">term_util.cpp:17</a></div></div>
|
|
|
|
|
<div class="ttc" id="aterm__util_8h_html"><div class="ttname"><a href="term__util_8h.html">term_util.h</a></div></div>
|
|
|
|
|