mirror of
https://github.com/hasherezade/hollows_hunter.git
synced 2026-10-12 02:15:21 +00:00
154 lines
10 KiB
HTML
154 lines
10 KiB
HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "https://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml" lang="en-US">
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/>
|
|
<meta http-equiv="X-UA-Compatible" content="IE=11"/>
|
|
<meta name="generator" content="Doxygen 1.10.0"/>
|
|
<meta name="viewport" content="width=device-width, initial-scale=1"/>
|
|
<title>HollowsHunter: hh_scanner.cpp File Reference</title>
|
|
<link href="tabs.css" rel="stylesheet" type="text/css"/>
|
|
<script type="text/javascript" src="jquery.js"></script>
|
|
<script type="text/javascript" src="dynsections.js"></script>
|
|
<script type="text/javascript" src="clipboard.js"></script>
|
|
<script type="text/javascript" src="cookie.js"></script>
|
|
<link href="search/search.css" rel="stylesheet" type="text/css"/>
|
|
<script type="text/javascript" src="search/searchdata.js"></script>
|
|
<script type="text/javascript" src="search/search.js"></script>
|
|
<link href="doxygen.css" rel="stylesheet" type="text/css" />
|
|
</head>
|
|
<body>
|
|
<div id="top"><!-- do not remove this div, it is closed by doxygen! -->
|
|
<div id="titlearea">
|
|
<table cellspacing="0" cellpadding="0">
|
|
<tbody>
|
|
<tr id="projectrow">
|
|
<td id="projectlogo"><img alt="Logo" src="logo2_128.png"/></td>
|
|
<td id="projectalign">
|
|
<div id="projectname">HollowsHunter
|
|
</div>
|
|
<div id="projectbrief">Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).</div>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
<!-- end header part -->
|
|
<!-- Generated by Doxygen 1.10.0 -->
|
|
<script type="text/javascript">
|
|
/* @license magnet:?xt=urn:btih:d3d9a9a6595521f9666a5e94cc830dab83b65699&dn=expat.txt MIT */
|
|
var searchBox = new SearchBox("searchBox", "search/",'.html');
|
|
/* @license-end */
|
|
</script>
|
|
<script type="text/javascript" src="menudata.js"></script>
|
|
<script type="text/javascript" src="menu.js"></script>
|
|
<script type="text/javascript">
|
|
/* @license magnet:?xt=urn:btih:d3d9a9a6595521f9666a5e94cc830dab83b65699&dn=expat.txt MIT */
|
|
$(function() {
|
|
initMenu('',true,false,'search.php','Search');
|
|
$(function() { init_search(); });
|
|
});
|
|
/* @license-end */
|
|
</script>
|
|
<div id="main-nav"></div>
|
|
<!-- window showing the filter options -->
|
|
<div id="MSearchSelectWindow"
|
|
onmouseover="return searchBox.OnSearchSelectShow()"
|
|
onmouseout="return searchBox.OnSearchSelectHide()"
|
|
onkeydown="return searchBox.OnSearchSelectKey(event)">
|
|
</div>
|
|
|
|
<!-- iframe showing the search results (closed by default) -->
|
|
<div id="MSearchResultsWindow">
|
|
<div id="MSearchResults">
|
|
<div class="SRPage">
|
|
<div id="SRIndex">
|
|
<div id="SRResults"></div>
|
|
<div class="SRStatus" id="Loading">Loading...</div>
|
|
<div class="SRStatus" id="Searching">Searching...</div>
|
|
<div class="SRStatus" id="NoMatches">No Matches</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
</div><!-- top -->
|
|
<div class="header">
|
|
<div class="summary">
|
|
<a href="#namespaces">Namespaces</a> |
|
|
<a href="#define-members">Macros</a> |
|
|
<a href="#func-members">Functions</a> </div>
|
|
<div class="headertitle"><div class="title">hh_scanner.cpp File Reference</div></div>
|
|
</div><!--header-->
|
|
<div class="contents">
|
|
<div class="textblock"><code>#include "<a class="el" href="hh__scanner_8h_source.html">hh_scanner.h</a>"</code><br />
|
|
<code>#include <iostream></code><br />
|
|
<code>#include <fstream></code><br />
|
|
<code>#include <sstream></code><br />
|
|
<code>#include <iomanip></code><br />
|
|
<code>#include <codecvt></code><br />
|
|
<code>#include <locale></code><br />
|
|
<code>#include <time.h></code><br />
|
|
<code>#include <tlhelp32.h></code><br />
|
|
<code>#include "<a class="el" href="suspend_8h_source.html">util/suspend.h</a>"</code><br />
|
|
<code>#include "<a class="el" href="time__util_8h_source.html">util/time_util.h</a>"</code><br />
|
|
<code>#include "<a class="el" href="term__util_8h_source.html">term_util.h</a>"</code><br />
|
|
<code>#include "<a class="el" href="process__util_8h_source.html">util/process_util.h</a>"</code><br />
|
|
<code>#include <paramkit.h></code><br />
|
|
</div>
|
|
<p><a href="hh__scanner_8cpp_source.html">Go to the source code of this file.</a></p>
|
|
<table class="memberdecls">
|
|
<tr class="heading"><td colspan="2"><h2 class="groupheader"><a id="namespaces" name="namespaces"></a>
|
|
Namespaces</h2></td></tr>
|
|
<tr class="memitem:namespacefiles__util" id="r_namespacefiles__util"><td class="memItemLeft" align="right" valign="top">namespace  </td><td class="memItemRight" valign="bottom"><a class="el" href="namespacefiles__util.html">files_util</a></td></tr>
|
|
<tr class="separator:"><td class="memSeparator" colspan="2"> </td></tr>
|
|
<tr class="memitem:namespaceutil" id="r_namespaceutil"><td class="memItemLeft" align="right" valign="top">namespace  </td><td class="memItemRight" valign="bottom"><a class="el" href="namespaceutil.html">util</a></td></tr>
|
|
<tr class="separator:"><td class="memSeparator" colspan="2"> </td></tr>
|
|
</table><table class="memberdecls">
|
|
<tr class="heading"><td colspan="2"><h2 class="groupheader"><a id="define-members" name="define-members"></a>
|
|
Macros</h2></td></tr>
|
|
<tr class="memitem:ac02ff12a84f72a554a357650a1631c2f" id="r_ac02ff12a84f72a554a357650a1631c2f"><td class="memItemLeft" align="right" valign="top">#define </td><td class="memItemRight" valign="bottom"><a class="el" href="#ac02ff12a84f72a554a357650a1631c2f">PID_FIELD_SIZE</a>   4</td></tr>
|
|
<tr class="separator:ac02ff12a84f72a554a357650a1631c2f"><td class="memSeparator" colspan="2"> </td></tr>
|
|
</table><table class="memberdecls">
|
|
<tr class="heading"><td colspan="2"><h2 class="groupheader"><a id="func-members" name="func-members"></a>
|
|
Functions</h2></td></tr>
|
|
<tr class="memitem:a9a7fcfd84189964e87c1b572f1fe8fbe" id="r_a9a7fcfd84189964e87c1b572f1fe8fbe"><td class="memItemLeft" align="right" valign="top">std::string </td><td class="memItemRight" valign="bottom"><a class="el" href="namespacefiles__util.html#a9a7fcfd84189964e87c1b572f1fe8fbe">files_util::join_path</a> (const std::string &baseDir, const std::string &subpath)</td></tr>
|
|
<tr class="separator:a9a7fcfd84189964e87c1b572f1fe8fbe"><td class="memSeparator" colspan="2"> </td></tr>
|
|
<tr class="memitem:a9c2cf1240e4b850893c4e7a0a2ab641b" id="r_a9c2cf1240e4b850893c4e7a0a2ab641b"><td class="memItemLeft" align="right" valign="top">std::string </td><td class="memItemRight" valign="bottom"><a class="el" href="namespacefiles__util.html#a9c2cf1240e4b850893c4e7a0a2ab641b">files_util::make_dir_name</a> (std::string baseDir, time_t timestamp)</td></tr>
|
|
<tr class="separator:a9c2cf1240e4b850893c4e7a0a2ab641b"><td class="memSeparator" colspan="2"> </td></tr>
|
|
<tr class="memitem:abab65a3cbe43de11dd5d25ed5e4d47e5" id="r_abab65a3cbe43de11dd5d25ed5e4d47e5"><td class="memItemLeft" align="right" valign="top">bool </td><td class="memItemRight" valign="bottom"><a class="el" href="namespacefiles__util.html#abab65a3cbe43de11dd5d25ed5e4d47e5">files_util::set_output_dir</a> (t_params &args, const std::string &new_dir)</td></tr>
|
|
<tr class="separator:abab65a3cbe43de11dd5d25ed5e4d47e5"><td class="memSeparator" colspan="2"> </td></tr>
|
|
<tr class="memitem:af87086ea253d2c9f93852ad9b40fd7ac" id="r_af87086ea253d2c9f93852ad9b40fd7ac"><td class="memItemLeft" align="right" valign="top">bool </td><td class="memItemRight" valign="bottom"><a class="el" href="namespacefiles__util.html#af87086ea253d2c9f93852ad9b40fd7ac">files_util::write_to_file</a> (const std::string &report_path, const std::string &summary_str, const bool append)</td></tr>
|
|
<tr class="separator:af87086ea253d2c9f93852ad9b40fd7ac"><td class="memSeparator" colspan="2"> </td></tr>
|
|
<tr class="memitem:a3849afaac9ec9e32eadd5e0abe8e1aa7" id="r_a3849afaac9ec9e32eadd5e0abe8e1aa7"><td class="memItemLeft" align="right" valign="top">bool </td><td class="memItemRight" valign="bottom"><a class="el" href="namespaceutil.html#a3849afaac9ec9e32eadd5e0abe8e1aa7">util::is_searched_name</a> (const WCHAR *processName, std::set< std::wstring > &names_list)</td></tr>
|
|
<tr class="separator:a3849afaac9ec9e32eadd5e0abe8e1aa7"><td class="memSeparator" colspan="2"> </td></tr>
|
|
<tr class="memitem:afe3e470c6b385ed25f7d5f1d93b420cd" id="r_afe3e470c6b385ed25f7d5f1d93b420cd"><td class="memItemLeft" align="right" valign="top">bool </td><td class="memItemRight" valign="bottom"><a class="el" href="namespaceutil.html#afe3e470c6b385ed25f7d5f1d93b420cd">util::is_searched_pid</a> (long pid, std::set< long > &pids_list)</td></tr>
|
|
<tr class="separator:afe3e470c6b385ed25f7d5f1d93b420cd"><td class="memSeparator" colspan="2"> </td></tr>
|
|
<tr class="memitem:a4afca6eda8fe7bc220cfdb824b79fd8b" id="r_a4afca6eda8fe7bc220cfdb824b79fd8b"><td class="memTemplParams" colspan="2">template<typename TYPE_T > </td></tr>
|
|
<tr class="memitem:a4afca6eda8fe7bc220cfdb824b79fd8b"><td class="memTemplItemLeft" align="right" valign="top">std::string </td><td class="memTemplItemRight" valign="bottom"><a class="el" href="namespaceutil.html#a4afca6eda8fe7bc220cfdb824b79fd8b">util::list_to_str</a> (std::set< TYPE_T > &list)</td></tr>
|
|
<tr class="separator:a4afca6eda8fe7bc220cfdb824b79fd8b"><td class="memSeparator" colspan="2"> </td></tr>
|
|
</table>
|
|
<h2 class="groupheader">Macro Definition Documentation</h2>
|
|
<a id="ac02ff12a84f72a554a357650a1631c2f" name="ac02ff12a84f72a554a357650a1631c2f"></a>
|
|
<h2 class="memtitle"><span class="permalink"><a href="#ac02ff12a84f72a554a357650a1631c2f">◆ </a></span>PID_FIELD_SIZE</h2>
|
|
|
|
<div class="memitem">
|
|
<div class="memproto">
|
|
<table class="memname">
|
|
<tr>
|
|
<td class="memname">#define PID_FIELD_SIZE   4</td>
|
|
</tr>
|
|
</table>
|
|
</div><div class="memdoc">
|
|
|
|
<p class="definition">Definition at line <a class="el" href="hh__scanner_8cpp_source.html#l00019">19</a> of file <a class="el" href="hh__scanner_8cpp_source.html">hh_scanner.cpp</a>.</p>
|
|
|
|
</div>
|
|
</div>
|
|
</div><!-- contents -->
|
|
<!-- start footer part -->
|
|
<hr class="footer"/><address class="footer"><small>
|
|
Generated by <a href="https://www.doxygen.org/index.html"><img class="footer" src="doxygen.svg" width="104" height="31" alt="doxygen"/></a> 1.10.0
|
|
</small></address>
|
|
</body>
|
|
</html>
|