[REFACT] Defined a single baseclass for all the process feature's scanners. Added comments.

CMakeLists.txt

@@ -57,6 +57,7 @@ set (scanners_srcs
 )
 
 set (scanners_hdrs
+	scanners/process_feature_scanner.h
 	scanners/mapping_scanner.h
 	scanners/headers_scanner.h
 	scanners/code_scanner.h

scanners/artefact_scanner.h

@@ -150,13 +150,14 @@ namespace pesieve {
 		size_t initialRegionSize;
 	};
 
-	class ArtefactScanner {
+	//!  A scanner for detection of artefacts related to PE implants in the process workingset.
+	class ArtefactScanner : public ProcessFeatureScanner {
 	public:
 
 		static size_t calcImgSize(HANDLE processHandle, HMODULE modBaseAddr, BYTE* headerBuffer, size_t headerBufferSize, IMAGE_SECTION_HEADER *hdr_ptr = NULL);
 
 		ArtefactScanner(HANDLE _procHndl, bool _isProcRefl, MemPageData &_memPageData, ProcessScanReport& _process_report)
-			: processHandle(_procHndl), isReflection(_isProcRefl),
+			: ProcessFeatureScanner(_procHndl), isReflection(_isProcRefl),
 			processReport(_process_report), isProcess64bit(false),
 			memPage(_memPageData), prevMemPage(nullptr), artPagePtr(nullptr)
 		{
@@ -261,7 +262,6 @@ namespace pesieve {
 		IMAGE_DOS_HEADER* _findDosHdrByPatterns(BYTE *search_ptr, const size_t max_search_size);
 		IMAGE_DOS_HEADER* findDosHdrByPatterns(MemPageData &memPage, const size_t start_offset, size_t stop_offset = INVALID_OFFSET);
 
-		HANDLE processHandle;
 		MemPageData &memPage;
 		MemPageData *prevMemPage;
 		MemPageData *artPagePtr; //pointer to the page where the artefacts were found: either to memPage or to prevMemPage

scanners/code_scanner.h

@@ -86,6 +86,8 @@ namespace pesieve {
 		PatchList patchesList;
 	};
 
+
+	//!  A scanner for detection of patches in the code.
 	class CodeScanner : public ModuleScanner {
 	public:
 

scanners/headers_scanner.h

@@ -76,6 +76,8 @@ namespace pesieve {
 		bool isInPEB;
 	};
 
+
+	//!  A scanner for detection of PE header's modifications.
 	class HeadersScanner : public ModuleScanner {
 	public:
 		HeadersScanner(HANDLE hProc, ModuleData &moduleData, RemoteModuleData &remoteModData)

scanners/iat_scanner.h

@@ -54,6 +54,7 @@ namespace pesieve {
 
 	//---
 
+	//!  A scanner for detection of IAT hooking.
 	class IATScanner : public ModuleScanner {
 	public:
 

scanners/mapping_scanner.h

@@ -5,6 +5,7 @@
 
 #include "module_scanner.h"
 #include "../utils/path_util.h"
+#include "process_feature_scanner.h"
 
 namespace pesieve {
 
@@ -43,17 +44,17 @@ namespace pesieve {
 		std::string mappedFile;
 	};
 
-	//is the mapped file name different than the module file name?
-	class MappingScanner {
+
+	//!  A scanner for detection of inconsistencies in mapping. Checks if the mapped file name is different than the module file name.
+	class MappingScanner : public ProcessFeatureScanner {
 	public:
 		MappingScanner(HANDLE hProc, ModuleData &moduleData)
-			: processHandle(hProc), moduleData(moduleData)
+			: ProcessFeatureScanner(hProc), moduleData(moduleData)
 		{
 		}
 
 		virtual MappingScanReport* scanRemote();
 
-		HANDLE processHandle;
 		ModuleData &moduleData;
 	};
 

scanners/module_data.h

@@ -9,6 +9,7 @@
 
 namespace pesieve {
 
+	//! Loads a module from the disk, corresponding to the module in the scanned process' memory.
 	class ModuleData {
 
 	public:
@@ -103,7 +104,7 @@ namespace pesieve {
 		friend class PeSection;
 	};
 
-	// the module loaded within the scanned process
+	//! Buffers the data from the module loaded in the scanned process into the local memory.
 	class RemoteModuleData
 	{
 	public:

scanners/module_scan_report.h

@@ -21,6 +21,7 @@ namespace pesieve {
 		SCAN_SUSPICIOUS = 1
 	} t_scan_status;
 
+	//!  A baseclass of all the reports detailing on the output of the performed module's scan.
 	class ModuleScanReport
 	{
 	public:

scanners/module_scanner.h

@@ -9,21 +9,24 @@
 #include "module_data.h"
 
 #include "../utils/format_util.h"
+#include "process_feature_scanner.h"
 
 namespace pesieve {
 
-	class ModuleScanner {
+	//!  A base class for all the scanners operating on module data.
+	class ModuleScanner : public ProcessFeatureScanner {
 	public:
 		ModuleScanner(HANDLE _procHndl, ModuleData &_moduleData, RemoteModuleData &_remoteModData)
-			: processHandle(_procHndl), moduleData(_moduleData), remoteModData(_remoteModData)
+			: ProcessFeatureScanner(_procHndl),
+			moduleData(_moduleData), remoteModData(_remoteModData)
 		{
 		}
+
 		virtual ~ModuleScanner() {}
 
 		virtual ModuleScanReport* scanRemote() = 0;
 
 	protected:
-		HANDLE processHandle;
 		ModuleData &moduleData;
 		RemoteModuleData &remoteModData;
 	};

scanners/patch_analyzer.h

@@ -5,6 +5,7 @@
 
 namespace pesieve {
 
+	//! A postprocessor of the detected code patches. Detects if the patch is a hook, and if so, tries to indentify the address where it leads to.
 	class PatchAnalyzer
 	{
 	public:

scanners/pe_section.h

@@ -7,6 +7,7 @@
 
 namespace pesieve {
 
+	//! Buffers the defined PE section belonging to the module loaded in the scanned process into the local memory.
 	class PeSection
 	{
 	public:

scanners/process_feature_scanner.h

@@ -0,0 +1,32 @@
+#pragma once
+
+#include <windows.h>
+#include <map>
+
+#include <peconv.h>
+#include "scan_report.h"
+
+namespace pesieve {
+
+	//!  A base class for all the scanners checking appropriate process' features.
+	class ProcessFeatureScanner {
+
+	public:
+		ProcessFeatureScanner(HANDLE _processHandle)
+			: processHandle(_processHandle)
+		{
+		}
+
+		virtual ~ProcessFeatureScanner() {}
+
+		/**
+		Perform the scan on the remote process
+		\return a pointer to an object of the class inherited from ModuleScanReport
+		*/
+		virtual ModuleScanReport* scanRemote() = 0;
+
+	protected:
+		HANDLE processHandle;
+	};
+
+}; //namespace pesieve

scanners/workingset_scanner.h

@@ -10,6 +10,7 @@
 #include "scan_report.h"
 
 #include "../utils/format_util.h"
+#include "process_feature_scanner.h"
 
 namespace pesieve {
 
@@ -86,10 +87,12 @@ namespace pesieve {
 		}
 	};
 
-	class WorkingSetScanner {
+
+	//!  A scanner for detection of code implants in the process workingset.
+	class WorkingSetScanner : public ProcessFeatureScanner {
 	public:
 		WorkingSetScanner(HANDLE _procHndl, MemPageData &_memPageDatal, pesieve::t_params _args, ProcessScanReport& _process_report)
-			: processHandle(_procHndl), memPage(_memPageDatal),
+			: ProcessFeatureScanner(_procHndl), memPage(_memPageDatal),
 			args(_args),
 			processReport(_process_report)
 		{
@@ -109,7 +112,6 @@ namespace pesieve {
 		bool isCode(MemPageData &memPageData);
 		WorkingSetScanReport* scanExecutableArea(MemPageData &memPageData);
 
-		HANDLE processHandle;
 		bool isReflection;
 		MemPageData &memPage;