mirror of
https://github.com/hasherezade/pe-sieve.git
synced 2026-10-11 21:49:57 +00:00
[NOBIN] Added comments for Doxygen
This commit is contained in:
@@ -1,3 +1,8 @@
|
||||
/**
|
||||
* @file
|
||||
* @brief The main file of PE-sieve built as a DLL
|
||||
*/
|
||||
|
||||
#include <windows.h>
|
||||
#include <string>
|
||||
#include <iostream>
|
||||
|
||||
@@ -24,14 +24,11 @@
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/**
|
||||
PE-sieve version in a DWORD form.
|
||||
*/
|
||||
|
||||
//! PE-sieve version in a DWORD form.
|
||||
extern const DWORD PESIEVE_API PESieve_version;
|
||||
|
||||
/**
|
||||
Shows a MessageBox with the informations about PE-sieve.
|
||||
*/
|
||||
//! Shows a MessageBox with the informations about PE-sieve.
|
||||
void PESIEVE_API_FUNC PESieve_help(void);
|
||||
|
||||
#ifdef __cplusplus
|
||||
@@ -42,9 +39,7 @@ typedef t_report PEsieve_report;
|
||||
typedef t_params PEsieve_params;
|
||||
#endif
|
||||
|
||||
/**
|
||||
Performs a PE-sieve scan with a supplied set of parameters (defined as a structure t_params). Returns a summary of the scan in a variable of type t_report.
|
||||
*/
|
||||
//! Performs a PE-sieve scan with a supplied set of parameters (defined as a structure t_params). Returns a summary of the scan in a variable of type t_report.
|
||||
PEsieve_report PESIEVE_API_FUNC PESieve_scan(const PEsieve_params args);
|
||||
|
||||
#ifdef __cplusplus
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
// Scans for modified modules within the process of a given PID
|
||||
// author: hasherezade ([email protected])
|
||||
/**
|
||||
* @file
|
||||
* @brief The main file of PE-sieve built as an EXE
|
||||
*/
|
||||
|
||||
#include <windows.h>
|
||||
#include <psapi.h>
|
||||
|
||||
@@ -1,6 +1,3 @@
|
||||
// Scans the process with a given PID
|
||||
// author: hasherezade ([email protected])
|
||||
|
||||
#include "pe_sieve.h"
|
||||
#include <peconv.h>
|
||||
|
||||
|
||||
+12
@@ -1,3 +1,8 @@
|
||||
/**
|
||||
* @file
|
||||
* @brief The root of the PE-sieve scanner.
|
||||
*/
|
||||
|
||||
#pragma once
|
||||
|
||||
#include <windows.h>
|
||||
@@ -14,6 +19,7 @@
|
||||
|
||||
namespace pesieve {
|
||||
|
||||
//! The final report about the actions performed on the process: scanning and dumping
|
||||
class ReportEx {
|
||||
public:
|
||||
ReportEx() :
|
||||
@@ -31,7 +37,13 @@ namespace pesieve {
|
||||
ProcessDumpReport* dump_report;
|
||||
};
|
||||
|
||||
//! The string with the basic information about the scanner.
|
||||
std::string info();
|
||||
|
||||
//! The main action performed by PE-sieve: scanning the process and dumping the detected material.
|
||||
/**
|
||||
\param args : the configuration of the scan (defined as t_params)
|
||||
\return A pointer to the generated report (of type ReportEx)
|
||||
*/
|
||||
ReportEx* scan_and_dump(IN const pesieve::t_params args);
|
||||
};
|
||||
|
||||
@@ -33,9 +33,9 @@ namespace pesieve {
|
||||
return peconv::validate_ptr(this->loadedData, this->loadedSize, field_bgn, field_size);
|
||||
}
|
||||
|
||||
ULONGLONG start_va; // VA that was requested. May not be beginning of the region.
|
||||
ULONGLONG stop_va; // maximum VA that will be read
|
||||
DWORD protection;
|
||||
ULONGLONG start_va; ///< VA that was requested. May not be beginning of the region.
|
||||
ULONGLONG stop_va; ///< the VA at which the read will stop
|
||||
DWORD protection; ///< page protection
|
||||
DWORD initial_protect;
|
||||
bool is_private;
|
||||
DWORD mapping_type;
|
||||
@@ -47,8 +47,8 @@ namespace pesieve {
|
||||
ULONGLONG region_start;
|
||||
ULONGLONG region_end;
|
||||
|
||||
std::string mapped_name; //if the region is mapped from a file
|
||||
std::string module_name; //if the region is on the list of loaded PEs
|
||||
std::string mapped_name; ///< if the region is mapped from a file, stores its file name
|
||||
std::string module_name; ///< if the region is on the list of loaded PEs, stores its module name
|
||||
|
||||
bool load()
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user