From ab0ac7abe4ca94a5d5c6816b94960079321a52af Mon Sep 17 00:00:00 2001 From: hasherezade Date: Mon, 2 Aug 2021 11:36:30 +0200 Subject: [PATCH] [NOBIN] Added comments for Doxygen --- dll_main.cpp | 5 +++++ include/pe_sieve_api.h | 13 ++++--------- main.cpp | 6 ++++-- pe_sieve.cpp | 3 --- pe_sieve.h | 12 ++++++++++++ scanners/mempage_data.h | 10 +++++----- 6 files changed, 30 insertions(+), 19 deletions(-) diff --git a/dll_main.cpp b/dll_main.cpp index 055b2b90..736b8480 100644 --- a/dll_main.cpp +++ b/dll_main.cpp @@ -1,3 +1,8 @@ +/** +* @file +* @brief The main file of PE-sieve built as a DLL +*/ + #include #include #include diff --git a/include/pe_sieve_api.h b/include/pe_sieve_api.h index 8a8c520e..4c71928e 100644 --- a/include/pe_sieve_api.h +++ b/include/pe_sieve_api.h @@ -24,14 +24,11 @@ extern "C" { #endif -/** -PE-sieve version in a DWORD form. -*/ + +//! PE-sieve version in a DWORD form. extern const DWORD PESIEVE_API PESieve_version; -/** -Shows a MessageBox with the informations about PE-sieve. -*/ +//! Shows a MessageBox with the informations about PE-sieve. void PESIEVE_API_FUNC PESieve_help(void); #ifdef __cplusplus @@ -42,9 +39,7 @@ typedef t_report PEsieve_report; typedef t_params PEsieve_params; #endif -/** -Performs a PE-sieve scan with a supplied set of parameters (defined as a structure t_params). Returns a summary of the scan in a variable of type t_report. -*/ +//! Performs a PE-sieve scan with a supplied set of parameters (defined as a structure t_params). Returns a summary of the scan in a variable of type t_report. PEsieve_report PESIEVE_API_FUNC PESieve_scan(const PEsieve_params args); #ifdef __cplusplus diff --git a/main.cpp b/main.cpp index 538c94ef..1b5bda50 100644 --- a/main.cpp +++ b/main.cpp @@ -1,5 +1,7 @@ -// Scans for modified modules within the process of a given PID -// author: hasherezade (hasherezade@gmail.com) +/** +* @file +* @brief The main file of PE-sieve built as an EXE +*/ #include #include diff --git a/pe_sieve.cpp b/pe_sieve.cpp index 4b54ceac..f662b94b 100644 --- a/pe_sieve.cpp +++ b/pe_sieve.cpp @@ -1,6 +1,3 @@ -// Scans the process with a given PID -// author: hasherezade (hasherezade@gmail.com) - #include "pe_sieve.h" #include diff --git a/pe_sieve.h b/pe_sieve.h index 31414b0c..e4c68b75 100644 --- a/pe_sieve.h +++ b/pe_sieve.h @@ -1,3 +1,8 @@ +/** +* @file +* @brief The root of the PE-sieve scanner. +*/ + #pragma once #include @@ -14,6 +19,7 @@ namespace pesieve { + //! The final report about the actions performed on the process: scanning and dumping class ReportEx { public: ReportEx() : @@ -31,7 +37,13 @@ namespace pesieve { ProcessDumpReport* dump_report; }; + //! The string with the basic information about the scanner. std::string info(); + //! The main action performed by PE-sieve: scanning the process and dumping the detected material. + /** + \param args : the configuration of the scan (defined as t_params) + \return A pointer to the generated report (of type ReportEx) + */ ReportEx* scan_and_dump(IN const pesieve::t_params args); }; diff --git a/scanners/mempage_data.h b/scanners/mempage_data.h index 6ac3e465..0d32169e 100644 --- a/scanners/mempage_data.h +++ b/scanners/mempage_data.h @@ -33,9 +33,9 @@ namespace pesieve { return peconv::validate_ptr(this->loadedData, this->loadedSize, field_bgn, field_size); } - ULONGLONG start_va; // VA that was requested. May not be beginning of the region. - ULONGLONG stop_va; // maximum VA that will be read - DWORD protection; + ULONGLONG start_va; ///< VA that was requested. May not be beginning of the region. + ULONGLONG stop_va; ///< the VA at which the read will stop + DWORD protection; ///< page protection DWORD initial_protect; bool is_private; DWORD mapping_type; @@ -47,8 +47,8 @@ namespace pesieve { ULONGLONG region_start; ULONGLONG region_end; - std::string mapped_name; //if the region is mapped from a file - std::string module_name; //if the region is on the list of loaded PEs + std::string mapped_name; ///< if the region is mapped from a file, stores its file name + std::string module_name; ///< if the region is on the list of loaded PEs, stores its module name bool load() {