hasherezade/pe-sieve
1
0
Fork 0
mirror of https://github.com/hasherezade/pe-sieve.git synced 2026-10-12 02:15:22 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,037 Commits 19 Branches 45 Tags
master
Commit Graph
96 Commits
Author SHA1 Message Date
hasherezade 22067f3dfd [BUGFIX] Cleanup checking if the process reflection inialized properly 2026-05-31 02:39:57 +02:00
hasherezade 27fa8f5127 [BUGFIX] Fixed closing the process snapshot. Fixed reporting suspicious addresses in thread scan 2026-05-31 01:52:58 +02:00
hasherezade fe5f81b165 [FEATURE] Added new argument: rebase to regulate if the dumped module should be rebased to its original base 2024-11-01 14:54:19 -07:00
hasherezade b1b169c271 [FEATURE] Added a new parameter, regulating what type of results should be reported 2024-10-30 12:59:54 -07:00
hasherezade 392263e32c [FEATURE] In Thread Scanner: retrieve last called syscall 2024-09-08 11:12:56 -07:00
hasherezade 6805ada9be [REFACT] Moved the global pattern matcher into a class 2024-06-14 07:18:29 -07:00
hasherezade ccd36439ea [FEATURE] Show info if loading signatures succeeded or failed 2024-02-14 16:49:17 -08:00
hasherezade c9968f9191 [FEATURE] Save pattern tags in the dump report. Save PE-sieve version in the scan report 2024-02-14 16:28:16 -08:00
hasherezade cef8382e01 [FEATURE] Allow to use pattern file in addition to hardcoded patterns 2024-02-14 16:02:45 -08:00
hasherezade 36657ce963 [FEATURE] Allow to load patterns from a file 2024-02-12 16:59:04 -08:00
hasherezade 071f768174 [REFACT] Changes in presenting the version 2022-11-05 06:13:37 -07:00
hasherezade 6da0e3a9e9 [FEATURE] Refactored version definition. Added version to resources 2022-11-04 07:14:42 -07:00
hasherezade 2929797b86 [REFACT] Use new operators with std::nothrow 2022-01-09 16:41:34 -08:00
hasherezade 5f0920793e [FEATURE] If scanning of inaccessible data requested, auto-enable /refl mode 2021-12-28 06:55:06 -08:00
hasherezade ab0ac7abe4 [NOBIN] Added comments for Doxygen 2021-08-02 11:36:30 +02:00
hasherezade e24b5b41ee [FEATURE] Print warning if scanning of inaccessible pages is enabled, but raw process was used 2021-08-01 12:21:15 +02:00
hasherezade b53322c905 [FEATURE] Try to use lower reflection access on failure 2021-07-30 18:34:16 +02:00
hasherezade ac0b609070 [FEATURE] Pass info if working on process reflection. Use it to decide if can force read inaccessible mem. 2021-07-30 12:46:28 +02:00
hasherezade ab0f439abe [BUGFIX] Allow to modify memory access only for process reflection 
(Issue #86)
 2021-07-30 11:38:49 +02:00
hasherezade 4533e03bae [FEATURE] Added SYNCHRONIZE flag to OpenProcess 2021-07-17 19:24:01 +02:00
hasherezade 97b72911ae [BUGFIX] Enforce access to inaccessible sections (Issue #86) 2021-06-30 03:08:22 +02:00
hasherezade 0d89606277 [FEATURE] Added json_lvl parameter: to control level of details in the report 2021-04-30 16:06:14 +02:00
hasherezade 83e5654ab8 [REFACT] Moved checking dump parameters to the function 2020-10-12 22:53:37 +02:00
hasherezade 70a0cb00bb [REFACT] Removed unused variables, cleanup 2020-07-10 22:46:28 +02:00
hasherezade 51586ad74b [BUGFIX] Fixed closing process handle on error 2020-07-06 05:58:01 -07:00
hasherezade 56c3fe1f11 [BUGFIX] Use process reflection for both: scan and dump 2020-07-03 13:03:12 +02:00
hasherezade eeb9b66be5 [FEATURE] In quiet mode, silence out the incompatibility warnings 2020-07-03 11:41:17 +02:00
hasherezade f2f2f8d45c [FEATURE] Changes in printing messages in colors 2020-07-03 11:23:22 +02:00
hasherezade 472164bf6e [REFACT] Refactored scan function. Single entry point to the scan. Do 
not throw an error on scanner incompatibility.
 2020-07-03 10:41:13 +02:00
hasherezade 5bf0e22921 [REFACT] Fixed a typo in a function name 2020-07-03 09:33:57 +02:00
hasherezade 0069959bd1 [BUGFIX] Set Debug privilege before scan and dump 2020-06-15 00:37:20 +02:00
hasherezade d6aeca0a80 [REFACT] Wrapped everything in pesieve namespace 2020-06-14 19:52:06 +02:00
hasherezade a08063b11d [REFACT] If opening process failed, try again with basic access. Added a 
handle check.
 2020-06-11 08:32:03 +02:00
hasherezade 0faf888634 [FEATURE] New param: refl (make process reflection before scan) 2020-06-08 11:33:36 +02:00
hasherezade 2a29cd4746 [FEATURE] Try to set debug privilege unconditionaly (not on failed 
opening process)
 2020-06-07 11:47:48 +02:00
hasherezade 287a14a038 [REFACT] Wrapped the utils into a namespace pesieve::util 2020-05-29 23:53:57 +02:00
Max Altgelt 13cfd8d065 [BUGFIX] Standardize includes 
Use lower-case filenames with /  as separator.
 2020-05-19 08:20:38 +02:00
hasherezade 3ecb5e9734 [REFACT] Moved functions into pesieve namespace. Moved version to 
includes.
 2020-03-08 18:21:06 +01:00
hasherezade 8a9176b098 [REFACT] Split util.cpp/.h into two files, basing on common functionality 2020-03-08 17:48:12 +01:00
hasherezade 9893bdb353 [REFACT] Build JSON report inside ProcessScanReport. 2020-03-08 01:02:48 +01:00
hasherezade d51d57b10f [BUGFIX] Make a dump report if the minidump was created. Small cleanup. 2020-03-07 20:00:54 +01:00
hasherezade 744a00202e [FEATURE] Save dump_report.json. Refactoring. 2020-03-07 07:18:40 +01:00
hasherezade 3da8e2b351 [FEATURE] Add dump mode info to dump report. Fixes. 2020-03-07 01:39:32 +01:00
hasherezade e4ac71f23a [W-I-P] Implement DumpReport 2020-03-07 01:22:41 +01:00
hasherezade 293ef7f532 [FEATURE] Use absolute path in ResultsDumper. In expand_path: normalize separators. 2020-03-06 21:45:40 +01:00
hasherezade ccfda849d4 [REFACT] Removed a redundant parameter. Use an explicit version of a function 2020-03-06 18:14:51 +01:00
hasherezade 6b60b97185 [BUGFIX] Silence out info in a quite mode 2020-02-26 19:56:01 +01:00
Jack McDowell 2b757b0cf8 Silence all output in quiet mode 2020-02-04 16:00:10 -05:00
hasherezade ab1ad8654c [REFACT] Use IsWow64Process via wrapper function 2019-10-18 17:17:34 +02:00
hasherezade e5c7989464 [FEATURE] Create a minidump under the application name. Added more logs. 2019-10-05 13:47:14 +02:00