Morph MORPH
SIGN IN SIGN UP
dhruvhead / pe-sieve UNCLAIMED
0 0 1 C++

COMMITS

/ scanners/artefact_scanner.cpp
stats
October 18, 2022
H
[BUGFIX] Fixed: stuck on scanning for PE headers artifacts
hasherezade committed
91a17f6
August 30, 2022
H
[REFACT] Pass process_details structure to ArtefactScanner
hasherezade committed
2e6aab6
H
[REFACT] Renamed a variable
hasherezade committed
d68d297
January 22, 2022
H
[REFACT] Removed redundant param: processHandle from ModuleScanReport
hasherezade committed
f81f273
July 30, 2021
H
[BUGFIX] Fixed passing the info about process refl. to all instanced of MemPageData
hasherezade committed
63e9023
July 29, 2021
H
[REFACT] When calculating imgSize, skip uncommited pages (rather than inaccessible) - Issue #85
hasherezade committed
c1f689f
June 27, 2021
H
[BUGFIX] Fixed calculation of the image size: ArtefactScanner::calcImgSize (Issue #85)
hasherezade committed
27d7ed9
July 20, 2020
H
[REFACT] Small cleanup of types, explicit cast, etc
hasherezade committed
bb94082
July 11, 2020
H
[REFACT] Removed unused variables
hasherezade committed
3e654ca
H
[REFACT] Pass ProcessScanReport by reference, not by pointer
hasherezade committed
cfeafde
July 10, 2020
H
[BUGFIX] Fixed a mistakenly deleted variable
hasherezade committed
1df85db
H
[REFACT] Removed unused variables, cleanup
hasherezade committed
70a0cb0
July 6, 2020
H
[FEATURE] Additional MZ pattern
hasherezade committed
6f9ed9f
H
[FEATURE] Hidden debug strings about sections header validation
hasherezade committed
caac4e2
H
[BUGFIX] Try to get infomation about the architecture from the detected PE header
hasherezade committed
c8729b9
June 14, 2020
H
[REFACT] Wrapped everything in pesieve namespace
hasherezade committed
d6aeca0
June 13, 2020
H
[BUGFIX] Fixed variable name
hasherezade committed
8dccfc4
H
[REFACT] In ArtefactScanner::calcImgSize implemented as static
hasherezade committed
6e4d199
June 11, 2020
H
[BUGFIX] In ArtefactScan: before searching artefacts in a previous page,
hasherezade committed
3625603
H
[BUGFIX] In MemPageData: allow to limit the area that will be read
hasherezade committed
49f7c3c
June 2, 2020
H
[REFACT] Wrap more utils in namespace pesieve::util
hasherezade committed
28407ad
November 23, 2019
H
[REFACT] Removed unused variables
hasherezade committed
36a3767
November 15, 2019
H
[REFACT] Hidden a debug string. Additional check in validate regions
hasherezade committed
5ea2c08
H
[BUGFIX] Move min_offset of the search after section headers end
hasherezade committed
b75fd44
H
[BUGFIX] Validate raw section alignment in the found hdr (if the validation of virtual failed)
hasherezade committed
f2b3cc3
November 14, 2019
H
[BUGFIX] Validate section regions in the detected header
hasherezade committed
ebda00b
November 13, 2019
H
[BUGFIX] ArtefactScanner: reset sec. hdr if validation failed
hasherezade committed
7f7a95f
November 3, 2019
H
[REFACT] Refactored checking a pointer to the found DOS header
hasherezade committed
90c84ea
November 2, 2019
H
[BUGFIX] Validate a pointer to DOS header before use
hasherezade committed
4561d3d
H
[REFACT] Use additional variable
hasherezade committed
2a6279c
H
[REFACT] Fixed misleading variable name, added a comment.
hasherezade committed
0ab67c3
November 1, 2019
H
[FEATURE] New PE recovery path: sections_hdr -> DOS hdr -> File Hdr
hasherezade committed
54ff550
H
[FEATURE] Search DOS header by the stub patterns
hasherezade committed
98efe2f
H
[FEATURE] Add another pattern to search sections
hasherezade committed
0ac3243
H
[BUGFIX] Ensure that min_offset is not going backwards after sections found.
hasherezade committed
bcbf461
H
[BUGFIX] Move min_offset to the beginning of found sections
hasherezade committed
8c7301e
H
[BUGFIX] If DOS header not found, detect the payload by NT Header
hasherezade committed
e5a7a96
H
[BUGFIX] Updated libpeconv. Refactored PE-sieve to follow the changes in API
hasherezade committed
2acd40a
H
[BUGFIX] Move the search window while searching Sections Header (Issue #44)
hasherezade committed
de299fc
August 11, 2019
H
[BUGFIX] In ArtefactsScanner: try to find 'MZ' signature before calculating the PE base
hasherezade committed
ce66fad
June 16, 2019
H
[BUGFIX] In ArtefactsScanner: added missing bounds check
hasherezade committed
3c0d52e
June 11, 2019
H
[REFACT] Use brackets for including peconv.h
hasherezade committed
4fb0dbd
May 21, 2019
H
[BUGFIX] In calculating PE size: make sure that consecutive sections
hasherezade committed
1b4a76a
H
[BUGFIX] In calculating PE size: validate each section header
hasherezade committed
68c7bad
March 14, 2019
H
[FEATURE] In calcImageBase: if cannot calculate size basing on sections,
hasherezade committed
a8e5723
March 10, 2019
H
[FEATURE] Reconstruct optional header
hasherezade committed
a793460
H
[REFACT] Simplified a condition
hasherezade committed
f00ba38
H
[FEATURE] Store information if the process is 64bit in the artefacts
hasherezade committed
6731b4e
H
[BUGFIX] Detect if the process is 32 or 64bit (in ArtefactsScanner)
hasherezade committed
3504a7f
March 9, 2019
H
[REFACT] Use fetch_region_size from libpeconv
hasherezade committed
73bb735