Morph MORPH
SIGN IN SIGN UP
dhruvhead / pe-sieve UNCLAIMED
0 0 1 C++

COMMITS

/ scanners/module_data.cpp
stats
August 23, 2022
S
fix clang compile issues (#109)
secDre4mer committed
7762e96
January 21, 2022
H
[FEATURE] In loadImportsList: return true if no failure of loading (even if output is of 0 size)
hasherezade committed
805af20
H
[FEATURE] Added loadImportsList to remote module
hasherezade committed
ef769b0
January 18, 2022
H
[BUGFIX] In ModuleData: added autoswitching path to Wow64
hasherezade committed
4d3cac3
H
[BUGFIX] Use cache to reload Wow64
hasherezade committed
e6a99c5
H
[FEATURE] Scan IAT by lookup on original Import Table
hasherezade committed
8f86143
January 9, 2022
H
[FEATURE] Allow to enable/disable caching by a param
hasherezade committed
d52635c
H
[FEATURE] Implemented modules caching (Issue #94)
hasherezade committed
67b971e
December 27, 2021
H
[REFACT] Use function collect_thunks from libPEconv
hasherezade committed
e17e6a7
November 9, 2021
H
[REFACT] Use consistent names: isReflection for the field, isRefl: function
hasherezade committed
a9592e5
September 9, 2021
H
[NOBIN] Fixed comments (Issue #15)
hasherezade committed
b288e00
H
[FEATURE] More precise clearing of IAT: field by field (Issue #15)
hasherezade committed
47ee21b
September 3, 2021
H
[NOBIN] Cleanup, removed commented out lines
hasherezade committed
fb9c3d8
H
[FEATURE] Hidden debug strings. Incremented version
hasherezade committed
dd8a6f6
H
[FEATURE] Collect all the relocated fields in the patched module
hasherezade committed
b26a804
August 11, 2021
H
[FEATURE] If in reflection mode: force-read inaccessible header
hasherezade committed
d167c2a
July 31, 2021
H
[FEATURE] Depending on data parameter (and refl mode) scan also inaccessible PE sections
hasherezade committed
f97c2ad
October 13, 2020
H
[FEATURE] Scan non-executable sections for hooks, if data scanning is enabled
hasherezade committed
0ef77a9
October 12, 2020
H
[BUGFIX] Fixed checking if the section contains the Entry Point (affecting: Issue #73)
hasherezade committed
5cbe92e
July 28, 2020
H
[REFACT] Removed some debug strings
hasherezade committed
1f52cdb
July 27, 2020
H
Revert "[REFACT] Removed too noisy debug strings"
hasherezade committed
e5ebe1d
July 26, 2020
H
[REFACT] Removed too noisy debug strings
hasherezade committed
a7bfff9
July 20, 2020
H
[BUGFIX] Scan section basing on their current protection only. Always scan entry section. (Issue #66)
hasherezade committed
573536f
H
[FEATURE] In RemoteModData: added checking if the section contains Entry Point
hasherezade committed
6f89ce5
July 18, 2020
H
[BUGFIX] Fixed detecting MEM_SEC as executable if access changed (Issue #66)
hasherezade committed
c48315e
July 16, 2020
H
[BUGFIX] In expand_path: always try to convert from the device path
hasherezade committed
33db1f3
July 10, 2020
H
[REFACT] Removed unused variables
hasherezade committed
c81da54
June 14, 2020
H
[REFACT] Wrapped everything in pesieve namespace
hasherezade committed
d6aeca0
H
[BUGFIX] In PeBuffer, ModuleData: use calculated ImageSize if the size
hasherezade committed
908f38b
June 12, 2020
H
[FEATURE] Scan load full remote module for IAT scan only if Import Table
hasherezade committed
9afac89
H
[REFACT] In remote PeSection: if PE has no sections, treat full image as
hasherezade committed
52f3194
June 2, 2020
H
[REFACT] Wrap more utils in a namespace pesieve::util
hasherezade committed
0e317bc
May 29, 2020
H
[REFACT] Wrapped the utils into a namespace pesieve::util
hasherezade committed
287a14a
April 17, 2020
M
[BUGFIX] Standardize includes
Max Altgelt committed
13cfd8d
April 12, 2020
H
[FEATURE] Scan against IAT hooks
hasherezade committed
6dffe07
March 8, 2020
H
[REFACT] Split util.cpp/.h into two files, basing on common functionality
hasherezade committed
8a9176b
December 30, 2019
H
[BUGFIX] In code scan: fixed sections wrongly identified as executable
hasherezade committed
7637c6c
December 28, 2019
H
[BUGFIX] In ModuleData: fixed updating reloc base. Added functions tofetch Image Base from headers
hasherezade committed
3771380
December 23, 2019
H
[REFACT] Removed field
hasherezade committed
996b2df
December 22, 2019
H
[BUGFIX] Use the base saved in the remote header as the reloc base
hasherezade committed
5cb9957
December 19, 2019
H
[REFACT] Normalized a boolean type
hasherezade committed
ed4f27e
December 15, 2019
H
[BUGFIX] Disable FS redirection while module loading by default
hasherezade committed
60a06ca
November 12, 2019
H
[REFACT] Use wrappers to manipulate FS redirection (for backward compat.)
hasherezade committed
89f409e
H
[BUGFIX] If cannot read module, try to disable FS redirection
hasherezade committed
f54ab6e
November 11, 2019
H
[FEATURE] Scan detached MEM_IMG for hooks
hasherezade committed
70b1c48
October 18, 2019
H
[REFACT] Use IsWow64Process via wrapper function
hasherezade committed
ab1ad86
June 15, 2019
H
[BUGFIX] Fixed invalid is section executable check: overwriting flag (Issue #36)
hasherezade committed
12a702d
H
[BUGFIX] Detect sections dynamically changed into executable (Issue #36)
hasherezade committed
c4fa6a9
September 8, 2018
H
[BUGFIX] Fixed detecting executable pages (added PAGE_EXECUTE_WRITECOPY)
hasherezade committed
1c4a6ca
August 11, 2018
H
[FEATURE] In case if converting module name failed, return the original
hasherezade committed
f592ce6