mirror of
https://github.com/hasherezade/pe-sieve
synced 2026-06-08 14:34:52 +00:00
hasherezade
103 lines
2.6 KiB
C++
103 lines
2.6 KiB
C++
/**
|
|
* @file
|
|
* @brief The main file of PE-sieve built as an EXE
|
|
*/
|
|
|
|
#include <windows.h>
|
|
#include <psapi.h>
|
|
#include <sstream>
|
|
#include <fstream>
|
|
|
|
#include "pe_sieve.h"
|
|
#include "params.h"
|
|
|
|
#include "utils/process_privilege.h"
|
|
#include "params_info/pe_sieve_params_info.h"
|
|
#include "utils/process_reflection.h"
|
|
#include "utils/console_color.h"
|
|
#include "color_scheme.h"
|
|
|
|
|
|
using namespace pesieve;
|
|
using namespace pesieve::util;
|
|
|
|
|
|
void print_report(const pesieve::ReportEx& report, const t_params args)
|
|
{
|
|
if (!report.scan_report) return;
|
|
|
|
std::string report_str;
|
|
if (args.json_output) {
|
|
report_str = report_to_json(report, pesieve::REPORT_ALL, args.results_filter, args.json_lvl);
|
|
} else {
|
|
report_str = scan_report_to_string(*report.scan_report);
|
|
}
|
|
//summary:
|
|
std::cout << report_str;
|
|
if (!args.json_output) {
|
|
std::cout << "---" << std::endl;
|
|
}
|
|
}
|
|
|
|
void free_params(t_params &args)
|
|
{
|
|
free_strparam(args.modules_ignored);
|
|
free_strparam(args.pattern_file);
|
|
}
|
|
|
|
int main(int argc, char *argv[])
|
|
{
|
|
SetDefaultDllDirectories(LOAD_LIBRARY_SEARCH_SYSTEM32 | LOAD_LIBRARY_SEARCH_USER_DIRS);
|
|
|
|
t_params args = { 0 };
|
|
args.results_filter = SHOW_SUSPICIOUS;
|
|
|
|
PEsieveParams uParams(PESIEVE_VERSION_STR);
|
|
if (argc < 2) {
|
|
uParams.printBanner();
|
|
uParams.printBriefInfo();
|
|
system("pause");
|
|
return PESIEVE_INFO;
|
|
}
|
|
if (!uParams.parse(argc, argv)) {
|
|
return PESIEVE_INFO;
|
|
}
|
|
uParams.fillStruct(args);
|
|
//---
|
|
// if scanning of inaccessible pages was requested, auto-enable reflection mode:
|
|
if (args.data == pesieve::PE_DATA_SCAN_INACCESSIBLE || args.data == pesieve::PE_DATA_SCAN_INACCESSIBLE_ONLY) {
|
|
if (!args.make_reflection) {
|
|
args.make_reflection = true;
|
|
if (!args.quiet) {
|
|
paramkit::print_in_color(paramkit::WARNING_COLOR, "[WARNING] Scanning of inaccessible pages requested: auto-enabled reflection mode!\n");
|
|
}
|
|
}
|
|
}
|
|
//print info about current settings:
|
|
if (!args.quiet) {
|
|
std::cout << "PID: " << args.pid << std::endl;
|
|
std::cout << "Output filter: " << translate_out_filter(args.out_filter) << std::endl;
|
|
std::cout << "Dump mode: " << translate_dump_mode(args.dump_mode) << std::endl;
|
|
}
|
|
|
|
pesieve::ReportEx* report = pesieve::scan_and_dump(args);
|
|
t_pesieve_res res = PESIEVE_ERROR;
|
|
if (report != nullptr) {
|
|
print_report(*report, args);
|
|
if (report->scan_report) {
|
|
pesieve::t_report summary = report->scan_report->generateSummary();
|
|
if (summary.scanned > 0) {
|
|
res = (summary.suspicious > 0) ? PESIEVE_DETECTED : PESIEVE_NOT_DETECTED;
|
|
}
|
|
}
|
|
delete report;
|
|
report = nullptr;
|
|
}
|
|
|
|
free_params(args);
|
|
#ifdef _DEBUG
|
|
system("pause");
|
|
#endif
|
|
return res;
|
|
}
|