forked from weak1337/BE-Shellcode
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathbeshellcode.h
More file actions
34 lines (33 loc) · 790 Bytes
/
Copy pathbeshellcode.h
File metadata and controls
34 lines (33 loc) · 790 Bytes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
#pragma once
#include <Windows.h>
#include <iostream>
#include <tuple>
#include <vector>
#include "veh.h"
#include "systhreadfinder.h"
#include "misc.h"
#include "modules.h"
#include "sigs.h"
#include "thread_scan.h"
namespace beshellcode {
enum class report_ids : uint8_t {
IllegaleCaller, //BE -> 0x43
HiddenSystemThread,
KiUserExceptionDispatcherHook,
BlacklistedDll,
BlacklistedDriver,
PatchedFunction,
HitSignature,
SuspendedThread,
IllegalRip
};
void report(report_ids report_id);
HANDLE add_exception_handler();
void remove_exception_handler(HANDLE handle);
void find_system_threads();
void check_KiUserExceptionDispatcher_hook();
void check_modules();
void function_integrity();
void scan_sigs();
void scan_threads();
}