A tiny PE-sieve based process scanner

main.cpp

#include <stdio.h>
#include <windows.h>
#include <psapi.h>
#include <iostream>
#include <string>
#include <vector>

#include "pe_sieve_api.h"
#pragma comment(lib, "pe-sieve.lib")

bool is_replaced_process(DWORD processID)
{
    t_params args = { 0 };
    args.pid = processID;
    args.quiet = true;
    args.filter = 0;

    t_report report = PESieve_scan(args);
    if (report.replaced | report.suspicious){
        return true;
    }
    return false;
}

size_t find_replaced_process(std::vector<DWORD> &replaced)
{
    DWORD aProcesses[1024], cbNeeded, cProcesses;
    unsigned int i;

    if ( !EnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded)) {
        return NULL;
    }

    //calculate how many process identifiers were returned.
    cProcesses = cbNeeded / sizeof(DWORD);

    char image_buf[MAX_PATH] = { 0 };

    for ( i = 0; i < cProcesses; i++ ) {
        if ( aProcesses[i] == 0 ) continue;
        DWORD pid = aProcesses[i];
        std::cout << ">> Scanning PID: " << std::dec << pid << std::endl;
        if ( is_replaced_process(pid) ) {
            replaced.push_back(pid);
        }
    }
    return replaced.size();
}

int main(int argc, char *argv[])
{
    std::vector<DWORD> replaced;
    find_replaced_process(replaced);
    std::cout << "All Replaced: " << std::dec << replaced.size() << std::endl;

    char image_buf[MAX_PATH] = { 0 };
    std::vector<DWORD>::iterator itr;
    for (itr = replaced.begin(); itr != replaced.end(); itr++) {
        DWORD pid = *itr;
        std::cout << "[+] PID: " << std::dec << pid << std::endl;
        HANDLE hProcess = OpenProcess( PROCESS_QUERY_INFORMATION, FALSE, pid);
        if (hProcess) {
            memset(image_buf, 0, MAX_PATH);
            GetProcessImageFileNameA(hProcess, image_buf, MAX_PATH);
            std::cout << image_buf << std::endl;
            CloseHandle(hProcess);
        }
    }
    system("pause");
    return 0;
}

Using PE-sieve build as a DLL: https://github.com/hasherezade/pe-sieve

Full project available here: https://github.com/hasherezade/hollows_hunter