Functions — github.com/DFIR-ORC/dfir-orc

CodeHub MCPcopy Create free account

hub / github.com/DFIR-ORC/dfir-orc / functions

Functions5,324 in github.com/DFIR-ORC/dfir-orc

⨍ Functions 5,324◇ Types & classes 1,348

↓ 1 callersMethodGetInLocationBuilder

src/OrcLib/MFTWalker.h:118

↓ 1 callersMethodGetIndexAllocationAttribute

src/OrcLib/MFTRecord.cpp:635

↓ 1 callersFunctionGetInfoCommandDescriptor

src/OrcCapsule/Cmd/CmdMain/CmdInfo.cpp:260

↓ 1 callersMethodGetInputFile

src/OrcLib/Configuration/ConfigFile.cpp:573

↓ 1 callersMethodGetJobStatictics

src/OrcLib/CommandNotification.h:209

↓ 1 callersMethodGetKernelTime

src/OrcCommand/Command/WolfLauncher/Outcome.h:159

↓ 1 callersFunctionGetKeyAndValue

src/OrcLib/CommandAgent.cpp:47

↓ 1 callersMethodGetKeyStatus

src/OrcLib/RegistryWalker.cpp:214

↓ 1 callersMethodGetLastChunkSize

src/OrcLib/Filesystem/Ntfs/Compression/WofChunks.h:44

↓ 1 callersFunctionGetLastFileName

src/OrcCommand/Command/GetThis/GetThis_Run.cpp:827

↓ 1 callersMethodGetLocalConfigurationFromConfig

src/OrcCommand/Command/WolfLauncher/WolfLauncher_Config.cpp:579

↓ 1 callersFunctionGetLogicalProcessorInformationExApi

src/OrcLib/CpuInfo.cpp:113

↓ 1 callersFunctionGetLogicalProcessorInformationXP

GetLogicalProcessorInformationXP implementation provided by Michael Chourdakis of TurboIRC.COM

src/Orc/XPSP2Compatibility.cpp:12

↓ 1 callersMethodGetMappedData

src/OrcLib/FileMappingStream.h:68

↓ 1 callersMethodGetMatchDescription

src/OrcLib/FileFind.cpp:539

↓ 1 callersFunctionGetModuleFileNameApi

src/OrcLib/Utils/WinApi.cpp:943

↓ 1 callersFunctionGetModuleFileNameExApi

src/OrcLib/Utils/WinApi.cpp:998

↓ 1 callersFunctionGetMultiplier

src/OrcLib/Text/ByteQuantity.cpp:27

↓ 1 callersFunctionGetNativeSystemArchitecture

src/OrcCapsule/Cmd/CmdMain/Runner.cpp:43

↓ 1 callersFunctionGetOSVersionInfo

src/OrcCapsule/Cmd/CmdMain/Runner.cpp:28

↓ 1 callersMethodGetPageFaultCount

src/OrcCommand/Command/WolfLauncher/Outcome.h:226

↓ 1 callersMethodGetPe32OptionalHeader

src/OrcLib/PEInfo.cpp:106

↓ 1 callersMethodGetPe64OptionalHeader

src/OrcLib/PEInfo.cpp:117

↓ 1 callersMethodGetPeakJobMemory

src/OrcCommand/Command/WolfLauncher/Outcome.h:241

↓ 1 callersMethodGetPeakProcessMemory

src/OrcCommand/Command/WolfLauncher/Outcome.h:238

↓ 1 callersFunctionGetPhysicallyInstalledSystemMemoryApi

src/OrcLib/SystemDetails.cpp:132

↓ 1 callersMethodGetPid

src/OrcCommand/Command/WolfLauncher/Outcome.h:165

↓ 1 callersMethodGetProcessCount

src/OrcCommand/Command/WolfLauncher/Outcome.h:229

↓ 1 callersMethodGetProcessIoCounters

src/OrcLib/CommandNotification.h:201

↓ 1 callersMethodGetProcessTimes

src/OrcLib/CommandNotification.h:195

↓ 1 callersMethodGetProcesses

src/OrcLib/RunningProcesses.cpp:79

↓ 1 callersFunctionGetProcessorCount

src/OrcLib/Archive/7z/Archive7z.cpp:132

↓ 1 callersMethodGetQueueBehavior

src/OrcLib/CommandMessage.h:190

↓ 1 callersFunctionGetRemoveCommandDescriptor

src/OrcCapsule/Cmd/CmdMain/CmdRemove.cpp:136

↓ 1 callersFunctionGetResourceCommandDescriptor

src/OrcCapsule/Cmd/CmdResource.cpp:1213

↓ 1 callersMethodGetResourceDataChunk

src/OrcLib/FileFormat/PeParser.cpp:1027

↓ 1 callersFunctionGetResourceLang

tools/rcedit/src/cmd/list/resources.cpp:103

↓ 1 callersFunctionGetResourceLinks

parse all resource links from xml files and register them to check later if they have been embedded

src/OrcLib/EmbeddedResource_Embed.cpp:538

↓ 1 callersFunctionGetResourceNames

tools/rcedit/src/cmd/list/resources.cpp:78

↓ 1 callersFunctionGetResourceString

src/OrcCommand/Command/ToolEmbed/ToolEmbed_Config.cpp:32

↓ 1 callersFunctionGetResourceString

src/OrcCapsule/Utilities/Resource.cpp:160

↓ 1 callersFunctionGetResourceTypeName

Well-known Windows resource type IDs

src/OrcCapsule/Cmd/CmdResource.cpp:435

↓ 1 callersFunctionGetResourceTypes

tools/rcedit/src/cmd/list/resources.cpp:62

↓ 1 callersFunctionGetRunnerSlotInfo

src/OrcCapsule/Cmd/CmdMain/CmdInfo.cpp:64

↓ 1 callersMethodGetSchemaFromConfig

src/OrcCommand/UtilitiesMain.h:807

↓ 1 callersMethodGetScopedCollectionProfiler

src/OrcLib/FileFind.h:337

↓ 1 callersFunctionGetShadowCopiesInformation

src/OrcLib/Filesystem/Ntfs/ShadowCopy/ShadowCopy.cpp:303

↓ 1 callersFunctionGetShadowCopyInformation

src/OrcLib/Location.cpp:35

↓ 1 callersFunctionGetShadowCopyLocations

src/OrcLib/LocationSet.cpp:133

↓ 1 callersFunctionGetSignersCertificateAuthoritiesName

src/OrcLib/Authenticode.cpp:267

↓ 1 callersFunctionGetSignersCertificateAuthoritiesThumbprint

src/OrcLib/Authenticode.cpp:307

↓ 1 callersMethodGetSize

src/OrcLib/TemporaryStream.cpp:217

↓ 1 callersMethodGetSize

src/OrcLib/UncompressWofStream.cpp:215

↓ 1 callersMethodGetSize

src/OrcLib/CacheStream.cpp:189

↓ 1 callersMethodGetStart

src/OrcCommand/Command/WolfLauncher/Outcome.h:312

↓ 1 callersMethodGetStartTime

Process start notification properties

src/OrcLib/CommandNotification.h:179

↓ 1 callersMethodGetStartingTime

src/OrcCommand/Command/WolfLauncher/Outcome.h:420

↓ 1 callersMethodGetStatus

src/OrcLib/DriverMgmt.cpp:472

↓ 1 callersMethodGetStreams

src/OrcLib/MftRecordAttribute.cpp:354

↓ 1 callersFunctionGetTargetArchitectureFromPeFile

src/OrcCapsule/Cmd/CmdMain/CmdAdd.cpp:37

↓ 1 callersFunctionGetTargetArchitectureFromResourceString

src/OrcCapsule/Cmd/CmdMain/CmdAdd.cpp:111

↓ 1 callersFunctionGetTempPathApi

src/OrcCapsule/Cmd/CmdMain/CmdRun.cpp:284

↓ 1 callersFunctionGetTempPathApi

src/OrcLib/Utils/WinApi.cpp:859

↓ 1 callersFunctionGetTemporaryDirectory

src/OrcCapsule/Cmd/CmdMain/CmdRun.cpp:319

↓ 1 callersMethodGetTerminatedProcessCount

src/OrcCommand/Command/WolfLauncher/Outcome.h:235

↓ 1 callersMethodGetTimeZoneDaylight

src/OrcCommand/Command/WolfLauncher/Outcome.h:429

↓ 1 callersMethodGetTimestampKey

Timestamp is used as a unique identifier between orc execution and multiple files

src/OrcCommand/Command/WolfLauncher/Outcome.h:417

↓ 1 callersMethodGetUnSafeMFTSegmentNumber

src/OrcLib/MFTRecord.h:88

↓ 1 callersMethodGetUserTime

src/OrcCommand/Command/WolfLauncher/Outcome.h:156

↓ 1 callersFunctionGetVolumeSerialUsingFileHandle

src/OrcLib/Location.cpp:213

↓ 1 callersFunctionGetWofChunkCount

src/OrcLib/Filesystem/Ntfs/Compression/WofChunks.cpp:154

↓ 1 callersFunctionGetWofDataAttribute

src/OrcLib/MftRecordAttribute.cpp:72

↓ 1 callersFunctionGetWofLastChunkSize

src/OrcLib/Filesystem/Ntfs/Compression/WofChunks.cpp:184

↓ 1 callersFunctionGetWofReparsePoint

src/OrcLib/MftRecordAttribute.cpp:115

↓ 1 callersFunctionGetWorkspaceSize

src/OrcLib/Filesystem/Ntfs/Compression/Engine/Nt/NtDecompressorConcept.cpp:22

↓ 1 callersFunctionGetXmlAttributeValueMatch

Look into the current xml element for an attributes name which match the provided regex

src/OrcLib/EmbeddedResource_Embed.cpp:270

↓ 1 callersFunctionGetXmlAttributesValue

src/OrcLib/EmbeddedResource_Embed.cpp:657

↓ 1 callersFunctionGetXmlAttributesValueMatch

Look into the current xml file for all attributes name which match the provided regex

src/OrcLib/EmbeddedResource_Embed.cpp:349

↓ 1 callersMethodGetXmlDataStream

src/OrcLib/AutoRuns.h:59

↓ 1 callersFunctionGetXmlElementValueMatch

Look into the current xml element for an attribute's name which match the provided regex

src/OrcLib/EmbeddedResource_Embed.cpp:403

↓ 1 callersFunctionGetXmlElementsValueMatch

Look into the current xml file for all attributes name which match the provided regex

src/OrcLib/EmbeddedResource_Embed.cpp:447

↓ 1 callersFunctionGetXmlLocalConfigBuilder

src/OrcCommand/Command/DD/DD.h:69

↓ 1 callersMethodGetXmlPosition

src/OrcLib/EmbeddedResource_Embed.cpp:173

↓ 1 callersFunctionHandleAddRunner

src/OrcCapsule/Cmd/CmdMain/CmdAdd.cpp:303

↓ 1 callersFunctionHandleGetRunner

src/OrcCapsule/Cmd/CmdMain/CmdGet.cpp:16

↓ 1 callersFunctionHandleInfo

src/OrcCapsule/Cmd/CmdMain/CmdInfo.cpp:172

↓ 1 callersFunctionHandleRemoveRunner

src/OrcCapsule/Cmd/CmdMain/CmdRemove.cpp:15

↓ 1 callersFunctionHandleResourceGet

src/OrcCapsule/Cmd/CmdResource.cpp:205

↓ 1 callersFunctionHandleResourceHexdump

src/OrcCapsule/Cmd/CmdResource.cpp:297

↓ 1 callersFunctionHandleResourceList

src/OrcCapsule/Cmd/CmdResource.cpp:654

↓ 1 callersFunctionHandleResourceSet

src/OrcCapsule/Cmd/CmdResource.cpp:39

↓ 1 callersFunctionHandleRun

src/OrcCapsule/Cmd/CmdMain/CmdRun.cpp:755

↓ 1 callersMethodHasAuthenticodeData

src/OrcLib/DataDetails.h:217

↓ 1 callersMethodHasBeenEmbedded

src/OrcLib/EmbeddedResource_Embed.cpp:170

↓ 1 callersMethodHasCatalog

src/OrcLib/Filesystem/Ntfs/ShadowCopy/SnapshotsIndexHeader.h:57

↓ 1 callersMethodHasExeHeader

src/OrcLib/PEInfo.cpp:47

↓ 1 callersFunctionHasExplicitSecurityDescriptor

src/OrcLib/Utils/WinApi.cpp:395

↓ 1 callersMethodHasFileVersionInfo

src/OrcLib/PEInfo.cpp:36

↓ 1 callersMethodHasHyperThreading

src/OrcLib/CpuId.cpp:241

↓ 1 callersFunctionHasSameAttributes

src/OrcLib/Text/Print/LocationSet.cpp:22

← previous next →1,101–1,200 of 5,324, ranked by callers