Functions — github.com/DFIR-ORC/dfir-orc

CodeHub MCPcopy Create free account

hub / github.com/DFIR-ORC/dfir-orc / functions

Functions5,324 in github.com/DFIR-ORC/dfir-orc

⨍ Functions 5,324◇ Types & classes 1,348

↓ 1 callersMethodHasSecurityDirectory

src/OrcLib/FileFormat/PeParser.cpp:623

↓ 1 callersFunctionHasWriteAccess

src/OrcLib/Utils/WinApi.cpp:388

↓ 1 callersFunctionHex

src/OrcLib/Text/HexDump.h:55

↓ 1 callersFunctionHexDump

src/OrcLib/Text/HexDump.h:94

↓ 1 callersFunctionIgnoreOptions

src/OrcCommand/Command/WolfLauncher/WolfLauncher_Config.cpp:89

↓ 1 callersMethodIncrementSubKeysSeenCount

src/OrcLib/RegistryWalker.cpp:204

↓ 1 callersMethodInit

src/OrcLib/FatWalker.cpp:28

↓ 1 callersMethodInitialize

src/OrcLib/USNJournalWalkerOffline.cpp:46

↓ 1 callersMethodInitialize

src/OrcLib/ExtensionLibrary.h:172

↓ 1 callersMethodInitialize

src/OrcLib/ZipLibrary.cpp:120

↓ 1 callersMethodInitializeBuffer

src/OrcLib/CsvFileWriter.cpp:205

↓ 1 callersMethodInitializeMappings

src/OrcLib/TaskTracker.cpp:282

↓ 1 callersFunctionInitializeStatisticsOutput

src/OrcCommand/Command/FastFind/FastFind_Config.cpp:42

↓ 1 callersFunctionInitializeStatisticsOutput

src/OrcCommand/Command/GetThis/GetThis_Config.cpp:46

↓ 1 callersMethodInputTypeValue

src/OrcCommand/Command/WolfLauncher/Outcome.h:67

↓ 1 callersFunctionInsertUniqueName

src/OrcCommand/Command/GetThis/GetThis_Run.cpp:703

↓ 1 callersMethodInstall

src/OrcLib/DriverMgmt.cpp:193

↓ 1 callersMethodIoCounters

src/OrcCommand/Command/WolfLauncher/WolfTask.h:68

↓ 1 callersFunctionIsAttributeInBounds

src/OrcLib/MFTRecord.cpp:26

↓ 1 callersMethodIsBitLocked

src/OrcLib/Partition.cpp:84

↓ 1 callersFunctionIsCharLtrZero

src/OrcLib/MFTUtils.cpp:19

↓ 1 callersMethodIsContinuation

src/OrcLib/MftRecordAttribute.h:119

↓ 1 callersMethodIsCritical

src/OrcLib/OrcException.h:133

↓ 1 callersMethodIsDirectory

src/OrcLib/MFTRecordFileInfo.cpp:137

↓ 1 callersMethodIsEOFEntry

src/OrcLib/FatTableEntry.h:53

↓ 1 callersMethodIsESP

src/OrcLib/Partition.cpp:79

↓ 1 callersFunctionIsExcludedDataAttribute

src/OrcLib/FileFind.cpp:109

↓ 1 callersFunctionIsFailureAcceptedForDirectories

Directory can have some of those attribute but usually they don't

src/OrcLib/FileInfo.cpp:94

↓ 1 callersMethodIsFree

src/OrcLib/FatTableEntry.h:47

↓ 1 callersMethodIsHidden

src/OrcLib/Partition.cpp:34

↓ 1 callersMethodIsHyperThreadingEnabled

src/OrcLib/CpuInfo.cpp:306

↓ 1 callersMethodIsInitialized

src/OrcLib/CircularStorage.h:292

↓ 1 callersMethodIsInitialized

src/OrcLib/ExtensionLibrary.h:129

↓ 1 callersMethodIsJunction

src/OrcLib/MFTRecord.h:49

↓ 1 callersFunctionIsLegacyFamily

NT 5.1 = XP, 5.2 = XP x64/Server 2003, 6.0 = Vista/Server 2008

src/OrcCapsule/Cmd/CmdMain/Runner.cpp:38

↓ 1 callersMethodIsLocalStorage

src/OrcLib/Filesystem/Ntfs/ShadowCopy/SnapshotsIndexHeader.h:58

↓ 1 callersMethodIsMemoryStream

src/OrcLib/ArchiveUpdateCallback.cpp:42

↓ 1 callersMethodIsMicrosoftReserved

src/OrcLib/Partition.cpp:89

↓ 1 callersFunctionIsNetworkPath

Detect if a path is a network path or a local path. Avoid using PathIsNetworkPathW which make a direct dependency on shlwapi.dll and at least an indir

src/OrcCapsule/Utilities/Process.cpp:59

↓ 1 callersMethodIsPipeStream

src/OrcLib/ArchiveUpdateCallback.cpp:41

↓ 1 callersFunctionIsPreferredLanguage

src/OrcLib/FileFormat/PeVersionInfo.cpp:335

↓ 1 callersMethodIsReadOnly

src/OrcLib/Partition.cpp:29

↓ 1 callersMethodIsReady

src/OrcLib/VolumeReader.h:50

↓ 1 callersFunctionIsReducedHardeningDrive

Network/removable drives reject a protected DACL of local SIDs (the share/device governs access), which would orphan the file at creation. Skip harden

src/OrcLib/Utils/WinApi.cpp:467

↓ 1 callersFunctionIsRunningInHyperV

src/OrcLib/SystemDetails.cpp:52

↓ 1 callersFunctionIsRunningInQEMU

src/OrcLib/SystemDetails.cpp:98

↓ 1 callersFunctionIsRunningInVMware

src/OrcLib/SystemDetails.cpp:64

↓ 1 callersFunctionIsRunningInVirtualBox

src/OrcLib/SystemDetails.cpp:81

↓ 1 callersFunctionIsRunningInXen

src/OrcLib/SystemDetails.cpp:115

↓ 1 callersFunctionIsSecDescIndexEntryInBounds

src/OrcLib/MFTWalker.cpp:712

↓ 1 callersFunctionIsSurrogate

src/OrcLib/Utils/StdStream/WideStreambufConverter.cpp:13

↓ 1 callersMethodIsSymbolicLink

src/OrcLib/MFTRecord.h:50

↓ 1 callersMethodIsSystem

src/OrcLib/Partition.cpp:24

↓ 1 callersMethodKernelTime

src/OrcCommand/Command/WolfLauncher/WolfTask.h:67

↓ 1 callersFunctionLaunchRelocatedOrc

src/OrcCapsule/Utilities/Process.cpp:141

↓ 1 callersFunctionLaunchRunnerProcess

src/OrcCapsule/Cmd/CmdMain/CmdRun.cpp:630

↓ 1 callersMethodLoad

tools/rcedit/src/cmd/list/resources.cpp:150

↓ 1 callersMethodLoadBitField

src/OrcLib/MftRecordAttribute.cpp:734

↓ 1 callersMethodLoadCommonExtensions

src/OrcCommand/UtilitiesMain.cpp:295

↓ 1 callersMethodLoadDiskProperties

src/OrcLib/VHDVolumeReader.cpp:61

↓ 1 callersMethodLoadHive

src/OrcLib/RegistryWalker.cpp:256

↓ 1 callersFunctionLoadNtdll

src/OrcLib/Utils/WinApi.cpp:511

↓ 1 callersMethodLoadRunningTasksAndModules

src/OrcLib/TaskTracker.cpp:143

↓ 1 callersMethodLog

src/OrcLib/Log/Logger.h:53

↓ 1 callersMethodLogicalCores

src/OrcLib/CpuInfo.cpp:282

↓ 1 callersFunctionMain

src/OrcCommand/Command/GetSamples/GetSamples.h:106

↓ 1 callersFunctionMakeStringView

src/OrcLib/Utils/BufferView.h:74

↓ 1 callersFunctionMakeWStringView

src/OrcLib/Utils/BufferView.h:96

↓ 1 callersFunctionMapFile

tools/rcedit/src/cmd/set/cmd_set.cpp:102

↓ 1 callersMethodMaximumSize

src/OrcLib/Filesystem/Ntfs/ShadowCopy/SnapshotsIndexHeader.h:50

↓ 1 callersMethodMiniDumpWriteDump

src/OrcLib/DbgHelpLibrary.h:48

↓ 1 callersFunctionMiniDumpWriteDumpApi

src/OrcLib/Robustness.cpp:22

↓ 1 callersMethodMoveCompletedCommand

src/OrcLib/CommandAgent.cpp:798

↓ 1 callersFunctionNextSecDescIndexEntryChecked

src/OrcLib/MFTWalker.cpp:723

↓ 1 callersFunctionNormalizeArguments

src/OrcCapsule/OrcCapsuleCli.cpp:67

↓ 1 callersFunctionNotContain

src/OrcLib/LocationSet.cpp:252

↓ 1 callersFunctionNowTimestamp

src/OrcLib/Archive/7z/ArchiveUpdateCallback.cpp:22

↓ 1 callersMethodNtOpenDirectoryObject

src/OrcLib/NtDllExtension.h:61

↓ 1 callersMethodNtOpenSymbolicLinkObject

src/OrcLib/NtDllExtension.h:103

↓ 1 callersMethodNtQueryDirectoryFile

src/OrcLib/NtDllExtension.h:79

↓ 1 callersMethodNtQueryDirectoryObject

src/OrcLib/NtDllExtension.h:97

↓ 1 callersMethodNtQueryInformationFile

src/OrcLib/NtDllExtension.h:67

↓ 1 callersMethodNtQueryInformationProcess

src/OrcLib/NtDllExtension.h:73

↓ 1 callersMethodNtQuerySystemInformation

src/OrcLib/NtDllExtension.h:85

↓ 1 callersFunctionNtSetInformationProcessApi

src/OrcLib/Utils/WinApi.cpp:572

↓ 1 callersFunctionNtfsFirstSecDescIndexEntry

src/OrcLib/NtfsDataStructures.h:393

↓ 1 callersMethodOpen

src/OrcApacheOrcLib/ApacheOrcStream.h:23

↓ 1 callersMethodOpen

src/OrcParquetLib/ParquetStream.cpp:25

↓ 1 callersMethodOpen

src/OrcLib/Utils/StdStream/LazyFileStream.h:30

↓ 1 callersMethodOpenAllHash

src/OrcLib/PEInfo.cpp:319

↓ 1 callersFunctionOpenCliConfig

Lookup for '/config' argument to either a file or resource location

src/OrcLib/CommandAgent.cpp:91

↓ 1 callersFunctionOpenEffectiveToken

src/OrcCapsule/Cmd/CmdMain/CmdRun.cpp:66

↓ 1 callersFunctionOpenEffectiveToken

src/OrcLib/Utils/WinApi.cpp:95

↓ 1 callersMethodOpenForReadOnly

src/OrcLib/ResourceStream.cpp:37

↓ 1 callersMethodOpenForStrings

src/OrcLib/StringsStream.cpp:283

↓ 1 callersMethodOpenPeHash

src/OrcLib/PEInfo.cpp:478

↓ 1 callersMethodOpenStream

src/OrcLib/NTFSAgent.cpp:15

↓ 1 callersMethodOpenTeeFile

src/OrcLib/Utils/StdStream/StandardOutput.cpp:78

↓ 1 callersMethodOpenToRead

src/OrcLib/CryptoHashStream.cpp:91

↓ 1 callersFunctionOpenVolume

src/OrcCommand/Command/NTFSUtil/NTFSUtil_Run.cpp:65

← previous next →1,201–1,300 of 5,324, ranked by callers