Functions — github.com/DFIR-ORC/dfir-orc

CodeHub MCPcopy Create free account

hub / github.com/DFIR-ORC/dfir-orc / functions

Functions5,324 in github.com/DFIR-ORC/dfir-orc

⨍ Functions 5,324◇ Types & classes 1,348

↓ 1 callersMethodOriginFriendlyName

src/OrcCommand/Command/WolfLauncher/WolfTask.h:71

↓ 1 callersMethodOriginResourceName

src/OrcCommand/Command/WolfLauncher/WolfTask.h:70

↓ 1 callersMethodOverlayCount

src/OrcLib/Filesystem/Ntfs/ShadowCopy/ShadowCopyInformation.h:30

↓ 1 callersMethodPEChecked

src/OrcLib/DataDetails.h:116

↓ 1 callersMethodParseAttributeList

src/OrcLib/AttributeList.cpp:326

↓ 1 callersFunctionParseCatalogHintFilename

src/OrcLib/Authenticode.cpp:85

↓ 1 callersFunctionParseCommandLine

src/OrcCapsule/OrcCapsuleCli.cpp:255

↓ 1 callersFunctionParseCommandLineArgument

src/OrcLib/CommandAgent.cpp:62

↓ 1 callersFunctionParseCompression

src/OrcCapsule/Cmd/CmdResource.cpp:1053

↓ 1 callersFunctionParseConsoleArgument

src/OrcCommand/Command/WolfLauncher/ConsoleConfiguration.cpp:74

↓ 1 callersFunctionParseConsoleOptions

src/OrcCommand/Command/WolfLauncher/ConsoleConfiguration.cpp:42

↓ 1 callersFunctionParseConsoleOptions

src/OrcCommand/Log/UtilitiesLoggerConfiguration.cpp:265

↓ 1 callersFunctionParseCopyOnWriteEntries

src/OrcLib/Filesystem/Ntfs/ShadowCopy/Snapshot.cpp:61

↓ 1 callersFunctionParseFileOptions

src/OrcCommand/Log/UtilitiesLoggerConfiguration.cpp:270

↓ 1 callersFunctionParseFixedFileInfo

src/OrcLib/FileFormat/PeVersionInfo.cpp:83

↓ 1 callersFunctionParseHexU32

src/OrcLib/Text/Guid.h:97

↓ 1 callersFunctionParseImageDosHeader

src/OrcLib/FileFormat/PeParser.cpp:88

↓ 1 callersFunctionParseImageFileHeader

src/OrcLib/FileFormat/PeParser.cpp:108

↓ 1 callersFunctionParseImageOptionalHeader

src/OrcLib/FileFormat/PeParser.cpp:140

↓ 1 callersFunctionParseImageSections

BEWARE: this function expects the stream to be at the right file position (just after optional headers)

src/OrcLib/FileFormat/PeParser.cpp:221

↓ 1 callersMethodParseLocations

src/OrcLib/Filesystem/Ntfs/Compression/WofChunks.cpp:86

↓ 1 callersFunctionParseLogArgument

src/OrcCommand/Log/UtilitiesLoggerConfiguration.cpp:351

↓ 1 callersFunctionParseNoLimitsArgument

src/OrcCommand/Command/WolfLauncher/WolfLauncher_Config.cpp:105

↓ 1 callersFunctionParseOverlayEntries

src/OrcLib/Filesystem/Ntfs/ShadowCopy/Snapshot.cpp:25

↓ 1 callersFunctionParsePathWithArchitecture

src/OrcCapsule/OrcCapsuleCli.cpp:125

↓ 1 callersFunctionParseSampleNameFormat

src/OrcCommand/Command/GetThis/GetThis_Config.cpp:519

↓ 1 callersFunctionParseSyslogOptions

src/OrcCommand/Log/UtilitiesLoggerConfiguration.cpp:314

↓ 1 callersMethodPeek

src/OrcLib/PipeStream.cpp:130

↓ 1 callersMethodPeekHeaders

src/OrcLib/CsvCruncher.cpp:297

↓ 1 callersMethodPeekNextToken

src/OrcLib/CsvCruncher.cpp:80

↓ 1 callersMethodPhysicalCores

src/OrcLib/CpuInfo.cpp:220

↓ 1 callersMethodPid

src/OrcCommand/Command/WolfLauncher/WolfTask.h:59

↓ 1 callersMethodPosition

src/OrcLib/Filesystem/Ntfs/ShadowCopy/CatalogEntry.h:83

↓ 1 callersFunctionPrepareRunner

src/OrcCapsule/Cmd/CmdMain/CmdAdd.cpp:178

↓ 1 callersMethodPrint

tools/rcedit/src/cmd/list/resources.cpp:187

↓ 1 callersFunctionPrintAddedRunnerSummary

src/OrcCapsule/Cmd/CmdMain/CmdAdd.cpp:278

↓ 1 callersFunctionPrintAttributeList

src/OrcLib/Text/Print/Ntfs/MFTRecord.cpp:448

↓ 1 callersMethodPrintConfig

src/OrcLib/Configuration/ConfigFile.cpp:359

↓ 1 callersMethodPrintConfiguration

src/OrcLib/YaraScanner.cpp:846

↓ 1 callersFunctionPrintDataAttribute

src/OrcLib/Text/Print/Ntfs/MFTRecord.cpp:606

↓ 1 callersFunctionPrintExtendedAttributes

src/OrcLib/Text/Print/Ntfs/MFTRecord.cpp:526

↓ 1 callersFunctionPrintFilenameAttribute

src/OrcLib/Text/Print/Ntfs/MFTRecord.cpp:142

↓ 1 callersMethodPrintFooter

src/OrcCommand/Command/DD/DD_Output.cpp:95

↓ 1 callersFunctionPrintFoundFile

src/OrcCommand/Command/FastFind/FastFind_Run.cpp:195

↓ 1 callersFunctionPrintFoundKey

src/OrcCommand/Command/FastFind/FastFind_Run.cpp:210

↓ 1 callersFunctionPrintFoundValue

src/OrcCommand/Command/FastFind/FastFind_Run.cpp:215

↓ 1 callersFunctionPrintFoundWindowsObject

src/OrcCommand/Command/FastFind/FastFind_Run.cpp:220

↓ 1 callersMethodPrintHeader

src/OrcCommand/UtilitiesMain.cpp:1135

↓ 1 callersFunctionPrintIndexAttributes

src/OrcLib/Text/Print/Ntfs/MFTRecord.cpp:489

↓ 1 callersFunctionPrintKey

src/OrcLib/Text/Print.h:43

↓ 1 callersMethodPrintLocationsByVolume

src/OrcLib/LocationSet.cpp:2522

↓ 1 callersFunctionPrintMissingResources

src/OrcLib/EmbeddedResource_Embed.cpp:856

↓ 1 callersMethodPrintName

src/OrcLib/MftRecordAttribute.h:319

↓ 1 callersMethodPrintParameters

src/OrcCommand/Command/DD/DD_Output.cpp:59

↓ 1 callersFunctionPrintReparsePointAttribute

src/OrcLib/Text/Print/Ntfs/MFTRecord.cpp:571

↓ 1 callersFunctionPrintRunnerSlotInfo

src/OrcCapsule/Cmd/CmdMain/CmdInfo.cpp:128

↓ 1 callersMethodPrintSpecs

src/OrcLib/RegFind.cpp:98

↓ 1 callersFunctionPrintStandardInformation

src/OrcLib/Text/Print/Ntfs/MFTRecord.cpp:427

↓ 1 callersFunctionPrintStatistics

src/OrcCommand/Command/FastFind/FastFind_Run.cpp:43

↓ 1 callersFunctionPrintStatistics

src/OrcCommand/Command/GetThis/GetThis_Run.cpp:84

↓ 1 callersFunctionPrintUsageHeader

src/OrcCapsule/OrcCapsuleCli.cpp:360

↓ 1 callersFunctionPrintValueFileAttributes

src/OrcLib/Text/Print/Ntfs/MFTRecord.cpp:136

↓ 1 callersFunctionPrintValues

src/OrcLib/Text/Print.h:86

↓ 1 callersFunctionPrintVersion

src/OrcCapsule/OrcCapsuleCli.cpp:355

↓ 1 callersFunctionProbeRunnerSlot

TODO: generic ?

src/OrcCapsule/Cmd/CmdMain/CmdInfo.cpp:24

↓ 1 callersFunctionProcessArchive

tests/OrcLibTest/mft_walker_test.cpp:52

↓ 1 callersMethodProcessIncomingData

src/OrcLib/ProcessRedirect.cpp:85

↓ 1 callersFunctionProcessorCount

src/OrcLib/ZipCreate.cpp:66

↓ 1 callersMethodProtectionFlags

src/OrcLib/Filesystem/Ntfs/ShadowCopy/SnapshotsIndexHeader.h:55

↓ 1 callersMethodPushBytes

src/OrcLib/CircularStorage.h:303

↓ 1 callersMethodPushExecutable

src/OrcLib/CommandMessage.cpp:104

↓ 1 callersMethodPushStdErr

src/OrcLib/CommandMessage.cpp:269

↓ 1 callersMethodPushStdOut

src/OrcLib/CommandMessage.cpp:256

↓ 1 callersMethodPushStdOutErr

src/OrcLib/CommandMessage.cpp:282

↓ 1 callersMethodQueryInterface

src/OrcLib/BITSDownloadTask.cpp:282

↓ 1 callersFunctionRead

src/OrcLib/Stream/StreamUtils.h:29

↓ 1 callersMethodRead

src/OrcParquetLib/ParquetStream.cpp:45

↓ 1 callersMethodRead

src/OrcLib/ShadowCopyVolumeReader.cpp:75

↓ 1 callersMethodRead

src/OrcLib/IStreamWrapper.cpp:61

↓ 1 callersMethodReadAt

src/OrcParquetLib/ParquetStream.cpp:86

↓ 1 callersMethodReadAt

This implementation tries to optimize IO and use direct buffer writes. It aligned and split the reads in 16k block with eventually 512 bytes chunks ea

src/OrcLib/Filesystem/Ntfs/ShadowCopy/ShadowCopy.cpp:534

↓ 1 callersFunctionReadChunkAt

src/OrcLib/ByteStreamHelpers.h:145

↓ 1 callersMethodReadData

src/OrcLib/MftRecordAttribute.cpp:776

↓ 1 callersFunctionReadExtendedAttribute

src/OrcLib/FileInfo.cpp:52

↓ 1 callersFunctionReadItem

src/OrcLib/ByteStreamHelpers.h:229

↓ 1 callersMethodReadSecurityDirectory

src/OrcLib/FileFormat/PeParser.cpp:784

↓ 1 callersFunctionReadSnapshotsInformation

src/OrcLib/Filesystem/Ntfs/ShadowCopy/SnapshotsIndex.cpp:32

↓ 1 callersFunctionRegisterConsoleItems

src/OrcCommand/Log/UtilitiesLoggerConfiguration.cpp:114

↓ 1 callersFunctionRegisterFileOptions

src/OrcCommand/Log/UtilitiesLoggerConfiguration.cpp:133

↓ 1 callersFunctionRegisterResourceLinks

Register resource link from attributes and elements like '7z:#TOOLS|Foo.exe' so later they can be marked as embedded

src/OrcLib/EmbeddedResource_Embed.cpp:605

↓ 1 callersFunctionRegisterSyslogOptions

src/OrcCommand/Log/UtilitiesLoggerConfiguration.cpp:158

↓ 1 callersFunctionRegisterYaraRules

src/OrcLib/EmbeddedResource_Embed.cpp:809

↓ 1 callersMethodRelease

src/OrcLib/BITSDownloadTask.cpp:304

↓ 1 callersMethodRelease

src/OrcLib/Semaphore.h:90

↓ 1 callersFunctionRelocateOrcFiles

src/OrcCapsule/Utilities/Process.cpp:103

↓ 1 callersFunctionRelocateOrcFromNetwork

src/OrcCapsule/Utilities/Process.cpp:226

↓ 1 callersFunctionRemoveFileIfExists

src/OrcLib/Utils/WinApi.cpp:479

↓ 1 callersFunctionRemoveResource

src/OrcCapsule/Utilities/Resource.cpp:215

↓ 1 callersMethodResumeChildProcess

src/OrcLib/CommandExecute.cpp:454

↓ 1 callersFunctionRetrieveComputerName

src/OrcCommand/Command/GetThis/GetThis_Run.cpp:430

← previous next →1,301–1,400 of 5,324, ranked by callers