Functions — github.com/DFIR-ORC/dfir-orc

CodeHub MCPcopy Create free account

hub / github.com/DFIR-ORC/dfir-orc / functions

Functions5,324 in github.com/DFIR-ORC/dfir-orc

⨍ Functions 5,324◇ Types & classes 1,348

↓ 3 callersFunctionCreateDefaultFullControlSD

src/OrcCapsule/Cmd/CmdMain/CmdRun.cpp:244

↓ 3 callersFunctionCreateSecurityDescriptor

src/OrcLib/Utils/WinApi.cpp:246

↓ 3 callersFunctionCreateWofStream

src/OrcLib/UncompressWofStream.cpp:27

↓ 3 callersMethodCreateXmlWriter

src/OrcLib/XmlLiteExtension.h:67

↓ 3 callersMethodDependsOnData

src/OrcLib/RegFind.h:163

↓ 3 callersMethodDependsOnName

src/OrcLib/FileFind.h:301

↓ 3 callersMethodDependsOnPath

src/OrcLib/FileFind.h:304

↓ 3 callersMethodDetach

tools/rcedit/src/utils/guard.h:252

↓ 3 callersFunctionDumpValue

src/OrcCommand/Command/RegInfo/RegInfo_Run.cpp:169

↓ 3 callersMethodDuplicate

src/OrcLib/FileStream.cpp:211

↓ 3 callersMethodExecute

tools/rcedit/src/cmd/set/cmd_set.cpp:309

↓ 3 callersMethodExitCode

src/OrcCommand/Command/WolfLauncher/WolfTask.h:60

↓ 3 callersMethodExtractArchive

src/OrcLib/UnitTestHelper.cpp:38

↓ 3 callersFunctionExtractResource

src/OrcCapsule/Utilities/Resource.cpp:97

↓ 3 callersMethodFileFixedVersionInfoAvailable

src/OrcLib/DataDetails.h:229

↓ 3 callersMethodFileName

src/OrcLib/MFTWalker.h:159

↓ 3 callersMethodFillSegmentDetailsMap

* we could be more smart here and merge contiguous segments */

src/OrcLib/FatFileEntry.cpp:59

↓ 3 callersMethodFirstDiffLocationTableOffset

src/OrcLib/Filesystem/Ntfs/ShadowCopy/CatalogEntry.h:123

↓ 3 callersMethodFirstIndexEntry

src/OrcLib/MftRecordAttribute.h:243

↓ 3 callersMethodFlush

src/OrcLib/CsvFileWriter.cpp:302

↓ 3 callersMethodFormCode

src/OrcLib/AttributeList.h:68

↓ 3 callersMethodGetBytesPerSector

src/OrcLib/VolumeReader.h:54

↓ 3 callersFunctionGetChildResourceDirectory

src/OrcLib/FileFormat/PeParser.cpp:311

↓ 3 callersMethodGetContentSpecFromString

src/OrcCommand/Command/GetThis/GetThis_Config.cpp:77

↓ 3 callersMethodGetEntry

src/OrcLib/FatTable.h:76

↓ 3 callersFunctionGetFilePath

tests/OrcParquetTest/parquet_output.cpp:308

↓ 3 callersFunctionGetFileSize

src/OrcLib/Utils/MapFile.cpp:19

↓ 3 callersMethodGetFullName

src/OrcLib/FatFileEntry.cpp:40

↓ 3 callersMethodGetFullNameBuilder

src/OrcLib/MFTWalker.h:111

↓ 3 callersFunctionGetFullPath

src/OrcCommand/Command/RegInfo/RegInfo_Run.cpp:192

↓ 3 callersMethodGetImageFileHeader

src/OrcLib/PEInfo.cpp:94

↓ 3 callersMethodGetIndexAttributes

src/OrcLib/MFTRecord.cpp:685

↓ 3 callersMethodGetKeyResidencyState

src/OrcLib/RegistryWalker.cpp:168

↓ 3 callersMethodGetLength

tests/OrcLibTest/DiskExtentTest.h:34

↓ 3 callersMethodGetLogicalSectorSize

tests/OrcLibTest/DiskExtentTest.h:35

↓ 3 callersMethodGetMFTRecordCount

src/OrcLib/MFTWalker.cpp:1893

↓ 3 callersFunctionGetOutputDir_Internal

src/OrcLib/ParameterCheck.cpp:30

↓ 3 callersMethodGetRemoteFullPath

src/OrcLib/BITSAgent.cpp:727

↓ 3 callersFunctionGetRunnerFilename

src/OrcCapsule/Cmd/CmdMain/Runner.cpp:82

↓ 3 callersMethodGetSecurityDescriptor

src/OrcLib/Utils/WinApi.cpp:186

↓ 3 callersMethodGetSecurityDirectoryChunk

src/OrcLib/FileFormat/PeParser.cpp:796

↓ 3 callersMethodGetSeekOffset

src/OrcLib/DiskExtent.h:62

↓ 3 callersFunctionGetSignersName

src/OrcLib/Authenticode.cpp:252

↓ 3 callersFunctionGetSignersThumbprint

src/OrcLib/Authenticode.cpp:284

↓ 3 callersMethodGetSize

src/OrcLib/SubStream.cpp:156

↓ 3 callersMethodGetSize

src/OrcLib/Archive/7z/InStreamAdapter.cpp:65

↓ 3 callersMethodGetStartOffset

tests/OrcLibTest/DiskExtentTest.h:32

↓ 3 callersMethodGetSubKeysCount

src/OrcLib/RegistryWalker.cpp:148

↓ 3 callersFunctionGetUSNJournalConfiguration

src/OrcCommand/Command/NTFSUtil/NTFSUtil_Run.cpp:85

↓ 3 callersMethodGetUniqueModules

src/OrcLib/RunningCode.cpp:311

↓ 3 callersFunctionGetWorkingDirectoryApi

src/OrcLib/Utils/WinApi.cpp:818

↓ 3 callersMethodGetWriters

src/OrcCommand/Command/NTFSInfo/NTFSInfo_Run.cpp:595

↓ 3 callersMethodHostRecordSegmentNumber

src/OrcLib/AttributeList.cpp:317

↓ 3 callersMethodIndexedAttributeType

src/OrcLib/MftRecordAttribute.h:223

↓ 3 callersMethodInit

tools/rcedit/src/cmd/set/7z/archive_update_callback.cpp:51

↓ 3 callersMethodInitializeStore

src/OrcLib/HeapStorage.h:41

↓ 3 callersMethodInitializeYara

src/OrcLib/FileFind.cpp:1561

↓ 3 callersMethodIsBaseRecord

src/OrcLib/MFTRecord.h:55

↓ 3 callersMethodIsBreakAwayAllowed

src/OrcLib/JobObject.cpp:394

↓ 3 callersMethodIsFile

src/OrcLib/OutputSpec.cpp:111

↓ 3 callersFunctionIsIndexEntryHeaderInBounds

The fixed INDEX_ENTRY header must lie fully within [bufBegin, bufEnd) before any field (Flags/Length) of a forged index entry is dereferenced.

src/OrcLib/MFTWalker.cpp:689

↓ 3 callersMethodIsLoaded

src/OrcLib/ExtensionLibrary.h:128

↓ 3 callersMethodIsOverlayFile

src/OrcLib/MFTRecord.h:51

↓ 3 callersMethodIsResident

src/OrcLib/MftRecordAttribute.h:99

↓ 3 callersMethodIsSelfOrcExecutable

src/OrcCommand/Command/WolfLauncher/Outcome.h:134

↓ 3 callersMethodIsSelfOrcExecutable

src/OrcLib/CommandMessage.h:197

↓ 3 callersMethodIsStructuredFile

src/OrcLib/OutputSpec.cpp:133

↓ 3 callersMethodLoad

src/OrcLib/ExtensionLibrary.cpp:357

↓ 3 callersMethodLoadDiskProperties

tests/OrcLibTest/VolumeReaderTest.h:33

↓ 3 callersFunctionLoadResourceData

src/OrcCapsule/Utilities/Resource.cpp:34

↓ 3 callersMethodMoveTo

src/OrcLib/TemporaryStream.cpp:295

↓ 3 callersMethodNextHeaderOffset

src/OrcLib/Filesystem/Ntfs/ShadowCopy/CatalogHeader.h:34

↓ 3 callersFunctionNextIndexEntryChecked

Advance to the next index entry, rejecting a forged Length that is zero (would loop forever) or that would carry the walk past the end of the buffer.

src/OrcLib/MFTWalker.cpp:700

↓ 3 callersMethodNtQueryObject

src/OrcLib/NtDllExtension.h:91

↓ 3 callersFunctionNtfsUnsafeSegmentNumber

src/OrcLib/NtfsDataStructures.h:100

↓ 3 callersMethodOpen

src/OrcLib/MftRecordAttribute.cpp:701

↓ 3 callersFunctionParseCommonOptions

src/OrcCommand/Log/UtilitiesLoggerConfiguration.cpp:224

↓ 3 callersMethodParseObjectDirectory

src/OrcLib/ObjectDirectory.cpp:166

↓ 3 callersFunctionParseSubArguments

src/OrcLib/Configuration/Option.cpp:56

↓ 3 callersFunctionParseVersionInfo

src/OrcLib/FileFormat/PeVersionInfo.cpp:394

↓ 3 callersMethodParsed

tools/rcedit/src/cmd/set/cmd_set.cpp:355

↓ 3 callersFunctionPerformSelfUpdate

src/OrcCapsule/Utilities/Process.cpp:288

↓ 3 callersMethodPrepare

src/OrcCommand/Command/NTFSInfo/NTFSInfo_Run.cpp:543

↓ 3 callersMethodPreviousBitmapOffset

src/OrcLib/Filesystem/Ntfs/ShadowCopy/CatalogEntry.h:127

↓ 3 callersFunctionProcessArchive

tests/OrcLibTest/usn_journal_test.cpp:197

↓ 3 callersFunctionProcessArchive

tests/OrcLibTest/fat_walker_test.cpp:77

↓ 3 callersMethodPushArgument

src/OrcLib/CommandMessage.cpp:116

↓ 3 callersMethodRead

src/OrcLib/CompleteVolumeReader.cpp:92

↓ 3 callersMethodReadConfiguration

src/OrcCommand/UtilitiesMain_Config.cpp:22

↓ 3 callersFunctionReadFileAt

src/OrcCapsule/Utilities/File.cpp:124

↓ 3 callersFunctionReadItem

src/OrcLib/Stream/StreamUtils.h:161

↓ 3 callersFunctionRegFlushKeys

src/OrcCommand/Command/GetThis/GetThis_Run.cpp:769

↓ 3 callersMethodRegister

tools/rcedit/src/cmd/set/cmd_set.cpp:267

↓ 3 callersMethodRepeatBehaviour

src/OrcCommand/Command/WolfLauncher/WolfExecution.h:265

↓ 3 callersMethodResetCursor

src/OrcLib/CircularStorage.h:216

↓ 3 callersFunctionSanitizeArchiveMemberName

src/OrcLib/ArchiveExtract.cpp:42

↓ 3 callersMethodSetCommandLineValue

src/OrcCommand/Command/WolfLauncher/Outcome.h:120

↓ 3 callersMethodSetConfiguration

src/OrcLib/UploadAgent.h:70

↓ 3 callersMethodSetFormatter

src/OrcLib/Log/SpdlogLogger.cpp:71

↓ 3 callersMethodSetIsValid

src/OrcLib/Location.h:80

← previous next →501–600 of 5,324, ranked by callers