Functions — github.com/DFIR-ORC/dfir-orc

CodeHub MCPcopy Create free account

hub / github.com/DFIR-ORC/dfir-orc / functions

Functions5,324 in github.com/DFIR-ORC/dfir-orc

⨍ Functions 5,324◇ Types & classes 1,348

↓ 2 callersFunctionGetEffectiveUserSidString

src/OrcLib/Utils/WinApi.cpp:311

↓ 2 callersFunctionGetEffectiveUserTokenInformation

src/OrcCapsule/Cmd/CmdMain/CmdRun.cpp:146

↓ 2 callersFunctionGetEffectiveUserTokenInformation

src/OrcLib/Utils/WinApi.cpp:265

↓ 2 callersMethodGetExecutableSha1

src/OrcLib/CommandNotification.h:125

↓ 2 callersMethodGetFileBaseRecord

src/OrcLib/MFTRecord.h:73

↓ 2 callersFunctionGetFilePath

tests/OrcParquetTest/parquet_writer.cpp:146

↓ 2 callersMethodGetHashInformation

src/OrcLib/MftRecordAttribute.cpp:628

↓ 2 callersMethodGetKeyHeader

src/OrcLib/RegistryWalker.cpp:209

↓ 2 callersMethodGetKeyLastModificationTime

src/OrcLib/RegistryWalker.cpp:84

↓ 2 callersMethodGetKeyType

src/OrcLib/RegistryWalker.cpp:94

↓ 2 callersFunctionGetLocalOutputFileInformations

src/OrcCommand/Command/WolfLauncher/WolfLauncher_Run.cpp:63

↓ 2 callersFunctionGetLogicalProcessorInformationApi

src/OrcLib/CpuInfo.cpp:70

↓ 2 callersMethodGetMain_PFILE_NAME

src/OrcLib/MFTRecord.cpp:270

↓ 2 callersFunctionGetMatchFullName

src/OrcCommand/Command/GetThis/GetThis_Run.cpp:489

↓ 2 callersMethodGetMaximumSize

src/OrcLib/CircularStorage.h:300

↓ 2 callersFunctionGetMountPointList

src/OrcLib/Location.cpp:965

↓ 2 callersMethodGetNonResidentSegmentsToRead

src/OrcLib/MftRecordAttribute.cpp:315

↓ 2 callersMethodGetObjectType

src/OrcLib/ObjectDirectory.cpp:95

↓ 2 callersMethodGetOffset

src/OrcLib/InterfaceReader.h:52

↓ 2 callersFunctionGetOptimalStream

src/OrcLib/FileFind.cpp:129

↓ 2 callersMethodGetOriginFriendlyName

src/OrcLib/CommandNotification.h:119

↓ 2 callersMethodGetOriginResourceName

src/OrcLib/CommandNotification.h:122

↓ 2 callersMethodGetPath

src/OrcLib/InterfaceReader.h:54

↓ 2 callersFunctionGetProcessExecutableHash

src/OrcCommand/Command/WolfLauncher/WolfLauncher_Run.cpp:197

↓ 2 callersMethodGetProcessParentID

src/OrcLib/RunningProcesses.cpp:101

↓ 2 callersMethodGetReadBitmap

src/OrcLib/Filesystem/Ntfs/ShadowCopy/ShadowCopy.cpp:111

↓ 2 callersFunctionGetRegInfoWriter

src/OrcCommand/Command/RegInfo/RegInfo.h:119

↓ 2 callersFunctionGetRemoteOutputFileInformations

src/OrcCommand/Command/WolfLauncher/WolfLauncher_Run.cpp:147

↓ 2 callersMethodGetResource

TODO: not thoroughly tested but useful for Forge and ExtractResource

src/OrcLib/FileFormat/PeParser.cpp:1080

↓ 2 callersFunctionGetResourceDataEntry

src/OrcLib/FileFormat/PeParser.cpp:359

↓ 2 callersFunctionGetResourceEntryNameOrId

src/OrcLib/FileFormat/PeParser.cpp:448

↓ 2 callersFunctionGetSecurityDescriptor

src/OrcLib/Utils/WinApi.cpp:607

↓ 2 callersMethodGetSeenSubKeysCount

src/OrcLib/RegistryWalker.cpp:143

↓ 2 callersFunctionGetTopDirectoryAndFilename

src/OrcCommand/Command/ToolEmbed/ToolEmbed_Config.cpp:78

↓ 2 callersMethodGetValuesCount

src/OrcLib/RegistryWalker.cpp:153

↓ 2 callersMethodGetVersion

src/OrcLib/DbgHelpLibrary.cpp:66

↓ 2 callersFunctionGetVolumeSerial32

src/OrcLib/Location.cpp:243

↓ 2 callersFunctionGetWofChunkOffsetSize

src/OrcLib/Filesystem/Ntfs/Compression/WofChunks.cpp:172

↓ 2 callersFunctionGetWofChunkSize

src/OrcLib/Filesystem/Ntfs/Compression/WofChunks.cpp:144

↓ 2 callersFunctionGetWorkspace

src/OrcLib/Filesystem/Ntfs/Compression/Engine/Nt/NtDecompressorConcept.cpp:38

↓ 2 callersMethodHasCallbackBeenCalled

src/OrcLib/MFTRecord.h:66

↓ 2 callersMethodHasCompleted

src/OrcLib/CommandExecute.cpp:535

↓ 2 callersFunctionHasFileOutput

src/OrcCommand/Command/WolfLauncher/WolfExecution_Execute.cpp:77

↓ 2 callersFunctionHasInvalidFlag

src/OrcLib/Filesystem/Ntfs/ShadowCopy/VolumeSnapshotAttributes.cpp:62

↓ 2 callersFunctionHasInvalidFlag

src/OrcLib/Filesystem/Ntfs/ShadowCopy/DiffAreaTableEntryFlags.cpp:42

↓ 2 callersMethodHasReparsePoint

src/OrcLib/MFTRecord.h:48

↓ 2 callersFunctionHasSnapshotsIndex

src/OrcLib/Filesystem/Ntfs/ShadowCopy/ShadowCopy.cpp:272

↓ 2 callersFunctionHasValue

src/OrcCommand/Command/WolfLauncher/ConsoleConfiguration.cpp:99

↓ 2 callersMethodHashChecked

src/OrcLib/DataDetails.h:159

↓ 2 callersMethodIndexEntriesEnd

src/OrcLib/MftRecordAttribute.h:245

↓ 2 callersMethodInitializeStorage

src/OrcLib/CircularStorage.h:260

↓ 2 callersMethodInstance

src/OrcLib/AttributeList.h:82

↓ 2 callersFunctionIs7zArchive

src/OrcCapsule/Utilities/Compression.cpp:82

↓ 2 callersMethodIsChildDebugActive

src/OrcCommand/Command/WolfLauncher/WolfExecution.h:253

↓ 2 callersFunctionIsEqual

src/OrcLib/FileFind.cpp:155

↓ 2 callersMethodIsExtented

src/OrcLib/Partition.cpp:69

↓ 2 callersMethodIsFileUploaded

src/OrcLib/OutputSpec.cpp:616

↓ 2 callersFunctionIsFiltered

src/OrcLib/FileFormat/PeParser.cpp:467

↓ 2 callersMethodIsGPT

src/OrcLib/Partition.cpp:74

↓ 2 callersMethodIsLastNode

src/OrcLib/Filesystem/Ntfs/ShadowCopy/Node.h:48

↓ 2 callersFunctionIsNumber

tools/rcedit/src/cmd/validators.cpp:16

↓ 2 callersMethodIsOpen

src/OrcCommand/Log/UtilitiesLogger.h:81

↓ 2 callersMethodIsREFS

src/OrcLib/Partition.cpp:59

↓ 2 callersFunctionIsRecordInUseOrResident

Check if an unused record can be considered as "resident" which means that most of its data is stored in only one record. An unused "resident" record

src/OrcLib/MFTWalker.cpp:35

↓ 2 callersFunctionIsReparsePoint

src/OrcLib/Temporary.cpp:546

↓ 2 callersMethodIsUnlimited

src/OrcLib/Limit.h:28

↓ 2 callersMethodIsValidTerm

src/OrcLib/FileFind.cpp:1326

↓ 2 callersFunctionIsXmlFile

src/OrcLib/EmbeddedResource_Embed.cpp:499

↓ 2 callersMethodLoadAutoRunsXml

src/OrcLib/AutoRuns.cpp:84

↓ 2 callersFunctionLocalConfiguration

src/OrcCommand/Command/DD/DD.h:70

↓ 2 callersFunctionLocalConfigurationExtension

src/OrcCommand/Command/DD/DD.h:71

↓ 2 callersFunctionMakeScopeGuard

src/OrcCapsule/Utilities/Scope.h:77

↓ 2 callersFunctionMapFile

src/OrcLib/Authenticode.cpp:45

↓ 2 callersMethodMarkAsEmbedded

src/OrcLib/EmbeddedResource_Embed.cpp:208

↓ 2 callersMethodMftRecord

src/OrcLib/MFTRecordFileInfo.h:92

↓ 2 callersFunctionMyPropVariantClear

src/OrcLib/PropVariant.cpp:123

↓ 2 callersMethodNameEquals

src/OrcLib/MftRecordAttribute.h:88

↓ 2 callersMethodNtQuerySymbolicLinkObject

src/OrcLib/NtDllExtension.h:109

↓ 2 callersFunctionNtfsNextIndexEntry

src/OrcLib/NtfsDataStructures.h:413

↓ 2 callersFunctionNtfsSetSegmentNumber

src/OrcLib/NtfsDataStructures.h:120

↓ 2 callersMethodOrcTool

src/OrcCommand/Command/WolfLauncher/WolfTask.h:73

↓ 2 callersFunctionOutputConfigurationToOptions

src/OrcCommand/Log/UtilitiesLoggerConfiguration.cpp:613

↓ 2 callersMethodParse

src/OrcLib/Filesystem/Ntfs/ShadowCopy/Node.cpp:21

↓ 2 callersFunctionParseCommandLineArgumentValue

src/OrcLib/CommandAgent.cpp:72

↓ 2 callersFunctionParseEntryName

src/OrcLib/FileFormat/PeParser.cpp:278

↓ 2 callersFunctionParseExecutionMode

src/OrcCapsule/OrcCapsuleCli.cpp:223

↓ 2 callersMethodParseFileDirectory

src/OrcLib/FileDirectory.cpp:80

↓ 2 callersFunctionParseHexU16

src/OrcLib/Text/Guid.h:103

↓ 2 callersFunctionParseResourceName

src/OrcCapsule/Cmd/CmdResource.cpp:590

↓ 2 callersFunctionParseVolumeSerial32

src/OrcLib/Location.cpp:141

↓ 2 callersMethodPeHashAvailable

src/OrcLib/DataDetails.h:194

↓ 2 callersFunctionPrint

src/OrcLib/Text/Print.h:31

↓ 2 callersFunctionPrintColumnSelectionParameter

src/OrcCommand/Usage.cpp:17

↓ 2 callersFunctionPrintLimitsParameters

src/OrcCommand/Usage.h:181

↓ 2 callersFunctionPrintUsage

src/Orc/Orc.cpp:129

↓ 2 callersMethodProcess

src/OrcLib/FatWalker.cpp:224

↓ 2 callersMethodPushOutputFile

src/OrcLib/CommandMessage.cpp:153

↓ 2 callersFunctionQueryEffectiveTokenBuffer

src/OrcCapsule/Cmd/CmdMain/CmdRun.cpp:100

↓ 2 callersFunctionQueryEffectiveTokenBuffer

src/OrcLib/Utils/WinApi.cpp:125

↓ 2 callersMethodReOpen

src/OrcLib/DiskExtent.cpp:235

← previous next →701–800 of 5,324, ranked by callers