Functions — github.com/DFIR-ORC/dfir-orc

CodeHub MCPcopy Create free account

hub / github.com/DFIR-ORC/dfir-orc / functions

Functions5,324 in github.com/DFIR-ORC/dfir-orc

⨍ Functions 5,324◇ Types & classes 1,348

↓ 1 callersMethodAllocatedSize

src/OrcLib/Filesystem/Ntfs/ShadowCopy/CatalogEntry.h:126

↓ 1 callersMethodAllowBreakAway

src/OrcLib/JobObject.cpp:424

↓ 1 callersFunctionAppendCsvEscaped

Appends 'value' to 'buf', doubling every '"' found inside it. The surrounding delimiter/quote characters are NOT part of 'value' here, so there is not

src/OrcLib/CsvFileWriter.cpp:77

↓ 1 callersFunctionApplyConsoleConfiguration

src/OrcCommand/Log/UtilitiesLoggerConfiguration.cpp:450

↓ 1 callersFunctionApplyFileConfiguration

src/OrcCommand/Log/UtilitiesLoggerConfiguration.cpp:502

↓ 1 callersMethodApplyNotification

src/OrcCommand/Command/WolfLauncher/WolfTask.cpp:34

↓ 1 callersFunctionApplyOptionNoLimits

src/OrcCommand/Command/WolfLauncher/WolfLauncher_Config.cpp:139

↓ 1 callersFunctionApplyPreparedRunners

src/OrcCapsule/Cmd/CmdMain/CmdAdd.cpp:244

↓ 1 callersFunctionApplySyslogConfiguration

src/OrcCommand/Log/UtilitiesLoggerConfiguration.cpp:559

↓ 1 callersMethodArchiveTimeOut

src/OrcCommand/Command/WolfLauncher/WolfExecution.h:85

↓ 1 callersMethodAssociateCompletionPort

src/OrcLib/JobObject.cpp:381

↓ 1 callersFunctionAttributeTypeToString

src/OrcLib/Text/Print/Ntfs/MFTRecord.cpp:91

↓ 1 callersFunctionBCryptGenRandom_xp

BEWARE: I don't need entropy for processing Yara rules but as minimal xp support I use this basic entropy source. In case better source is needed, on

external/vcpkg_overlay_ports/xp/libressl/bcrypt_gen_random.c:40

↓ 1 callersMethodBlockBreakAway

src/OrcLib/JobObject.cpp:509

↓ 1 callersMethodBlockCount

src/OrcLib/Filesystem/Ntfs/ShadowCopy/ShadowCopy.cpp:107

↓ 1 callersMethodBlocksPerIndex

src/OrcLib/MftRecordAttribute.h:236

↓ 1 callersMethodBuild

src/OrcLib/Log/Syslog/SyslogMessage.cpp:41

↓ 1 callersFunctionBuildBlockViewTree

src/OrcLib/FileFormat/PeVersionInfo.cpp:298

↓ 1 callersMethodBuildFullArchiveName

src/OrcCommand/Command/WolfLauncher/WolfExecution_Execute.cpp:166

↓ 1 callersMethodBuildStreamList

src/OrcLib/HiveQuery.cpp:19

↓ 1 callersFunctionBuildStringColumnDelimiters

Fills the Prefix / Suffix fields of a string column. Prefix = leadingDelimiter + openingStringDelimiter (e.g. L",\"") Suffix = closingStringDelimit

src/OrcLib/CsvFileWriter.cpp:62

↓ 1 callersMethodCancelIoEx

src/OrcLib/Kernel32Extension.h:47

↓ 1 callersMethodCancelTerminationHandler

src/OrcLib/ArchiveAgent.cpp:88

↓ 1 callersMethodCancelTerminationHandler

src/OrcLib/CommandExecute.cpp:160

↓ 1 callersMethodCanonicalizeLocation

src/OrcLib/LocationSet.cpp:620

↓ 1 callersMethodCheck

src/OrcLib/Utils/Threshold.h:48

↓ 1 callersFunctionCheckCatalogSignature

Verify a security catalog held entirely in memory: confirm its PKCS#7 signature is intact AND that the signing certificate chains to a trusted root un

src/OrcLib/Authenticode.cpp:126

↓ 1 callersMethodCheckConfiguration

src/OrcCommand/Command/DD/DD_Config.cpp:90

↓ 1 callersMethodCheckFileUpload

src/OrcLib/BITSAgent.cpp:763

↓ 1 callersFunctionCheckGetThisConfiguration

src/OrcCommand/Command/GetSamples/GetSamples_Config.cpp:27

↓ 1 callersMethodCheckHash

src/OrcLib/FileInfo.cpp:658

↓ 1 callersFunctionCheckPathIsRelative

src/OrcCommand/Command/WolfLauncher/WolfExecution_Execute.cpp:96

↓ 1 callersFunctionCheckPhysicalMemoryRequirement

src/OrcCommand/Command/WolfLauncher/WolfLauncher_Run.cpp:413

↓ 1 callersFunctionCheckREFSVbr

tests/OrcLibTest/partition_table_test.cpp:1226

↓ 1 callersMethodCheckSamplesSignature

src/OrcLib/TaskTracker.cpp:926

↓ 1 callersFunctionCheckYaraRules

src/OrcLib/EmbeddedResource_Embed.cpp:987

↓ 1 callersMethodChildConnected

src/OrcLib/ProcessRedirect.cpp:350

↓ 1 callersMethodClearMatches

src/OrcLib/RegFind.h:506

↓ 1 callersMethodClose

src/OrcParquetLib/ParquetWriter.cpp:477

↓ 1 callersMethodClose

src/OrcParquetLib/ParquetStream.cpp:180

↓ 1 callersMethodClose

src/OrcLib/EncodeMessageStream.cpp:234

↓ 1 callersMethodClose

src/OrcLib/CsvFileWriter.cpp:376

↓ 1 callersMethodClose

src/OrcLib/SubStream.cpp:50

↓ 1 callersMethodCloseCompressor

src/OrcLib/CompressAPIExtension.h:84

↓ 1 callersMethodCmdTimeOut

src/OrcCommand/Command/WolfLauncher/WolfExecution.h:84

↓ 1 callersMethodCoalesceResults

src/OrcLib/TaskTracker.cpp:519

↓ 1 callersMethodColumn

src/OrcLib/TableOutput.h:90

↓ 1 callersFunctionComparisonOperatorFromString

src/OrcLib/Text/ComparisonOperator.cpp:46

↓ 1 callersFunctionCompileYaraRuleFromArchiveResource

src/OrcLib/EmbeddedResource_Embed.cpp:965

↓ 1 callersFunctionCompileYaraRuleFromPlainResource

src/OrcLib/EmbeddedResource_Embed.cpp:946

↓ 1 callersFunctionCompress7z

tools/rcedit/src/cmd/set/7z/compress_7z.cpp:87

↓ 1 callersFunctionCompressStatistics

src/OrcCommand/Command/GetThis/GetThis_Run.cpp:254

↓ 1 callersFunctionCompressTable

src/OrcCommand/Command/GetThis/GetThis_Run.cpp:365

↓ 1 callersMethodCompressionFormat

src/OrcLib/Filesystem/Ntfs/Attribute/ReparsePoint/WofReparsePoint.cpp:82

↓ 1 callersFunctionConfigurePeCompressionParams

src/OrcCapsule/Utilities/Compression.cpp:51

↓ 1 callersFunctionConfigureStringStream

src/OrcCommand/Command/GetThis/GetThis_Run.cpp:650

↓ 1 callersFunctionConfigureUSNJournal

src/OrcCommand/Command/NTFSUtil/NTFSUtil_Run.cpp:118

↓ 1 callersMethodConsole

src/OrcCommand/Command/WolfLauncher/Journal.h:75

↓ 1 callersFunctionConsoleConfigurationToArgument

src/OrcCommand/Log/UtilitiesLoggerConfiguration.cpp:662

↓ 1 callersFunctionConvertResValueOption

tools/rcedit/src/cmd/set/cmd_set.cpp:187

↓ 1 callersFunctionCopyChunk

src/OrcLib/FileFormat/PeParser.cpp:42

↓ 1 callersFunctionCopyChunks

src/OrcLib/FileFormat/PeParser.cpp:70

↓ 1 callersMethodCopyHandle

src/OrcLib/FileStream.cpp:170

↓ 1 callersMethodCopyOnWriteCount

src/OrcLib/Filesystem/Ntfs/ShadowCopy/ShadowCopyInformation.h:33

↓ 1 callersFunctionCopyStream

src/OrcCommand/Command/GetThis/GetThis_Run.cpp:444

↓ 1 callersFunctionCopyUntil

src/OrcLib/SystemDetails.cpp:44

↓ 1 callersFunctionCountSetBits

src/OrcLib/CpuInfo.cpp:178

↓ 1 callersMethodCreateArchiveAgent

src/OrcCommand/Command/WolfLauncher/WolfExecution_Execute.cpp:349

↓ 1 callersMethodCreateChildProcess

src/OrcLib/CommandExecute.cpp:299

↓ 1 callersMethodCreateCommandAgent

src/OrcCommand/Command/WolfLauncher/WolfExecution_Execute.cpp:511

↓ 1 callersFunctionCreateCompressor

src/OrcCommand/Command/GetThis/GetThis_Run.cpp:307

↓ 1 callersMethodCreateCompressor

src/OrcLib/CompressAPIExtension.h:59

↓ 1 callersFunctionCreateConsoleSink

src/OrcCommand/Log/UtilitiesLogger.cpp:30

↓ 1 callersFunctionCreateDefaultSampleName

src/OrcCommand/Command/GetThis/GetThis_Run.cpp:678

↓ 1 callersFunctionCreateDirectoryWithACL

src/OrcCapsule/Cmd/CmdMain/CmdRun.cpp:371

↓ 1 callersFunctionCreateFacilities

src/OrcCommand/Log/UtilitiesLogger.cpp:53

↓ 1 callersFunctionCreateFileSafeApi

src/OrcLib/Utils/WinApi.cpp:613

↓ 1 callersFunctionCreateFileSink

src/OrcCommand/Log/UtilitiesLogger.cpp:37

↓ 1 callersMethodCreateInstance

src/OrcLib/COMExtension.h:40

↓ 1 callersMethodCreateOutputTree

src/OrcCommand/Console.h:63

↓ 1 callersFunctionCreateRestrictedDirectory

src/OrcCapsule/Cmd/CmdMain/CmdRun.cpp:584

↓ 1 callersFunctionCreateSampleFileName

src/OrcCommand/Command/GetThis/GetThis_Run.cpp:530

↓ 1 callersFunctionCreateSyslogSink

src/OrcCommand/Log/UtilitiesLogger.cpp:46

↓ 1 callersFunctionCreateTeeSink

src/OrcCommand/Log/UtilitiesLogger.cpp:88

↓ 1 callersFunctionCreateUniqueSampleName

src/OrcCommand/Command/GetThis/GetThis_Run.cpp:732

↓ 1 callersMethodCreateVssBackupComponents

src/OrcLib/VssAPIExtension.h:36

↓ 1 callersFunctionCreateWorkingTemp

src/OrcCapsule/Cmd/CmdMain/CmdRun.cpp:520

↓ 1 callersMethodCreateXmlWriterOutputWithEncodingName

src/OrcLib/XmlLiteExtension.h:73

↓ 1 callersMethodCryptCATAdminCalcHashFromFileHandle

src/OrcLib/WinTrustExtension.cpp:65

↓ 1 callersMethodCryptCATAdminEnumCatalogFromHash

src/OrcLib/WinTrustExtension.h:121

↓ 1 callersMethodCryptCATAdminReleaseCatalogContext

src/OrcLib/WinTrustExtension.h:131

↓ 1 callersMethodCryptCATAdminReleaseContext

src/OrcLib/WinTrustExtension.h:139

↓ 1 callersMethodDataIsAvailable

src/OrcLib/PipeStream.cpp:116

↓ 1 callersMethodDataIsPlausible

src/OrcLib/AttributeList.cpp:251

↓ 1 callersMethodDebugLoop

src/OrcLib/DebugAgent.cpp:154

↓ 1 callersMethodDecompress

Decompress a chunk and shift the output to 'uncompressedOffset'. Uses an internal buffer if needed.

src/OrcLib/Filesystem/Ntfs/Compression/WofStreamConcept.h:225

↓ 1 callersMethodDeleteAttributesForThisRecord

src/OrcLib/AttributeList.cpp:465

↓ 1 callersMethodDeleteMe

src/OrcLib/EmbeddedResource.h:290

↓ 1 callersMethodDeleteTemporaryResources

src/OrcLib/CommandAgentResources.cpp:98

↓ 1 callersMethodDependsOnValueName

src/OrcLib/RegFind.h:153

← previous next →901–1,000 of 5,324, ranked by callers