MCPcopy Create free account

hub / github.com/Xacone/BestEdrOfTheMarket / functions

Functions149 in github.com/Xacone/BestEdrOfTheMarket

↓ 10 callersFunctionprintRedAlert
BestEdrOfTheMarket/ColorsUtils.h:36
↓ 7 callersFunctionAttachHook
DLLs/NT/ntdII/dllmain.cpp:363
↓ 7 callersFunctionDetachHook
DLLs/NT/ntdII/dllmain.cpp:374
↓ 7 callersFunctionGetProcessPathByPID
BestEdrOfTheMarket/ReportingUtils.h:15
↓ 7 callersFunctionbytesToHexString
* Convert a byte array to a hex string. * @param bytes The byte array to convert. * @param size The size of the byte array. * @return The hex strin
BestEdrOfTheMarket/ConversionUtils.h:60
↓ 7 callersFunctioninterceptMsg
DLLs/NT/ntdII/dllmain.cpp:8
↓ 6 callersMethodRetrieveExportsForGivenModuleAndFillMap
BestEdrOfTheMarket/Pe64Utils.h:376
↓ 5 callersMethodInjectDll
* Injects a DLL into a target process * @param dllName Name of the DLL to inject * @return TRUE if the DLL was successfully injected, FALSE ot
BestEdrOfTheMarket/ModuleLoadingUtils.h:41
↓ 4 callersFunctioncontainsSequence
BestEdrOfTheMarket/BytesSequencesUtils.h:21
↓ 4 callersFunctionhexStringToByteArray
BestEdrOfTheMarket/ConversionUtils.h:232
↓ 3 callersMethodgetFunctionsNamesMapping
BestEdrOfTheMarket/Pe64Utils.h:154
↓ 3 callersFunctiongetHandledProcessPeb
* Get the PEB of a process * @param hProcess The handle of the process * @return The PEB of the process */
BestEdrOfTheMarket/ProcessStructUtils.h:24
↓ 3 callersMethodinitPipeAndWaitForConnection
BestEdrOfTheMarket/IPCUtils.h:369
↓ 3 callersFunctionprintLastError
* Retrieves and prints the last error message (explicitly). */
BestEdrOfTheMarket/ErrorsReportingUtils.h:16
↓ 3 callersMethodsetPatterns
BestEdrOfTheMarket/IPCUtils.h:253
↓ 2 callersFunctiondeleteMonitoringWorkerThreads
* Function for proper deletion of monitoring threads, invoked when hitting Ctrl+C / when the process is terminated */
BestEdrOfTheMarket/MonitoringUtils.cpp:709
↓ 2 callersFunctiondirectSyscallReportingJson
BestEdrOfTheMarket/ReportingUtils.h:50
↓ 2 callersFunctiondllHookingReportingJson
BestEdrOfTheMarket/ReportingUtils.h:23
↓ 2 callersMethodenumerateMemoryRegionsOfProcess
BestEdrOfTheMarket/Pe64Utils.h:79
↓ 2 callersMethodenumerateProcessModulesAndTheirPools
BestEdrOfTheMarket/Pe64Utils.h:226
↓ 2 callersMethodgetAddressOfExport
BestEdrOfTheMarket/Pe64Utils.h:124
↓ 2 callersMethodgetHeapRegionSize
BestEdrOfTheMarket/HeapUtils.h:43
↓ 2 callersMethodgetSizeOfMemoryRegionByItsIndex
BestEdrOfTheMarket/Pe64Utils.h:53
↓ 2 callersFunctionhexToByte
* Convert a CHAR representing a hex character to its BYTE equivalent. * @param byteArray The byte array to convert. * @param size The size of th
BestEdrOfTheMarket/ConversionUtils.h:98
↓ 2 callersMethodisAddressInModulesMemPools
BestEdrOfTheMarket/Pe64Utils.h:193
↓ 2 callersMethodisModulePresent
BestEdrOfTheMarket/Pe64Utils.h:217
↓ 2 callersFunctionstartup
BestEdrOfTheMarket/MonitoringUtils.cpp:319
↓ 1 callersFunctionConvertCharToLPCWSTR
BestEdrOfTheMarket/ConversionUtils.h:154
↓ 1 callersFunctionConvertCharToLPWSTR
BestEdrOfTheMarket/ConversionUtils.h:140
↓ 1 callersFunctionInitializeHooks
DLLs/NT/ntdII/dllmain.cpp:382
↓ 1 callersFunctionUninitializeHooks
DLLs/NT/ntdII/dllmain.cpp:403
↓ 1 callersFunctionWideStringToChar
BestEdrOfTheMarket/ConversionUtils.h:188
↓ 1 callersMethodcheckRemoteFunction
BestEdrOfTheMarket/PatchingUtils.h:49
↓ 1 callersMethodclearFunctionsNamesMapping
BestEdrOfTheMarket/Pe64Utils.h:150
↓ 1 callersFunctiondoingSomethingWithTheSyscall
BestEdrOfTheMarket/SSNHookingUtils.h:29
↓ 1 callersMethodfillProtectedFunctions
BestEdrOfTheMarket/PatchingUtils.h:116
↓ 1 callersMethodgetFirstModuleIAT
* Retrieves the Import Address Table of the targeted process and fills the appropriate structure */
BestEdrOfTheMarket/Pe64Utils.h:272
↓ 1 callersMethodgetHeapAddress
BestEdrOfTheMarket/HeapUtils.h:47
↓ 1 callersMethodgetHeapCount
BestEdrOfTheMarket/HeapUtils.h:51
↓ 1 callersMethodgetHeapRegionContent
BestEdrOfTheMarket/HeapUtils.h:69
↓ 1 callersMethodgetIATFunctionsMapping
BestEdrOfTheMarket/Pe64Utils.h:136
↓ 1 callersMethodgetStartOfMemoryRegion
BestEdrOfTheMarket/Pe64Utils.h:108
↓ 1 callersMethodgetThreads
BestEdrOfTheMarket/Pe64Utils.h:128
↓ 1 callersFunctionheapReportingJson
BestEdrOfTheMarket/ReportingUtils.h:71
↓ 1 callersFunctionhexStringToBytes
BestEdrOfTheMarket/ConversionUtils.h:331
↓ 1 callersFunctionhexStringToLPCVOID
* converts a hex string to an LPCVOID. * @param hexString The hex string to convert. * @return The LPCVOID. */
BestEdrOfTheMarket/ConversionUtils.h:35
↓ 1 callersMethodindexOfMemoryRegion
BestEdrOfTheMarket/Pe64Utils.h:99
↓ 1 callersFunctioninitYaraUtils
BestEdrOfTheMarket/IPCUtils.h:137
↓ 1 callersMethodmemoryRegionsContainsIndex
* Checks if a specific memory region contains a specific index */
BestEdrOfTheMarket/Pe64Utils.h:71
↓ 1 callersFunctionpatchAmsi
Samples/etw-amsi-patcher.cpp:20
↓ 1 callersFunctionpatchEtw
Samples/etw-amsi-patcher.cpp:7
↓ 1 callersFunctionpidFilling
* PID filling function, used when the /p flag is not set */
BestEdrOfTheMarket/MonitoringUtils.cpp:310
↓ 1 callersFunctionprintAsciiArtTitle
BestEdrOfTheMarket/Startup.cpp:54
↓ 1 callersFunctionprintAsciiDump
BestEdrOfTheMarket/ConversionUtils.h:373
↓ 1 callersFunctionprintBlueAlert
* Print a message in blue color * @param msg The message to print */
BestEdrOfTheMarket/ColorsUtils.h:61
↓ 1 callersFunctionprintGreenAlert
BestEdrOfTheMarket/ColorsUtils.h:45
↓ 1 callersFunctionprintHelp
BestEdrOfTheMarket/Startup.cpp:60
↓ 1 callersFunctionprintOrangeAlert
* Print a message in orange color * @param msg The message to print */
BestEdrOfTheMarket/ColorsUtils.h:69
↓ 1 callersFunctionprintStartupAsciiTitle
BestEdrOfTheMarket/Startup.cpp:50
↓ 1 callersFunctionremoveBOM
* Removes the BOM (Byte Order Mark) from the given string. * @param input The input string. * @return The string without the BOM. */
BestEdrOfTheMarket/ConversionUtils.h:76
↓ 1 callersMethodretrieveHeapRegions
BestEdrOfTheMarket/HeapUtils.h:128
↓ 1 callersFunctionstackFrameReportingJson
BestEdrOfTheMarket/ReportingUtils.h:95
↓ 1 callersFunctionxorDecrypt
Samples/low-level-shellcode-injector.cpp:32
↓ 1 callersFunctionxorDecrypt
Samples/shellcode-injector.cpp:4
↓ 1 callersFunctionxorDecrypt
Samples/apc-queue-injector.cpp:5
↓ 1 callersFunctionyaraRulesReportingJson
BestEdrOfTheMarket/ReportingUtils.h:122
FunctionCtrlHandler
<summary> Control Handler for proper deletion of the threads when hitting Ctrl+C/// </summary> <param name="fdwCtrlType">Control type</param> <returns
BestEdrOfTheMarket/MonitoringUtils.cpp:170
MethodDllLoader
BestEdrOfTheMarket/ModuleLoadingUtils.h:32
FunctionDllMain
DLLs/K32/KerneI32/dllmain.cpp:31
FunctionDllMain
DLLs/NT/ntdII/dllmain.cpp:423
FunctionDllMain
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:200
MethodHeapUtils
BestEdrOfTheMarket/HeapUtils.h:55
MethodIpcUtils
BestEdrOfTheMarket/IPCUtils.h:284
FunctionIsThreadSuspended
* Checks if a specific thread is suspended * @param hThread The handle of the thread */
BestEdrOfTheMarket/ProcessStructUtils.h:43
FunctionLPVOIDToBYTE
BestEdrOfTheMarket/ConversionUtils.h:25
MethodPatchingMitigationUtils
* @brief Constructor for PatchingMitigationUtils * @param target The handle to the remote process */
BestEdrOfTheMarket/PatchingUtils.h:133
MethodPe64Utils
BestEdrOfTheMarket/Pe64Utils.h:144
FunctionWCharToConstChar
BestEdrOfTheMarket/ConversionUtils.h:170
Function_NtAdjustPrivilegesToken
DLLs/NT/ntdII/dllmain.cpp:165
Function_NtAllocateVirtualMemory
DLLs/NT/ntdII/dllmain.cpp:124
Function_NtCreateThreadEx
DLLs/NT/ntdII/dllmain.cpp:279
Function_NtFreeVirtualMemory
DLLs/NT/ntdII/dllmain.cpp:205
Function_NtMapViewOfSection
DLLs/NT/ntdII/dllmain.cpp:223
Function_NtProtectVirtualMemory
DLLs/NT/ntdII/dllmain.cpp:146
Function_NtWriteVirtualMemory
DLLs/NT/ntdII/dllmain.cpp:186
Function_VirtualAlloc
DLLs/K32/KerneI32/dllmain.cpp:14
Function_hGetCurrentProcess
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:51
Function_hGetCurrentThreadId
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:136
Function_hGetModuleHandleA
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:69
Function_hGetProcAddress
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:77
Function_hHeapAlloc
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:31
Function_hHeapFree
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:41
Function_hInternetOpenUrlW
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:176
Function_hInternetOpenW
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:164
Function_hInternetReadFile
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:189
Function_hIsDebuggerPresent
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:130
Function_hLoadLibraryA
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:86
Function_hLocalFree
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:94
Function_hOpenProcess
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:142
Function_hReadProcessMemory
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:57
next →1–100 of 149, ranked by callers