Code
Hub
Workspaces
Following
Trending
Connect
MCP
copy
Create free account
hub
/
github.com/Xacone/BestEdrOfTheMarket
/ functions
Functions
149 in github.com/Xacone/BestEdrOfTheMarket
⨍
Functions
149
◇
Types & classes
13
↓ 10 callers
Function
printRedAlert
BestEdrOfTheMarket/ColorsUtils.h:36
↓ 7 callers
Function
AttachHook
DLLs/NT/ntdII/dllmain.cpp:363
↓ 7 callers
Function
DetachHook
DLLs/NT/ntdII/dllmain.cpp:374
↓ 7 callers
Function
GetProcessPathByPID
BestEdrOfTheMarket/ReportingUtils.h:15
↓ 7 callers
Function
bytesToHexString
* Convert a byte array to a hex string. * @param bytes The byte array to convert. * @param size The size of the byte array. * @return The hex strin
BestEdrOfTheMarket/ConversionUtils.h:60
↓ 7 callers
Function
interceptMsg
DLLs/NT/ntdII/dllmain.cpp:8
↓ 6 callers
Method
RetrieveExportsForGivenModuleAndFillMap
BestEdrOfTheMarket/Pe64Utils.h:376
↓ 5 callers
Method
InjectDll
* Injects a DLL into a target process * @param dllName Name of the DLL to inject * @return TRUE if the DLL was successfully injected, FALSE ot
BestEdrOfTheMarket/ModuleLoadingUtils.h:41
↓ 4 callers
Function
containsSequence
BestEdrOfTheMarket/BytesSequencesUtils.h:21
↓ 4 callers
Function
hexStringToByteArray
BestEdrOfTheMarket/ConversionUtils.h:232
↓ 3 callers
Method
getFunctionsNamesMapping
BestEdrOfTheMarket/Pe64Utils.h:154
↓ 3 callers
Function
getHandledProcessPeb
* Get the PEB of a process * @param hProcess The handle of the process * @return The PEB of the process */
BestEdrOfTheMarket/ProcessStructUtils.h:24
↓ 3 callers
Method
initPipeAndWaitForConnection
BestEdrOfTheMarket/IPCUtils.h:369
↓ 3 callers
Function
printLastError
* Retrieves and prints the last error message (explicitly). */
BestEdrOfTheMarket/ErrorsReportingUtils.h:16
↓ 3 callers
Method
setPatterns
BestEdrOfTheMarket/IPCUtils.h:253
↓ 2 callers
Function
deleteMonitoringWorkerThreads
* Function for proper deletion of monitoring threads, invoked when hitting Ctrl+C / when the process is terminated */
BestEdrOfTheMarket/MonitoringUtils.cpp:709
↓ 2 callers
Function
directSyscallReportingJson
BestEdrOfTheMarket/ReportingUtils.h:50
↓ 2 callers
Function
dllHookingReportingJson
BestEdrOfTheMarket/ReportingUtils.h:23
↓ 2 callers
Method
enumerateMemoryRegionsOfProcess
BestEdrOfTheMarket/Pe64Utils.h:79
↓ 2 callers
Method
enumerateProcessModulesAndTheirPools
BestEdrOfTheMarket/Pe64Utils.h:226
↓ 2 callers
Method
getAddressOfExport
BestEdrOfTheMarket/Pe64Utils.h:124
↓ 2 callers
Method
getHeapRegionSize
BestEdrOfTheMarket/HeapUtils.h:43
↓ 2 callers
Method
getSizeOfMemoryRegionByItsIndex
BestEdrOfTheMarket/Pe64Utils.h:53
↓ 2 callers
Function
hexToByte
* Convert a CHAR representing a hex character to its BYTE equivalent. * @param byteArray The byte array to convert. * @param size The size of th
BestEdrOfTheMarket/ConversionUtils.h:98
↓ 2 callers
Method
isAddressInModulesMemPools
BestEdrOfTheMarket/Pe64Utils.h:193
↓ 2 callers
Method
isModulePresent
BestEdrOfTheMarket/Pe64Utils.h:217
↓ 2 callers
Function
startup
BestEdrOfTheMarket/MonitoringUtils.cpp:319
↓ 1 callers
Function
ConvertCharToLPCWSTR
BestEdrOfTheMarket/ConversionUtils.h:154
↓ 1 callers
Function
ConvertCharToLPWSTR
BestEdrOfTheMarket/ConversionUtils.h:140
↓ 1 callers
Function
InitializeHooks
DLLs/NT/ntdII/dllmain.cpp:382
↓ 1 callers
Function
UninitializeHooks
DLLs/NT/ntdII/dllmain.cpp:403
↓ 1 callers
Function
WideStringToChar
BestEdrOfTheMarket/ConversionUtils.h:188
↓ 1 callers
Method
checkRemoteFunction
BestEdrOfTheMarket/PatchingUtils.h:49
↓ 1 callers
Method
clearFunctionsNamesMapping
BestEdrOfTheMarket/Pe64Utils.h:150
↓ 1 callers
Function
doingSomethingWithTheSyscall
BestEdrOfTheMarket/SSNHookingUtils.h:29
↓ 1 callers
Method
fillProtectedFunctions
BestEdrOfTheMarket/PatchingUtils.h:116
↓ 1 callers
Method
getFirstModuleIAT
* Retrieves the Import Address Table of the targeted process and fills the appropriate structure */
BestEdrOfTheMarket/Pe64Utils.h:272
↓ 1 callers
Method
getHeapAddress
BestEdrOfTheMarket/HeapUtils.h:47
↓ 1 callers
Method
getHeapCount
BestEdrOfTheMarket/HeapUtils.h:51
↓ 1 callers
Method
getHeapRegionContent
BestEdrOfTheMarket/HeapUtils.h:69
↓ 1 callers
Method
getIATFunctionsMapping
BestEdrOfTheMarket/Pe64Utils.h:136
↓ 1 callers
Method
getStartOfMemoryRegion
BestEdrOfTheMarket/Pe64Utils.h:108
↓ 1 callers
Method
getThreads
BestEdrOfTheMarket/Pe64Utils.h:128
↓ 1 callers
Function
heapReportingJson
BestEdrOfTheMarket/ReportingUtils.h:71
↓ 1 callers
Function
hexStringToBytes
BestEdrOfTheMarket/ConversionUtils.h:331
↓ 1 callers
Function
hexStringToLPCVOID
* converts a hex string to an LPCVOID. * @param hexString The hex string to convert. * @return The LPCVOID. */
BestEdrOfTheMarket/ConversionUtils.h:35
↓ 1 callers
Method
indexOfMemoryRegion
BestEdrOfTheMarket/Pe64Utils.h:99
↓ 1 callers
Function
initYaraUtils
BestEdrOfTheMarket/IPCUtils.h:137
↓ 1 callers
Method
memoryRegionsContainsIndex
* Checks if a specific memory region contains a specific index */
BestEdrOfTheMarket/Pe64Utils.h:71
↓ 1 callers
Function
patchAmsi
Samples/etw-amsi-patcher.cpp:20
↓ 1 callers
Function
patchEtw
Samples/etw-amsi-patcher.cpp:7
↓ 1 callers
Function
pidFilling
* PID filling function, used when the /p flag is not set */
BestEdrOfTheMarket/MonitoringUtils.cpp:310
↓ 1 callers
Function
printAsciiArtTitle
BestEdrOfTheMarket/Startup.cpp:54
↓ 1 callers
Function
printAsciiDump
BestEdrOfTheMarket/ConversionUtils.h:373
↓ 1 callers
Function
printBlueAlert
* Print a message in blue color * @param msg The message to print */
BestEdrOfTheMarket/ColorsUtils.h:61
↓ 1 callers
Function
printGreenAlert
BestEdrOfTheMarket/ColorsUtils.h:45
↓ 1 callers
Function
printHelp
BestEdrOfTheMarket/Startup.cpp:60
↓ 1 callers
Function
printOrangeAlert
* Print a message in orange color * @param msg The message to print */
BestEdrOfTheMarket/ColorsUtils.h:69
↓ 1 callers
Function
printStartupAsciiTitle
BestEdrOfTheMarket/Startup.cpp:50
↓ 1 callers
Function
removeBOM
* Removes the BOM (Byte Order Mark) from the given string. * @param input The input string. * @return The string without the BOM. */
BestEdrOfTheMarket/ConversionUtils.h:76
↓ 1 callers
Method
retrieveHeapRegions
BestEdrOfTheMarket/HeapUtils.h:128
↓ 1 callers
Function
stackFrameReportingJson
BestEdrOfTheMarket/ReportingUtils.h:95
↓ 1 callers
Function
xorDecrypt
Samples/low-level-shellcode-injector.cpp:32
↓ 1 callers
Function
xorDecrypt
Samples/shellcode-injector.cpp:4
↓ 1 callers
Function
xorDecrypt
Samples/apc-queue-injector.cpp:5
↓ 1 callers
Function
yaraRulesReportingJson
BestEdrOfTheMarket/ReportingUtils.h:122
Function
CtrlHandler
<summary> Control Handler for proper deletion of the threads when hitting Ctrl+C/// </summary> <param name="fdwCtrlType">Control type</param> <returns
BestEdrOfTheMarket/MonitoringUtils.cpp:170
Method
DllLoader
BestEdrOfTheMarket/ModuleLoadingUtils.h:32
Function
DllMain
DLLs/K32/KerneI32/dllmain.cpp:31
Function
DllMain
DLLs/NT/ntdII/dllmain.cpp:423
Function
DllMain
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:200
Method
HeapUtils
BestEdrOfTheMarket/HeapUtils.h:55
Method
IpcUtils
BestEdrOfTheMarket/IPCUtils.h:284
Function
IsThreadSuspended
* Checks if a specific thread is suspended * @param hThread The handle of the thread */
BestEdrOfTheMarket/ProcessStructUtils.h:43
Function
LPVOIDToBYTE
BestEdrOfTheMarket/ConversionUtils.h:25
Method
PatchingMitigationUtils
* @brief Constructor for PatchingMitigationUtils * @param target The handle to the remote process */
BestEdrOfTheMarket/PatchingUtils.h:133
Method
Pe64Utils
BestEdrOfTheMarket/Pe64Utils.h:144
Function
WCharToConstChar
BestEdrOfTheMarket/ConversionUtils.h:170
Function
_NtAdjustPrivilegesToken
DLLs/NT/ntdII/dllmain.cpp:165
Function
_NtAllocateVirtualMemory
DLLs/NT/ntdII/dllmain.cpp:124
Function
_NtCreateThreadEx
DLLs/NT/ntdII/dllmain.cpp:279
Function
_NtFreeVirtualMemory
DLLs/NT/ntdII/dllmain.cpp:205
Function
_NtMapViewOfSection
DLLs/NT/ntdII/dllmain.cpp:223
Function
_NtProtectVirtualMemory
DLLs/NT/ntdII/dllmain.cpp:146
Function
_NtWriteVirtualMemory
DLLs/NT/ntdII/dllmain.cpp:186
Function
_VirtualAlloc
DLLs/K32/KerneI32/dllmain.cpp:14
Function
_hGetCurrentProcess
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:51
Function
_hGetCurrentThreadId
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:136
Function
_hGetModuleHandleA
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:69
Function
_hGetProcAddress
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:77
Function
_hHeapAlloc
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:31
Function
_hHeapFree
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:41
Function
_hInternetOpenUrlW
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:176
Function
_hInternetOpenW
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:164
Function
_hInternetReadFile
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:189
Function
_hIsDebuggerPresent
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:130
Function
_hLoadLibraryA
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:86
Function
_hLocalFree
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:94
Function
_hOpenProcess
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:142
Function
_hReadProcessMemory
DLLs/IAT/BestEDROfTheMarketDLL_IAT/dllmain.cpp:57
next →
1–100 of 149, ranked by callers