admin/dobin-RedEdr
1
0
Fork 0
mirror of https://github.com/dobin/RedEdr synced 2026-08-09 12:30:51 +00:00
Code Issues Packages Projects Releases Wiki Activity
664 Commits 1 Branch 6 Tags
16bd7233d36b29cac9899a1ca1c046beac8de8a1
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dobin Rutishauser 16bd7233d3 refactor: add "etw_time -> event_time" to all subsystems 2026-08-01 16:46:20 +02:00
Dobin Rutishauser 8840959c0f refactor: etw_time -> event_time 2026-08-01 16:43:09 +02:00
Dobin Rutishauser 718a544897 feature: sort, better color 2026-08-01 15:01:46 +02:00
Dobin Rutishauser 36547bf49a ui: performance of semidatasieve 2026-08-01 09:39:14 +02:00
Dobin Rutishauser b68ec5eefb fix: null values in json result 2026-08-01 09:38:25 +02:00
Dobin Rutishauser ab4b4a6355 feature: app ETW recording 2026-07-31 14:38:48 +02:00
Dobin Rutishauser 1787233769 refactor: log strings improvements 2026-06-23 08:54:23 +02:00
Dobin Rutishauser c5bdf1d650 fix: too small buffer, leading to unescaped json... 2026-06-22 22:43:32 +02:00
Dobin Rutishauser d1400b4fbc doc: update notes with kernel & ppl logging via etw 2026-06-22 19:59:04 +02:00
Dobin Rutishauser 7c66b11d00 refactor: ppl log message now logged with ETW (not via log file) 2026-06-22 19:58:47 +02:00
Dobin Rutishauser 12f33d173e refactor: kernel driver log messages now logged with ETW 2026-06-22 19:47:38 +02:00
Dobin Rutishauser 163880502f fix: compile help for vsc 2026-06-22 18:43:39 +02:00
Dobin Rutishauser 2c51fd1e5b feature: compile help for vsc 2026-06-22 18:37:20 +02:00
Dobin Rutishauser f9b0022358 feature: KDU EPROCESS runtime offset calculation for unknown windows versions 2026-06-21 12:53:45 +02:00
Dobin Rutishauser a675e5a86e feature: to access mssense.exe, elevate RedEdrPplService from ntimalware-Light to SignerWinTcb-Light (in kernel, kdu inspired) 2026-06-21 10:53:30 +02:00
Dobin Rutishauser ba773a7232 fix: just send the dll name without path because of length restrictions 2026-06-21 10:40:46 +02:00
Dobin Rutishauser aed71c0093 fix 2026-06-21 10:29:29 +02:00
Dobin Rutishauser 9220387fdd ui: semidatasieve colors 2026-06-21 10:09:06 +02:00
Dobin Rutishauser 168e9a8004 fix: compile error 2026-06-21 10:08:56 +02:00
Dobin Rutishauser 74862796ff fix: better names for Audi-API-Calls 2026-06-20 11:32:44 +02:00
Dobin Rutishauser 9fb6c7bccc fix: compile 2026-06-19 09:00:29 +02:00
Dobin Rutishauser 0f60bdf134 feature: process->name is now without path (its in process->image_path)) 2026-06-19 09:00:22 +02:00
Dobin Rutishauser 93b63bd85f feature: support MsSense.exe too to MsMpEng.exe 2026-06-19 08:52:59 +02:00
Dobin Rutishauser 4ddd5f36fe fix: notepad start upon compiling?! 2026-06-17 18:40:35 +02:00
Dobin Rutishauser 7846b39a9f refactor (claude) small cleanup 2026-06-17 18:34:28 +02:00
Dobin Rutishauser b4d2b4da5f refactor: (claude) improved thread safety of ProcessResolver 2026-06-17 18:23:13 +02:00
Dobin Rutishauser 347f7246b8 fix: injecting defender memory addresses into ProcessResolver 2026-06-17 18:08:46 +02:00
Dobin Rutishauser 656a0045a5 feature: dump defender version (mpengine.dll and registry) 2026-06-17 13:05:06 +02:00
Dobin Rutishauser 3f3fe4d42a doc: proxmox secureboot update 2026-06-17 10:42:42 +02:00
Dobin Rutishauser 642c2f2d88 update: semidatesieve 2026-06-16 09:37:33 +02:00
Dobin Rutishauser 26fd2c862d fix: correct defender dll dump 2026-06-16 09:37:24 +02:00
Dobin Rutishauser c36d93c2af fix: html not updated on release 2026-06-16 08:41:30 +02:00
Dobin Rutishauser 1586065fc7 feature: send defender dlls events on start 2026-06-16 08:41:23 +02:00
Dobin Rutishauser 237132fe88 feature: inject defender dlls infos from RedEdrPpl into RedEdr ProcessResolver (for callstack) 2026-06-16 06:50:15 +02:00
Dobin Rutishauser 8ff471643c feature: make defender dll's available in ProcessResolver 2026-06-16 06:27:23 +02:00
Dobin Rutishauser ca83bac4c6 fix: emit some meta events only if available (e.g. not for defender) 2026-06-14 20:19:12 +02:00
Dobin Rutishauser f4d6ba1bf4 featuer: add process name to dlls 2026-06-14 20:16:01 +02:00
Dobin Rutishauser 4b0a6e6073 refactor: defender loaded dlls in one event 2026-06-14 20:15:53 +02:00
Dobin Rutishauser bc0d228e8a fix: compile options something who tf knows 2026-06-14 17:36:18 +02:00
Dobin Rutishauser 9be1e468a3 feature: defender modules logging 2026-06-14 17:36:01 +02:00
Dobin Rutishauser f2e69a8571 fix: observe msmepeng.exe with DefenderTrace enabled (and not the target process) 2026-06-14 13:43:16 +02:00
Dobin Rutishauser 2b1c702f88 fix: absolutely braindead retarteded windows quoting garbage 2026-06-06 12:27:34 +02:00
Dobin Rutishauser e7931576d4 feature: version endpoint 2026-06-06 11:37:36 +02:00
Dobin Rutishauser 6747ff034e fix: escaping azure upload script auth error 2026-06-06 10:53:01 +02:00
Dobin Rutishauser 4153db8a76 doc: vs2022 download location 2026-05-10 16:25:09 +02:00
Dobin 3bd6b97a0f update: vs issues 2026-05-03 11:37:31 +02:00
Dobin Rutishauser aa54182fd1 Merge branch 'master' of https://github.com/dobin/RedEdr 2026-05-03 11:16:59 +02:00
Dobin Rutishauser 167445a51c fix: add *.user as it contains fucking important information fucking visual studio 2026-05-03 11:16:42 +02:00
Dobin 653f833475 fix: correctly handle process name and command line in process resolver 2026-05-03 01:02:25 +02:00
Dobin Rutishauser e624121c2f feature: rededr test better memory layout print 2026-04-25 16:08:46 +02:00
Dobin Rutishauser 1ae5e686bf add: data 2026-04-25 16:08:32 +02:00
Dobin RutishauserandCopilot 1b0b3a5336 ui: make it more beautiful 
Co-authored-by: Copilot <copilot@github.com>
 2026-04-25 16:04:54 +02:00
Dobin Rutishauser 0b1b27ac07 add: redtest 2026-04-24 12:38:23 +02:00
Dobin Rutishauser 8c883efd61 fix: win 11 compatibility 2026-04-24 12:38:13 +02:00
Dobin Rutishauser d78153d9e9 doc: update disabling secureboot 2026-04-19 21:18:59 +02:00
Dobin Rutishauser 95061ac1a6 refactor: update logging so it looks nicer 2026-04-19 15:45:16 +02:00
Dobin Rutishauser 9e15474b2d doc: update 2026-04-19 15:15:32 +02:00
Dobin Rutishauser 09d8a4cd83 feature: always use kernel with etwti 2026-04-19 15:15:24 +02:00
Dobin Rutishauser 0d557478b8 refactor: 2026-04-19 14:49:47 +02:00
Dobin Rutishauser bce214a14c fix: shutdown when ctrl-c with kernel 2026-04-19 14:49:32 +02:00
Dobin Rutishauser 2bc37b303f feature: enable all ETW-TI events for defender 2026-04-19 12:35:43 +02:00
Dobin Rutishauser 365df783c1 refactor: split kernel-loading and kernel-dll-hooking 2026-04-19 10:41:17 +02:00
Dobin Rutishauser db65a72692 fix: etw-ti enabling, implements #3 2026-04-18 12:43:52 +02:00
Dobin Rutishauser e36be0eb07 fix: dont observe ourselves (upon process re-evaluating) 2026-04-17 19:29:09 +02:00
Dobin Rutishauser ebb6872676 feature: attempt to enable etw-ti (unsuccessful) related to #3 2026-04-17 16:38:15 +02:00
Dobin Rutishauser 372b518779 fix: (claude) reliability updates for Driver 2026-04-12 14:01:18 +02:00
Dobin Rutishauser d7aadf4c89 doc 2026-04-12 13:58:10 +02:00
Dobin Rutishauser fb06fc001c fix: unnice shutdown for ppl 2026-04-12 13:40:19 +02:00
Dobin Rutishauser 943d622f57 fix: pplservice not applying new target 2026-04-12 12:52:10 +02:00
Dobin Rutishauser 3df3c51974 feature: defender msmpeng.exe related events in etw-ti 2026-04-11 18:48:05 +02:00
Dobin Rutishauser b4889ccb79 feature: defender msmpeng.exe related events 2026-04-11 15:59:13 +02:00
Dobin Rutishauser c35d5e0683 refactor: (claude) use signals instead of terminatethread (reliability) 2026-04-11 10:58:43 +02:00
Dobin Rutishauser 377876010c fix: (claude) reliability and safety fixes 2026-04-08 08:49:19 +02:00
Dobin Rutishauser 767d050bab fix: (claude) reliability fixes 2026-04-08 08:13:07 +02:00
Dobin Rutishauser 02f9be9f46 refactor: set trace target in ManagerApplyNewTargets 2026-01-30 14:58:26 +01:00
Dobin Rutishauser 055d74c22d feature: defender antimalwareengine events 2026-01-30 14:33:44 +01:00
Dobin 926dbec0ac refactor: remove all things now in DetonatorAgent 2025-11-02 13:58:41 +00:00
Dobin f5a1607feb fix: upload script 2025-11-02 13:26:59 +00:00
Dobin ac45eaf8ac feature: change default port from 8080 to 8081 2025-10-31 11:37:29 +00:00
Dobin fb2d1ca237 feature: log file writing 2025-10-28 19:23:40 +00:00
Dobin fbe6e8b549 refactor: extension check 2025-10-28 16:42:22 +00:00
Dobin 530f15e020 fix: remove log msg when starting without arguments 2025-10-28 16:41:50 +00:00
Dobin 9c7f5fa3be fix: api update to new detonatoragent style 2025-10-26 09:32:10 +00:00
Dobin bdcd4450ee fix: unittests 2025-09-26 20:00:58 +01:00
Dobin dfe5ce1e23 fix: RedEdrTester 2025-09-26 19:44:27 +01:00
Dobin 815502a5c5 update: api doc 2025-09-26 18:28:05 +01:00
Dobin 53f198555a fix: update REST API 2025-09-26 15:08:18 +01:00
Dobin 70606d481d fix: nicer output 2025-09-26 14:55:02 +01:00
Dobin 0805d8d10c feature: cleanup process list regularly (attempt to fix long-running crash) 2025-09-26 14:13:23 +01:00
Dobin 96d4e73952 refactor: split and compartementalize process-observe and process-info (mem_static to process) 2025-09-26 12:53:34 +01:00
Dobin e0d2d82d43 fix: error message trigger 2025-09-26 08:22:04 +01:00
Dobin facc6984b1 fix: new cert, 5y 2025-09-26 07:58:33 +01:00
Dobin Rutishauser 17015d5bfe fix: unittests 2025-09-04 15:55:34 +02:00
Dobin e4900e3de6 fix: initialize web last 2025-08-29 15:36:16 +01:00
Dobin e1fd60a49e fix: dont trace ourselves 2025-08-29 15:36:03 +01:00
Dobin c4471b8004 feature: support fileargs 2025-08-29 15:35:56 +01:00
Dobin 3963239e22 fix: bump version 2025-08-29 10:34:18 +01:00
Dobin 88658da134 featur: check commandline of processes (if possible) - for rundll32 support 2025-08-29 10:32:39 +01:00
Dobin b971a98d9e feature: wait for ETW to load 2025-08-29 10:08:10 +01:00
Dobin e4b8e89b98 fix: error messages 2025-08-23 10:12:56 +01:00