62343f37eb
fix python2 missing enum.IntFlag
2023-02-22 23:49:06 +02:00
1398672f7b
Add github action for tests ( #25 )
...
* Add github action for tests
* github tests install current package
* remove python 2.7, add coveralls
* fix coveralls
2023-02-22 23:09:13 +02:00
58fe476873
Add code for handling details of FileSystemOperation CreateFileMapping. ( #24 )
...
* Add code for handling details of FileSystemOperation CreateFileMapping.
* add CreateFileMapping to tests
* add CreateFileMapping tests exception to PageProtection detail value
---------
Co-authored-by: eronnen <elyronnen@gmail.com >
2023-02-21 23:44:35 +02:00
f0b227389d
Update PML Format.md
...
Updated some fields in te header after reverse engineering.
The field at offset 0x238 never triggers a breakpoint, so my guess is it's not used at all.
You c
2023-02-09 16:16:04 +02:00
347faec6dd
test SetDispositionInformationFile detail and category
2021-05-22 02:52:01 +03:00
8b8676362c
parsing SetDispositionInformationFile details
2021-05-22 02:33:03 +03:00
48f7ff9442
Merge pull request #16 from eronnen/add-helper-functions
...
adding good hash functions to main objects
adding helper function to read PML in one liner
2021-03-02 00:03:05 +02:00
d796c55b9b
adding helper function to read PML in one liner
2021-03-01 23:50:44 +02:00
32392dacf7
adding good hash functions to main objects
2021-03-01 23:48:54 +02:00
caa94e791a
Clarify Readme ( #14 )
...
* Clarify Readme.md
* Change "Supported Feature" to TODO
2020-09-25 21:06:25 +03:00
c0a07ba3cd
new procmon 3.60 ( #13 )
2020-09-19 13:50:18 +03:00
69237f7848
support Archtitecture column filter ( #12 )
2020-08-07 01:04:09 +03:00
7241aae305
fix #10 - integer valued filter rules ( #11 )
2020-08-07 00:15:23 +03:00
1f0ff8e027
fix readme sample code ( #9 )
2020-08-04 20:57:03 +03:00
65ea6befda
Feature/parse filesytem details2 ( #7 )
...
* Parsing DeviceIoControl, FilesystemControl
* Parsing QueryDirectory
2020-07-31 11:35:54 +03:00
8605424e51
Parsing CreateFile, ReadFile, WriteFile details
2020-07-25 01:46:22 +03:00
01ff306be8
adding benchmark test against csv DictReader
2020-07-24 16:17:16 +03:00
311882ca4f
Adding more optimizations
2020-07-22 21:20:00 +03:00
dd2ce4d566
Feature/parsing registry details ( #5 )
...
* Parsing RegQueryValue and RegEnumValue details and category
* Parsing RegQueryKey and RegEnumKey details and category
* Parsing RegOpenKey and RegCreateKey
* Parsing every single registry operation's details successfully!
* parsing process events details
2020-07-20 22:24:38 +03:00
63e886379a
3.5 times faster PML parsing then construct library, 1.5 times faster then kaitai struct
2020-07-18 02:00:18 +03:00
1f10a8fe80
way faster PML parsing with kaitai struct library
2020-07-18 02:00:18 +03:00
5b25ddfbe1
fix time off by one second
2020-07-18 02:00:18 +03:00
11a02e87fd
fixed handling of wrong encoded Paths
...
added manual test
2020-07-15 19:40:03 +03:00
81dc6d157d
handling Unknown sub operation type
...
handling unknown virtualize value
2020-07-15 13:48:51 +03:00
af6864b413
adding file formats docs
...
parsing system details from PML header
testing part of the Detail column
2020-07-15 10:52:34 +03:00
0c66234e84
Parsing the module list of every process
2020-07-13 01:11:13 +03:00
937ed60f4d
compatible with original procmon for 25 columns out of 27 columns (missing Detail and Category)
2020-07-12 23:55:26 +03:00
bfd5d2ba37
uploading to pypi
2020-07-12 13:11:58 +03:00
386c31aa21
add coverage
2020-07-12 12:46:16 +03:00
610036ce84
first release
2020-07-12 12:21:24 +03:00
e13745018d
patch for python 2
2020-07-12 11:15:23 +03:00
0517b05f50
adding pml parsing tests and resources
2020-07-12 04:34:21 +03:00
ffa68303dd
parsing times to 100 nanoseconds precision like original Procmon using numpy
2020-07-11 18:56:56 +03:00
824db4dfa7
parsing thread_exit correctly
2020-07-11 12:32:25 +03:00
ac6491f0cb
parsing Process_Start environment multi_sz string
2020-07-11 11:58:17 +03:00
2f674975ea
parsing process create and process start almost full details
2020-07-11 04:44:52 +03:00
b328d89404
parsing registry and filesystem paths
2020-07-11 01:50:30 +03:00
2c573f76ea
parsing network events details
2020-07-11 00:30:35 +03:00
5c8fa72c0c
adding logs format
2020-07-10 19:43:34 +03:00
8bde1d78c0
code works for Python27
2020-07-10 08:45:38 +03:00
18f599c2a0
update package programming languages
2020-07-10 00:06:09 +03:00
b6466c933c
add travis CI yaml config
2020-07-09 23:36:41 +03:00
542f45ee67
adding sanity pytest to test configuration format
2020-07-09 23:16:18 +03:00
c5341f9fde
adding README.md
2020-07-09 20:09:50 +03:00
9ec32af852
adding validators and documenting some fields
2020-07-09 16:28:59 +03:00
7ca475facc
reorganizing files
2020-07-09 14:26:08 +03:00
57760c24e2
fully loading and dumping .PMC file successfully
2020-07-09 13:57:41 +03:00
e722f0dcbf
Successfully loading .PMC file to python dictionary
2020-07-08 23:42:25 +03:00
eronnen