admin/eronnen-procmon-parser
1
0
Fork 0
mirror of https://github.com/eronnen/procmon-parser synced 2026-06-08 14:05:59 +00:00
Code Issues Packages Projects Releases Wiki Activity
48 Commits 9 Branches 5 Tags
fix-python2
Commit Graph

20 Commits

Author SHA1 Message Date
eronnen 32392dacf7 adding good hash functions to main objects 2021-03-01 23:48:54 +02:00
Ely Ronnen 65ea6befda Feature/parse filesytem details2 (#7) 
* Parsing DeviceIoControl, FilesystemControl

* Parsing QueryDirectory
 2020-07-31 11:35:54 +03:00
eronnen 8605424e51 Parsing CreateFile, ReadFile, WriteFile details 2020-07-25 01:46:22 +03:00
eronnen 01ff306be8 adding benchmark test against csv DictReader 2020-07-24 16:17:16 +03:00
eronnen 311882ca4f Adding more optimizations 2020-07-22 21:20:00 +03:00
Ely Ronnen dd2ce4d566 Feature/parsing registry details (#5) 
* Parsing RegQueryValue and RegEnumValue details and category

* Parsing RegQueryKey and RegEnumKey details and category

* Parsing RegOpenKey and RegCreateKey

* Parsing every single registry operation's details successfully!

* parsing process events details
 2020-07-20 22:24:38 +03:00
eronnen 63e886379a 3.5 times faster PML parsing then construct library, 1.5 times faster then kaitai struct 2020-07-18 02:00:18 +03:00
eronnen 1f10a8fe80 way faster PML parsing with kaitai struct library 2020-07-18 02:00:18 +03:00
eronnen 5b25ddfbe1 fix time off by one second 2020-07-18 02:00:18 +03:00
eronnen 11a02e87fd fixed handling of wrong encoded Paths 
added manual test
 2020-07-15 19:40:03 +03:00
eronnen 81dc6d157d handling Unknown sub operation type 
handling unknown virtualize value
 2020-07-15 13:48:51 +03:00
eronnen af6864b413 adding file formats docs 
parsing system details from PML header
testing part of the Detail column
 2020-07-15 10:52:34 +03:00
eronnen 0c66234e84 Parsing the module list of every process 2020-07-13 01:11:13 +03:00
eronnen 937ed60f4d compatible with original procmon for 25 columns out of 27 columns (missing Detail and Category) 2020-07-12 23:55:26 +03:00
eronnen 0517b05f50 adding pml parsing tests and resources 2020-07-12 04:34:21 +03:00
eronnen ffa68303dd parsing times to 100 nanoseconds precision like original Procmon using numpy 2020-07-11 18:56:56 +03:00
eronnen 824db4dfa7 parsing thread_exit correctly 2020-07-11 12:32:25 +03:00
eronnen 2f674975ea parsing process create and process start almost full details 2020-07-11 04:44:52 +03:00
eronnen 2c573f76ea parsing network events details 2020-07-11 00:30:35 +03:00
eronnen 5c8fa72c0c adding logs format 2020-07-10 19:43:34 +03:00