112 Commits

Author	SHA1	Message	Date
forrest-orr	7320bb7145	Page noaccess workingset bug	2020-03-14 16:43:55 -07:00
forrest-orr	8ec027c995	Added scan time duration	2020-03-14 16:17:54 -07:00
forrest-orr	e5937266e3	PE header performance optimization	2020-03-14 12:06:40 -07:00
forrest-orr	5d2e1676f6	Adding PE header optimization	2020-03-13 17:52:11 -07:00
forrest-orr	6cb901dcde	Fixed double-enum on suspicions with full entity/non-full types	2020-03-11 19:50:20 -07:00
forrest-orr	b02c65f9e4	Re-designed statistics output	2020-03-10 09:33:11 -07:00
forrest-orr	a48492b9d0	Fixed working set query performance issue	2020-03-10 07:55:14 -07:00
forrest-orr	befe3849a2	Changed suspicion vector to list	2020-03-08 19:06:26 -07:00
forrest-orr	4bc5d833fc	Added statistics support	2020-03-08 19:03:21 -07:00
forrest-orr	565c418070	Started adding statistics option	2020-03-08 17:08:38 -07:00
forrest-orr	dc13e77367	Update Process.cpp	2020-03-08 15:26:07 -07:00
forrest-orr	cc6b156542	Abandoned region info	2020-03-08 15:22:26 -07:00
forrest-orr	a6e8b77314	Added region info to ablock entity	2020-03-08 15:07:35 -07:00
forrest-orr	7d382a238b	Added private memory to sblock	2020-03-08 14:45:58 -07:00
forrest-orr	381a821d3f	Added verbose signing check detail	2020-03-08 08:25:05 -07:00
forrest-orr	b2df21ce1d	Added additional detail fields for executables	2020-03-08 08:55:18 -07:00
forrest-orr	73cb3ecde5	Added entry point to PEB module	2020-03-07 18:12:57 -08:00
forrest-orr	16abfe8906	Detail verbosity for entities	2020-03-07 17:02:51 -08:00
forrest-orr	55710b0568	Update Process.cpp	2020-03-06 17:14:39 -08:00
forrest-orr	579d79abd5	Block memory selection type added/tested	2020-03-06 16:56:44 -08:00
forrest-orr	b3c1dfc221	Designing detailed verbose output	2020-03-06 16:22:27 -08:00
forrest-orr	84db89c2f3	Fixed minor formatting issues	2020-03-05 15:53:09 -08:00
forrest-orr	c292481995	Consolidated memdmp code and fixed from-base dump bug	2020-03-05 13:10:32 -08:00
forrest-orr	2d8dbdf01d	Fixed section bug and consolidated suspicion enum to new func	2020-03-04 18:39:01 -08:00
forrest-orr	46e2289a8c	Fixed a series of bugs - section overlap bug remains	2020-03-04 17:18:26 -05:00
forrest-orr	abc51f76a4	Begun consolidating enumeration of PE and other entity types	2020-03-03 18:08:28 -08:00
forrest-orr	2c207c6aa3	Consolidated enum logic for PE entity	2020-03-03 16:02:33 -08:00
forrest-orr	4c660a0a52	Update Process.cpp	2020-03-03 05:49:54 -08:00
forrest-orr	d1dd9a1879	Update Process.cpp	2020-03-02 18:27:20 -08:00
forrest-orr	0bcf1729e7	Finished new args	2020-03-02 17:36:27 -08:00
forrest-orr	7b377233d9	Fixed suspicion dumping	2020-02-29 10:46:07 -08:00
forrest-orr	7562629178	Update Process.cpp	2020-02-28 19:20:08 -08:00
forrest-orr	94f69571c3	Fixed suspicions map gen bug	2020-02-28 19:14:23 -08:00
forrest-orr	0f6a341998	Fixing filter bugs	2020-02-28 18:21:18 -08:00
forrest-orr	088e6aecd2	Update Process.cpp	2020-02-28 08:16:41 -08:00
forrest-orr	570d2394e4	Begun adding double maps for suspicions	2020-02-27 19:28:41 -08:00
forrest-orr	80a021dc22	Changed metadata filter criteria to sign/ext only	2020-02-27 07:25:06 -08:00
forrest-orr	8e07838ffb	Added filter case for metadata	2020-02-27 07:16:42 -08:00
forrest-orr	e03fb415f3	Filter cases working	2020-02-26 19:51:03 -08:00
forrest-orr	5a09e250ee	Suspicion output matching original	2020-02-26 12:11:52 -08:00
forrest-orr	e7d8231873	Suspicion enumeration dev	2020-02-26 10:27:25 -08:00
forrest-orr	807c431de8	Finished generating suspicions class list	2020-02-25 19:10:06 -08:00
forrest-orr	428a4b99e4	Developing suspicion base code	2020-02-25 15:10:46 -08:00
forrest-orr	afa9e813af	Initial commit	2020-02-24 17:32:24 -08:00
forrest-orr	20caf3ed02	MemoryBlock to SBlock and started Suspicions class	2020-02-24 14:47:02 -08:00
forrest-orr	65fbd20db1	Fixed section name align bug	2020-02-24 06:19:14 -08:00
forrest-orr	d107dda18d	Added catalog signing check	2020-02-24 06:06:55 -08:00
forrest-orr	105be72c9a	Fixed signing bug and started writing new output layout	2020-02-23 19:04:30 -08:00
forrest-orr	989ffed787	Fixed non-executable section enum	2020-02-23 10:30:22 -08:00
forrest-orr	b00e65a27f	Added non-executable image detection	2020-02-23 09:33:55 -08:00