 hasherezade
|
a462d7c845
|
[FEATURE] Cache detected shellcodes
|
2023-07-09 10:31:39 -07:00 |
|
|
hasherezade
|
90f31674b4
|
[FEATURE] In dump_report: report is_shellcode only if dumped material really contains code. Refact in code patterns scan
|
2023-01-02 12:32:57 -08:00 |
|
|
hasherezade
|
00921bf738
|
[REFACT] Hidden a debug string: Unable to fix imports
|
2022-05-06 08:46:28 -07:00 |
|
|
hasherezade
|
8a48c9c52d
|
[REFACT] Explicitly case sizes to DWORDs when needed
|
2022-01-09 16:23:28 -08:00 |
|
|
hasherezade
|
7ad55744d1
|
[FEATURE] In imp_rec: set callback on found thunk. Filter out calls to the current module
|
2021-09-04 09:15:04 +02:00 |
|
|
hasherezade
|
ac0b609070
|
[FEATURE] Pass info if working on process reflection. Use it to decide if can force read inaccessible mem.
|
2021-07-30 12:46:28 +02:00 |
|
|
hasherezade
|
ab0f439abe
|
[BUGFIX] Allow to modify memory access only for process reflection
(Issue #86)
|
2021-07-30 11:38:49 +02:00 |
|
|
hasherezade
|
a7cc4df35b
|
[REFACT] In PeBuffer: store the base no matter if reading succeeded or failed
|
2021-04-19 22:36:15 +02:00 |
|
|
hasherezade
|
d33ac6b3db
|
[BUGFIX] Updated libpeconv with a bugfix (improving detecting dump modes)
|
2020-07-08 04:58:40 -07:00 |
|
|
hasherezade
|
d6aeca0a80
|
[REFACT] Wrapped everything in pesieve namespace
|
2020-06-14 19:52:06 +02:00 |
|
|
hasherezade
|
908f38b84e
|
[BUGFIX] In PeBuffer, ModuleData: use calculated ImageSize if the size
from header is wrong
|
2020-06-14 15:29:04 +02:00 |
|
|
hasherezade
|
bb8c9f4267
|
[REFACT] If ImageSize was not given in the report, use the calculated size
|
2020-06-14 14:18:07 +02:00 |
|
|
hasherezade
|
0e16960017
|
[REFACT] Moved generation of IAT report into IATScanReport
|
2020-04-13 12:23:16 +02:00 |
|
|
hasherezade
|
939a36c7c7
|
[FEATURE] Make IAT Scan report independent from Import Recovery
|
2020-04-12 20:25:32 +02:00 |
|
|
hasherezade
|
d41a04f18d
|
[FEATURE] In report about not recovered imports: show the name from import table
|
2020-04-12 15:07:53 +02:00 |
|
|
hasherezade
|
934ffbe58b
|
[REFACT] Changed handling uncovered imports
|
2020-03-11 20:48:45 +01:00 |
|
|
hasherezade
|
4a4e0ff74f
|
[FEATURE] Create a list of not recovered imports
|
2020-03-11 04:20:42 +01:00 |
|
|
hasherezade
|
3a0137c425
|
[FEATURE] Preserve the relocBase found during the code scan, and use it during PE dumping
|
2019-12-30 01:41:49 +01:00 |
|
|
hasherezade
|
7762b01eae
|
[REFACT] Use load base as a reloc base
|
2019-12-28 01:43:00 +01:00 |
|
|
hasherezade
|
59adb8ad0e
|
[BUGFIX] In PeBuffer::dumpToPe : use a module base saved in the header
|
2019-12-23 03:25:51 +01:00 |
|
|
hasherezade
|
57754a4f6f
|
[BUGFIX] Fixed reverting dumpMode
|
2019-11-23 06:27:03 +01:00 |
|
|
hasherezade
|
6a89d2e2f9
|
[REFACT] Re-read module from the memory if reconstruction failed. Refactored dumping shellcode.
|
2019-06-12 00:22:58 +02:00 |
|
|
hasherezade
|
a0691394b4
|
[BUGFIX] Preserve the module base while resising PeBuffer
|
2019-06-11 20:24:22 +02:00 |
|
|
hasherezade
|
bd2d941cd6
|
[REFACT] Set ExportsMaper as const in functions that use it as lookup. Refactored function dumpAllModified.
|
2019-06-08 16:20:41 +02:00 |
|
|
hasherezade
|
cf5af4dbec
|
[REFACT] Moved PeBuffer into separate files
|
2019-06-08 15:30:25 +02:00 |
|