admin/hasherezade-pe-sieve
1
0
Fork 0
mirror of https://github.com/hasherezade/pe-sieve synced 2026-06-08 14:34:52 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,771 Commits 19 Branches 45 Tags
pattern_tree3
Commit Graph

65 Commits

Author SHA1 Message Date
hasherezade 8a48c9c52d [REFACT] Explicitly case sizes to DWORDs when needed 2022-01-09 16:23:28 -08:00
hasherezade 5c14d2aca1 [BUGFIX] In fixSectionsVirtualSize: improved validation of sections 
(Issue #95)
 2021-12-22 14:41:09 -08:00
hasherezade 8493ee6990 [BUGFIX] In fixSectionsVirtualSize: trim out invalid sections (Issue #96) 2021-12-22 13:45:21 -08:00
hasherezade 4d598dcf5a [REFACT] Added cast 2021-09-07 11:45:21 +02:00
hasherezade ac0b609070 [FEATURE] Pass info if working on process reflection. Use it to decide if can force read inaccessible mem. 2021-07-30 12:46:28 +02:00
hasherezade e09f653cb0 [REFACT] Updated libpeconv. Whenever buffer size is available, use it to verify NT headers 2021-04-11 14:23:11 +02:00
hasherezade d6aeca0a80 [REFACT] Wrapped everything in pesieve namespace 2020-06-14 19:52:06 +02:00
hasherezade 7762b01eae [REFACT] Use load base as a reloc base 2019-12-28 01:43:00 +01:00
hasherezade f213eed55c [FEATURE] In reconstructing PE: if virtual, set module base as ImageBase in the header 2019-12-23 03:21:32 +01:00
hasherezade e34c893c7d [REFACT] Moved fixing EP of .NET applications to libpeconv. Accuracy improved (Issue #48) 2019-12-05 00:45:50 +01:00
hasherezade 5b322412e1 [BUGFIX] In search_jump: use signed integer 2019-12-03 17:43:25 +01:00
hasherezade 4ee4847cc7 [BUGFIX] Reconstruct Entry Point of .NET payloads (Issue #48) 2019-12-03 03:40:24 +01:00
hasherezade c93b16316b [REFACT] Limited scope of a variable 2019-11-23 06:30:05 +01:00
hasherezade 48eeac1f2c [REFACT] Removing PE base from the artefact implemented by function: dropPeBase 2019-11-03 15:28:23 +01:00
hasherezade 219042d27f [BUGFIX] Fixed invalid offset calculation (Issue #45) 2019-11-02 19:04:02 +01:00
hasherezade ae7b9c688d [BUGFIX] In reconstructFileHdr: substract PE base from the calculated offset 2019-11-01 22:12:24 +01:00
hasherezade 2acd40aa4b [BUGFIX] Updated libpeconv. Refactored PE-sieve to follow the changes in API 2019-11-01 15:35:10 +01:00
hasherezade 0dced941a9 [REFACT] Changes in setting the dump paths. Remove 'rec' from the path of the reconstructed payload. 2019-06-11 19:41:15 +02:00
hasherezade 3c9f4b519f [REFACT] Removed a debug string 2019-06-10 23:41:55 +02:00
hasherezade cf5af4dbec [REFACT] Moved PeBuffer into separate files 2019-06-08 15:30:25 +02:00
hasherezade ae8fc61867 [REFACT] Create PeBuffer outside, not in PeReconstructor 2019-06-08 14:49:40 +02:00
hasherezade 37b21c3b00 [FEATURE] Reconstruct import table of replaced and patched modules 2019-06-07 17:42:46 +02:00
hasherezade 10557fc3d1 [REFACT] Moved retrieving buffer size to PeBuffer. Cleanup. 2019-06-07 17:07:28 +02:00
hasherezade a4d2d527d0 [REFACT] Separated ImpReconstructor from PeReconstructor 2019-06-07 14:13:52 +02:00
hasherezade 2b7e434c1e [REFACT] In IATBlock: added function isValid 2019-06-07 00:14:18 +02:00
hasherezade f415c504eb [BUGFIX] Fixed memory leak in IATThunkSeries. Cleanup. 2019-06-06 20:56:23 +02:00
hasherezade 09fd320794 [FEATURE] Reconstructing Import Table of implants. Saving functions by 
names.
 2019-06-06 20:14:40 +02:00
hasherezade eb889a8f98 [REFACT] Small refactoring of IATThunkSeries (limit access to the 
fields)
 2019-06-05 22:53:29 +02:00
hasherezade eb5d1f65e1 [BUGFIX] Delete ThunksSeries in a destructor of IATBlock. Renamed 
iat_size to iatSize
 2019-06-05 15:11:10 +02:00
hasherezade 227ccec16c [REFACT] In IATBlock: store IAT and ImportTable by offsets. Removed 
redundant variables.
 2019-06-05 15:01:56 +02:00
hasherezade 585e37473d [FEATURE] Reconstructing ImportTable basing on fully covered IAT blocks 2019-06-05 14:16:57 +02:00
hasherezade d6c9098747 [FEATURE] Coverage for each series of thunks in IAT block 2019-06-05 11:56:58 +02:00
hasherezade 99b1eec5f8 [FEATURE] Added parameter changing the import recovery mode 2019-05-27 16:38:54 +02:00
hasherezade dcde8198b2 [REFACT] Call collectIATs in rebuildImportTable function 2019-05-27 02:45:08 +02:00
hasherezade f0e4527d23 [FEATURE] Collect all possible IAT candidates 2019-05-27 02:26:54 +02:00
hasherezade 4e46c4ae61 [FEATURE] Save a report about the found imports 2019-05-27 00:30:54 +02:00
hasherezade be30e2617c [FEATURE] Collect all the found IAT blocks in PeReconstructor 2019-05-26 21:47:00 +02:00
hasherezade c93a07d9bd [REFACT] Moved import_table_finder into separate files 2019-05-26 21:30:46 +02:00
hasherezade 969ff9ebf2 [REFACT] Store the found IAT in a class 2019-05-26 17:22:20 +02:00
hasherezade 1e7affd7d4 [FEATURE] Cleanup sections characteristics in an implanted payload 2019-05-25 00:17:37 +02:00
hasherezade 5d722040c7 [BUGFIX] Scan all the possible IATs searching for the ImportTable (Issue #35) 2019-03-19 18:52:36 +01:00
hasherezade 8fb7695fdd [BUGFIX] In case if raw alignment is invalid and virtual valid, try to 
remap
 2019-03-14 20:42:40 +01:00
hasherezade e5d20ba7d9 [FEATURE] Recognize if the sections header is damaged, attempt to remap 
(Issue #32)
 2019-03-14 18:00:52 +01:00
hasherezade 231c5fd50b [REFACT] Renamed a function. 2019-03-14 17:18:04 +01:00
hasherezade 6fb79d0858 [REFACT] Use function 'is_padding' from peconv namespace 2019-03-14 15:29:17 +01:00
hasherezade 8e3c21fc9b [REFACT] Modified displayed info about PE reconstruction 2019-03-14 15:16:30 +01:00
hasherezade 6dbee14481 [BUGFIX] Redundant use of shiftPeHeader 2019-03-14 15:06:05 +01:00
hasherezade b0e512f0a0 [REFACT] In PeReconstructor: store the original artefacts that stays 
unmodified
 2019-03-14 15:00:45 +01:00
hasherezade 42928e16bc [FEATURE] In PeReconstructor: shift PE header to make space for DOS 
header if needed
 2019-03-14 03:23:55 +01:00
hasherezade 5c5e14b7b7 [BUGFIX] Ensure that found import descriptor is the first one (Issue #31) 2019-03-13 05:17:27 +01:00