 hasherezade
|
d843745097
|
[FEATURE] Updated pattern tree: if no signatures found, restart from the root
|
2024-02-08 06:54:08 -08:00 |
|
|
hasherezade
|
f3b6cb3a1a
|
[FEATURE] Pattern tree with list of matches
|
2024-02-07 18:05:58 -08:00 |
|
|
hasherezade
|
3e669126a0
|
[BUGFIX] In pattern_tree: added Node destructor. Small refact
|
2024-02-07 13:22:55 -08:00 |
|
|
hasherezade
|
c81303c37e
|
[FEATURE] Added a function to collect all matches
|
2024-02-07 12:50:31 -08:00 |
|
|
hasherezade
|
6383f2179c
|
[REFACT] In is_code: use one checker for both 32 and 64 bit patterns
|
2024-02-07 12:19:45 -08:00 |
|
|
hasherezade
|
da730c6d80
|
[REFACT] Renamed namespace to pattern_tree
|
2024-02-07 12:00:12 -08:00 |
|
|
hasherezade
|
f1e591ed45
|
[FEATURE] Retrieve match details. Use named signatures
|
2024-02-07 11:56:45 -08:00 |
|
|
hasherezade
|
39e3895b6c
|
[REFACT] In is_code: use one checker for both 32 and 64 bit patterns
|
2024-02-07 11:11:05 -08:00 |
|
|
hasherezade
|
64b1eadf2f
|
[REFACT] Searching pattern in a separate function
|
2024-02-07 10:52:03 -08:00 |
|
|
hasherezade
|
482f18caa0
|
[FEATURE] Use pattern_tree to search for 32bit or 64bit code pattern
|
2024-02-07 10:46:19 -08:00 |
|
|
hasherezade
|
90f31674b4
|
[FEATURE] In dump_report: report is_shellcode only if dumped material really contains code. Refact in code patterns scan
|
2023-01-02 12:32:57 -08:00 |
|
|
hasherezade
|
aa06ceba94
|
[FEATURE] Extended prolog pattern to avoid false positives (Issue #108)
|
2022-11-04 08:22:53 -07:00 |
|
|
hasherezade
|
28b389740d
|
[FEATURE] Added one more shellcode detection pattern (Issue #108)
|
2022-11-03 16:48:00 -07:00 |
|
|
hasherezade
|
ef0f1884ee
|
[BUGFIX] Fixed page access checks
|
2022-01-22 16:40:06 -08:00 |
|
|
hasherezade
|
211c571160
|
[FEATURE] In util: added is_normal_inaccessible (to check access to inaccessible pages)
|
2021-07-31 13:31:57 +02:00 |
|
|
hasherezade
|
24b4b7ef82
|
[FEATURE] Added one more 64 bit prolog pattern
|
2021-07-02 02:49:26 +02:00 |
|
|
hasherezade
|
5a68218d9e
|
[NOBIN] Cleanup
|
2021-06-20 21:41:48 +02:00 |
|
|
hasherezade
|
65696f8ce3
|
[FEATURE] Added a detection pattern
|
2021-06-20 21:39:29 +02:00 |
|
|
hasherezade
|
722fe6b1d8
|
[REFACT] Refactored . Added a function to util
|
2020-10-13 00:17:07 +02:00 |
|
|
hasherezade
|
c820271bbc
|
[REFACT] Refactored pattern checking
|
2020-07-20 21:53:33 +02:00 |
|
|
hasherezade
|
f05e8756f2
|
[BUGFIX] Added prefixed to patterns (to avoid false positives)
|
2020-07-20 21:41:08 +02:00 |
|
|
hasherezade
|
01bed9d88b
|
[FEATURE] Added one more 64 bit prolog pattern
|
2020-07-20 18:41:59 +02:00 |
|
|
hasherezade
|
1f51f4967f
|
[REFACT] Simplified 64bit patterns: removed prefixes
|
2020-07-20 18:34:49 +02:00 |
|
|
hasherezade
|
6e101772a5
|
[NOBIN] Fixed a comment
|
2020-07-20 18:24:52 +02:00 |
|
|
hasherezade
|
94ace64b27
|
[BUGFIX] Fixed return value in
|
2020-07-20 15:23:12 +02:00 |
|
|
hasherezade
|
73ae0958b1
|
[REFACT] Use function is_executable from util in WorkingsetScanner
|
2020-07-18 22:14:06 +02:00 |
|
|
hasherezade
|
c48315ea9c
|
[BUGFIX] Fixed detecting MEM_SEC as executable if access changed (Issue #66)
|
2020-07-18 22:09:09 +02:00 |
|
|
hasherezade
|
0215939f19
|
[FEATURE] Before checking code patterns, check if the area is not empty
|
2020-06-11 09:01:50 +02:00 |
|
|
hasherezade
|
28407adf8b
|
[REFACT] Wrap more utils in namespace pesieve::util
|
2020-06-02 23:56:07 +02:00 |
|
|
hasherezade
|
70ee8a9a02
|
[FEATURE] Added more shellcode detection patterns (Issue #50)
|
2020-02-26 21:01:55 +01:00 |
|
|
hasherezade
|
e5a7a96484
|
[BUGFIX] If DOS header not found, detect the payload by NT Header
|
2019-11-01 17:52:57 +01:00 |
|
|
hasherezade
|
816ff5d16a
|
[BUGFIX] Recognize bitness of the shellcode before retrieving imports
|
2019-08-04 18:07:49 +02:00 |
|
|
hasherezade
|
4f70c34e0c
|
[BUGFIX] Added another prolog variant
|
2018-08-24 02:45:03 +02:00 |
|
|
hasherezade
|
1ad9241075
|
[BUGFIX] Removed debug string (using undefined variable)
|
2018-08-07 01:46:18 +02:00 |
|
|
hasherezade
|
39f4e31a31
|
[FEATURE] Scan all executable sections for modifications
|
2018-08-06 21:36:08 +02:00 |
|