Morph MORPH
SIGN IN SIGN UP
dhruvhead / pe-sieve UNCLAIMED
0 0 1 C++

COMMITS

/ postprocessors/pe_reconstructor.cpp
stats
January 10, 2022
H
[REFACT] Explicitly case sizes to DWORDs when needed
hasherezade committed
8a48c9c
December 22, 2021
H
[BUGFIX] In fixSectionsVirtualSize: improved validation of sections
hasherezade committed
5c14d2a
H
[BUGFIX] In fixSectionsVirtualSize: trim out invalid sections (Issue #96)
hasherezade committed
8493ee6
September 7, 2021
H
[REFACT] Added cast
hasherezade committed
4d598dc
July 30, 2021
H
[FEATURE] Pass info if working on process reflection. Use it to decide if can force read inaccessible mem.
hasherezade committed
ac0b609
April 11, 2021
H
[REFACT] Updated libpeconv. Whenever buffer size is available, use it to verify NT headers
hasherezade committed
e09f653
June 14, 2020
H
[REFACT] Wrapped everything in pesieve namespace
hasherezade committed
d6aeca0
December 28, 2019
H
[REFACT] Use load base as a reloc base
hasherezade committed
7762b01
December 23, 2019
H
[FEATURE] In reconstructing PE: if virtual, set module base as ImageBase in the header
hasherezade committed
f213eed
December 4, 2019
H
[REFACT] Moved fixing EP of .NET applications to libpeconv. Accuracy improved (Issue #48)
hasherezade committed
e34c893
December 3, 2019
H
[BUGFIX] In search_jump: use signed integer
hasherezade committed
5b32241
H
[BUGFIX] Reconstruct Entry Point of .NET payloads (Issue #48)
hasherezade committed
4ee4847
November 23, 2019
H
[REFACT] Limited scope of a variable
hasherezade committed
c93b163
November 3, 2019
H
[REFACT] Removing PE base from the artefact implemented by function: dropPeBase
hasherezade committed
48eeac1
November 2, 2019
H
[BUGFIX] Fixed invalid offset calculation (Issue #45)
hasherezade committed
219042d
November 1, 2019
H
[BUGFIX] In reconstructFileHdr: substract PE base from the calculated offset
hasherezade committed
ae7b9c6
H
[BUGFIX] Updated libpeconv. Refactored PE-sieve to follow the changes in API
hasherezade committed
2acd40a
June 11, 2019
H
[REFACT] Changes in setting the dump paths. Remove 'rec' from the path of the reconstructed payload.
hasherezade committed
0dced94
June 10, 2019
H
[REFACT] Removed a debug string
hasherezade committed
3c9f4b5
June 8, 2019
H
[REFACT] Moved PeBuffer into separate files
hasherezade committed
cf5af4d
H
[REFACT] Create PeBuffer outside, not in PeReconstructor
hasherezade committed
ae8fc61
June 7, 2019
H
[FEATURE] Reconstruct import table of replaced and patched modules
hasherezade committed
37b21c3
H
[REFACT] Moved retrieving buffer size to PeBuffer. Cleanup.
hasherezade committed
10557fc
H
[REFACT] Separated ImpReconstructor from PeReconstructor
hasherezade committed
a4d2d52
June 6, 2019
H
[REFACT] In IATBlock: added function isValid
hasherezade committed
2b7e434
H
[BUGFIX] Fixed memory leak in IATThunkSeries. Cleanup.
hasherezade committed
f415c50
H
[FEATURE] Reconstructing Import Table of implants. Saving functions by
hasherezade committed
09fd320
June 5, 2019
H
[REFACT] Small refactoring of IATThunkSeries (limit access to the
hasherezade committed
eb889a8
H
[BUGFIX] Delete ThunksSeries in a destructor of IATBlock. Renamed
hasherezade committed
eb5d1f6
H
[REFACT] In IATBlock: store IAT and ImportTable by offsets. Removed
hasherezade committed
227ccec
H
[FEATURE] Reconstructing ImportTable basing on fully covered IAT blocks
hasherezade committed
585e374
H
[FEATURE] Coverage for each series of thunks in IAT block
hasherezade committed
d6c9098
May 27, 2019
H
[FEATURE] Added parameter changing the import recovery mode
hasherezade committed
99b1eec
H
[REFACT] Call collectIATs in rebuildImportTable function
hasherezade committed
dcde819
H
[FEATURE] Collect all possible IAT candidates
hasherezade committed
f0e4527
May 26, 2019
H
[FEATURE] Save a report about the found imports
hasherezade committed
4e46c4a
H
[FEATURE] Collect all the found IAT blocks in PeReconstructor
hasherezade committed
be30e26
H
[REFACT] Moved import_table_finder into separate files
hasherezade committed
c93a07d
H
[REFACT] Store the found IAT in a class
hasherezade committed
969ff9e
May 24, 2019
H
[FEATURE] Cleanup sections characteristics in an implanted payload
hasherezade committed
1e7affd
March 19, 2019
H
[BUGFIX] Scan all the possible IATs searching for the ImportTable (Issue #35)
hasherezade committed
5d72204
March 14, 2019
H
[BUGFIX] In case if raw alignment is invalid and virtual valid, try to
hasherezade committed
8fb7695
H
[FEATURE] Recognize if the sections header is damaged, attempt to remap
hasherezade committed
e5d20ba
H
[REFACT] Renamed a function.
hasherezade committed
231c5fd
H
[REFACT] Use function 'is_padding' from peconv namespace
hasherezade committed
6fb79d0
H
[REFACT] Modified displayed info about PE reconstruction
hasherezade committed
8e3c21f
H
[BUGFIX] Redundant use of shiftPeHeader
hasherezade committed
6dbee14
H
[REFACT] In PeReconstructor: store the original artefacts that stays
hasherezade committed
b0e512f
H
[FEATURE] In PeReconstructor: shift PE header to make space for DOS
hasherezade committed
42928e1
March 13, 2019
H
[BUGFIX] Ensure that found import descriptor is the first one (Issue #31)
hasherezade committed
5c5e14b