8e56052f1d
refs #74 enhance kdbgscan performance for win8/2012 x64
...
traditionally, kdbgscan has been used for two reasons: to determine a
suggested profile or to gather information used to speed up other
plugins. this patch optimizes kdbgscan when its used for the later
purpose. specifically, when you call kdbgscan with —profile (thus you
must already know its win8/2012 x64), it will skip the typical
signature-based KDBG scan. this reduced wyatt’s execution time from 30
minutes to 6 minutes on a 140 GB dump.
2014-08-18 19:23:49 -05:00
0c5a683549
refs #12 fixing the --kdbg parameter on win8/2012 x64
2014-01-27 16:02:14 -06:00
b23cf5b657
add the win8/2012 x64 kdbg values for block_encoded, wait_never, and wait_always to the output of kdbgscan
2014-01-27 15:20:05 -06:00
6d862c2eff
refs #9 fixing kdbgscan and image info on x64 windows 8 and 2012
...
all pointers off KDBG should be dereferenced in the native VM (kernel
AS), because in some cases the KDBG will be instantiated from a
BufferAddressSpace
2014-01-27 15:02:43 -06:00
e6ed7078f9
sync with r3581 of trunk
2014-01-17 14:21:55 -06:00
f699e93a4f
sync with r3514
2013-10-08 01:04:26 -04:00
d242168adb
initial commit of r3513 branch
2013-10-07 11:55:04 -04:00
4c7cc26502
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
2013-10-08 04:16:13 +00:00
799ad8149c
Ensure that kdbgscan ignores non-windows profiles.
2012-08-19 10:16:20 +00:00
33cbf31032
Apply SanityCheckExceptions that can be disabled/ignored using the --unsafe/-u flag. Fixes issue 243.
2012-07-07 19:19:58 +00:00
fd035d1677
fix a bug from r1866 when kdbgscan is used with no profile
2012-06-13 15:00:37 +00:00
b0bd25c6c2
kdbgscan output is now pretty verbose, compared to the previous version which just output P and V offsets. this will help distinguish between FPs and also should contain the necessary fields for auto-selecting the profile when we get to that. reference: issue #268
2012-06-12 22:49:32 +00:00
4f6681a14d
Apply basic windows restrictions to most windows plugins.
2012-05-18 09:53:27 +00:00
3ec9fbc7f7
Improve KDBG performance.
2012-04-14 13:47:11 +00:00
02a8380f71
Remove while 1 loop from scanning code.
2012-04-06 22:30:26 +00:00
e5aa86d908
Merge branch 'local/noregistry' into local/trunk
2012-03-08 23:39:19 +00:00
beb854441f
Remove unnecessary comments from kdbgscan.
2012-02-26 22:55:03 +00:00
d649b5b9b0
Fix inconsistency in commands.command class capitalization.
2012-02-05 23:36:33 +00:00
db4eb63085
Fix up docstring for MultiStringFinderCheck.
2012-02-04 11:32:18 +00:00
64d61dae50
Now that we have 64-bit profiles for everything, get rid of the additional suggestions in kdbgscan. Fixes issue 185.
2012-01-22 09:54:15 +00:00
b12ae5b0ad
Add in a convenience function for volatility magic to save scudette's fingers, and ensure we require valid arguments to the Object factory.
2011-10-01 16:19:51 +00:00
117e5b466a
Move the Volatility-1.4_rc1 branch over to trunk.
2011-06-29 21:01:19 +00:00
iMHLv2