 gleeda
|
401f6e8f8e
|
converted idt and gdt
Note: binary data is left out for now in VERBOSE mode
|
2014-12-05 11:33:38 -05:00 |
|
|
iMHLv2
|
70374eedf1
|
distinguish unused (null) IDT entries from used entries that point to unknown modules (per Frank Boldewin)
|
2014-11-15 13:03:41 -06:00 |
|
|
iMHLv2
|
566521e151
|
closes #4 add default arg parameters to get_image and get_sections
|
2014-06-19 18:58:25 -05:00 |
|
|
iMHLv2
|
e6ed7078f9
|
sync with r3581 of trunk
|
2014-01-17 14:21:55 -06:00 |
|
|
iMHLv2
|
f699e93a4f
|
sync with r3514
|
2013-10-08 01:04:26 -04:00 |
|
|
iMHLv2
|
d242168adb
|
initial commit of r3513 branch
|
2013-10-07 11:55:04 -04:00 |
|
|
awalters
|
4c7cc26502
|
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
|
2013-10-08 04:16:13 +00:00 |
|
|
iMHLv2
|
1c6743f165
|
rework the detection of idt hooks using gdt selectors. ignore gdt entries that aren't for code segments
|
2013-03-25 17:46:53 +00:00 |
|
|
iMHLv2
|
a1880c0b3c
|
change the idt plugin to print the selector column as hex to match with the gdt selector output
|
2013-03-25 17:21:45 +00:00 |
|
|
iMHLv2
|
f606ffd282
|
add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369
|
2013-02-20 02:56:19 +00:00 |
|
|
iMHLv2
|
9d881ed2b0
|
a bug in the idt plugin prevented it from displaying the right interrupt handler address when special gdt selectors are set
|
2012-11-22 02:55:52 +00:00 |
|
|
iMHLv2
|
a2d21d59ef
|
make better use of Plugin.is_valid_profile for blacklisting commands on unsupported profiles. a general, but consistent message is reported to the user 'This command does not support the selected profile'.
|
2012-07-10 14:11:47 +00:00 |
|
|
mike.auty@gmail.com
|
33cbf31032
|
Apply SanityCheckExceptions that can be disabled/ignored using the --unsafe/-u flag. Fixes issue 243.
|
2012-07-07 19:19:58 +00:00 |
|
|
iMHLv2
|
74c678989a
|
the Limit column of GDT plugin should be addrpad
|
2012-06-25 20:39:38 +00:00 |
|
|
iMHLv2
|
b0fc9fab2e
|
fix a bitmasking issue with GDT 32-bit callgate address calculation. also make the Limit field for callgates 0 instead of a dash or it'll encounter a formatting bug when trying to print as hex
|
2012-06-25 19:18:14 +00:00 |
|
|
iMHLv2
|
143e73a47d
|
the gdt selector column should be displayed as hex
|
2012-06-25 18:57:13 +00:00 |
|
|
iMHLv2
|
5a719d134d
|
bring back two components of the idt plugin output which was present in 2.0: print the PE section name of the IDT function and allow disasm of code when --verbose is enabled
|
2012-06-25 18:43:02 +00:00 |
|
|
iMHLv2
|
ed22db8c61
|
per request, avoid changing the number of variables yielded by IDT.calculate() and GDT.calculate() just to access the associated KPCRs. instead access the KPCR using the IDT or GDT entry's obj_parent
|
2012-06-12 14:07:40 +00:00 |
|
|
iMHLv2
|
f23dfc8f5b
|
when calculating the IDT for each CPU, make sure we use the GDT entries from the same CPU
|
2012-06-12 13:52:18 +00:00 |
|
|
iMHLv2
|
abf1668d84
|
per request, move the KPCR object classes from malware/idt.py to windows/overlays/kpcr_vtypes.py (since they aren't malware specific)
|
2012-06-12 13:45:01 +00:00 |
|
|
iMHLv2
|
05c3c015bb
|
leverage the new KDBG.kpcrs() to iterate quickly through all KPCRs in a memory dump. this allows us to display IDT, GDT, and Timers per-processor without relying on kpcrscan which is way too slow to actually be useful
|
2012-06-05 21:58:24 +00:00 |
|
|
iMHLv2
|
b754e88e4a
|
document our backup method of finding KDBG via KPCR. use object classes w/ inheritance to clearly indicate that finding KDBG via KPCR will not work on x64.
|
2012-06-05 21:21:51 +00:00 |
|
|
mike.auty@gmail.com
|
16d9bf8072
|
Reformat idt plugin output.
|
2012-06-03 16:04:58 +00:00 |
|
|
mike.auty@gmail.com
|
b2b3464334
|
Reformat gdt plugin output.
|
2012-06-03 15:45:45 +00:00 |
|
|
mike.auty@gmail.com
|
3241df1a19
|
Add in profile checks for some malware plugins.
|
2012-05-22 07:31:04 +00:00 |
|
|
mike.auty@gmail.com
|
4f6681a14d
|
Apply basic windows restrictions to most windows plugins.
|
2012-05-18 09:53:27 +00:00 |
|
|
mike.auty@gmail.com
|
5cb4ab5dda
|
Fix up a large number of very minor pylint/indentation/trailing space issues across the tree.
|
2012-05-14 23:06:56 +00:00 |
|
|
mike.auty@gmail.com
|
f3c28c098a
|
Pylint some files.
|
2012-04-30 11:56:50 +00:00 |
|
|
iMHLv2
|
4e3afdbdcc
|
remove unused interrupt lookup table from idt.py
|
2012-04-06 20:40:20 +00:00 |
|
|
iMHLv2
|
f1a17ed17f
|
add idt and gdt plugins for x86. support for x64 is planned but not a big priority, given the discounted role that the descriptor tables play on x64 systems.
|
2012-04-06 20:38:00 +00:00 |
|