 iMHLv2
|
d43fdcd9ff
|
refs #83 fix threads plugin when invalid offsets are supplied
|
2014-09-03 13:35:12 -05:00 |
|
|
iMHLv2
|
e916f99e57
|
fix the threads plugin to properly follow the --offset option
|
2014-06-27 19:44:32 -04:00 |
|
|
iMHLv2
|
e6ed7078f9
|
sync with r3581 of trunk
|
2014-01-17 14:21:55 -06:00 |
|
|
iMHLv2
|
f699e93a4f
|
sync with r3514
|
2013-10-08 01:04:26 -04:00 |
|
|
iMHLv2
|
d242168adb
|
initial commit of r3513 branch
|
2013-10-07 11:55:04 -04:00 |
|
|
awalters
|
4c7cc26502
|
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
|
2013-10-08 04:16:13 +00:00 |
|
|
iMHLv2
|
3d94977317
|
remove an unnecessary for loop in threads plugin. spotted by carl pulley. fixes issue #406
|
2013-04-12 04:11:54 +00:00 |
|
|
iMHLv2
|
c10d655e45
|
for plugins that have a soft dependency on distorm3 (i.e. they work without the library, but could work better with it) use debug.warning() to notify the user that experiences could be more positive with the module installed. fixes issue #396
|
2013-04-09 14:34:13 +00:00 |
|
|
iMHLv2
|
bfce17f9e9
|
move the thread starting address module resolution code from threads.render_text() into threads.calculate(). this is work that should by design be done in calculate() instead. also, it allows us to track which processes we've already enumerated dlls for, so we don't parse the same lists twice++
|
2013-04-02 12:41:59 +00:00 |
|
|
iMHLv2
|
75b936a40d
|
threads plugin doesn't print _KTRAP_FRAME.SegFs, now it does. spotted by carl pulley. fixes issue #395
|
2013-03-29 12:05:15 +00:00 |
|
|
iMHLv2
|
75ccdf6c9e
|
not all threads that start in kernel mode are 'system' threads, so change the way we look up the owning module's name to just check if the start address is above MmSystemRangeStart
|
2013-03-27 16:51:09 +00:00 |
|
|
iMHLv2
|
6f7a9682b9
|
make sure to disassemble thread starting addresses in 32 or 64 bit according to the profile
|
2013-03-27 15:53:36 +00:00 |
|
|
iMHLv2
|
623006f870
|
use a process AS to disassemble threads starting address. fixes issue #391
|
2013-03-25 15:55:23 +00:00 |
|
|
iMHLv2
|
1394f9a72f
|
fix a bug in the threads plugin...a typo introduced with the new address space pointer masking. spotted by Wyatt Roersma
|
2013-02-22 16:38:37 +00:00 |
|
|
iMHLv2
|
f606ffd282
|
add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369
|
2013-02-20 02:56:19 +00:00 |
|
|
iMHLv2
|
4b0de7aa9a
|
add proper spacing to registers in threads output. fixes issue #348
|
2012-09-17 16:51:25 +00:00 |
|
|
mike.auty@gmail.com
|
a51f61a44f
|
Fix a typo/bug in the recent malware threads plugin.
|
2012-05-14 23:07:20 +00:00 |
|
|
mike.auty@gmail.com
|
5cb4ab5dda
|
Fix up a large number of very minor pylint/indentation/trailing space issues across the tree.
|
2012-05-14 23:06:56 +00:00 |
|
|
iMHLv2
|
fc33d7dcce
|
add threads plugin. fixes issue #249
|
2012-05-08 15:53:02 +00:00 |
|