 iMHLv2
|
e6ed7078f9
|
sync with r3581 of trunk
|
2014-01-17 14:21:55 -06:00 |
|
|
iMHLv2
|
575545220b
|
closes #1. patch imageinfo now that VolMagic.KDBG.v() returns an object rather than an offset
|
2013-10-10 00:58:25 -04:00 |
|
|
iMHLv2
|
f699e93a4f
|
sync with r3514
|
2013-10-08 01:04:26 -04:00 |
|
|
iMHLv2
|
d242168adb
|
initial commit of r3513 branch
|
2013-10-07 11:55:04 -04:00 |
|
|
awalters
|
4c7cc26502
|
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
|
2013-10-08 04:16:13 +00:00 |
|
|
iMHLv2
|
b0bd25c6c2
|
kdbgscan output is now pretty verbose, compared to the previous version which just output P and V offsets. this will help distinguish between FPs and also should contain the necessary fields for auto-selecting the profile when we get to that. reference: issue #268
|
2012-06-12 22:49:32 +00:00 |
|
|
mike.auty@gmail.com
|
63cd1962d0
|
Minor pylintage.
|
2012-06-10 11:51:02 +00:00 |
|
|
iMHLv2
|
69a9c1c56c
|
remove the temporary CPU number hack from imageinfo now that we have object classes for x86 and x64 KPCR
|
2012-06-05 21:36:17 +00:00 |
|
|
iMHLv2
|
02f0a22e37
|
imageinfo should acquire CPU count and service pack from KDBG, not process PEB. this is a more authoritative source and less likely to be paged. we can also now report the KPCR address for each CPU on multi-core systems instead of just one. Fixes Issue #267.
|
2012-06-05 19:59:46 +00:00 |
|
|
iMHLv2
|
878710f699
|
import kdbgscan as kdbgscan instead of as kdbg, so we can have a variable with the name kdbg. seems like this is better than importing as kdbg and then making a variable named kdbg_obj or something.
|
2012-06-05 16:54:36 +00:00 |
|
|
iMHLv2
|
780a503704
|
left-indent a big code block in imageinfo. finding KUSER_SHARED_DATA, service pack, and CPU count do not rely on finding KPCR, so they should not be inside the 'if kpcroffset' block
|
2012-06-05 16:50:27 +00:00 |
|
|
iMHLv2
|
e9435fab20
|
change how the PEB.CSDVersion string in imageinfo and the function name string in _LDR_DATA_TABLE_ENTRY.getprocaddress() are handled
|
2012-04-10 01:07:11 +00:00 |
|
|
mike.auty@gmail.com
|
5905d35820
|
Don't return multiple identical suggestions. Fixes issue 180.
|
2012-04-03 10:29:20 +00:00 |
|
|
mike.auty@gmail.com
|
e5aa86d908
|
Merge branch 'local/noregistry' into local/trunk
|
2012-03-08 23:39:19 +00:00 |
|
|
mike.auty@gmail.com
|
821130fb2e
|
Convert all *args to *args, **kwargs in __init__ functions.
|
2012-03-08 20:58:06 +00:00 |
|
|
mike.auty@gmail.com
|
b12ae5b0ad
|
Add in a convenience function for volatility magic to save scudette's fingers, and ensure we require valid arguments to the Object factory.
|
2011-10-01 16:19:51 +00:00 |
|
|
mike.auty@gmail.com
|
117e5b466a
|
Move the Volatility-1.4_rc1 branch over to trunk.
|
2011-06-29 21:01:19 +00:00 |
|