 mike.auty@gmail.com
|
54a987d2cd
|
Remove VolatilityMagic for HiveListOffset and HiveListPoolSize, since these can be calculated from the profiles directly.
|
2012-01-18 12:42:35 +00:00 |
|
|
mike.auty@gmail.com
|
4f9f56a29b
|
Ensure pointer64s are treated like pointers on 64-bit systems.
|
2012-01-16 00:14:06 +00:00 |
|
|
mike.auty@gmail.com
|
211c849ee1
|
Rename x86 windows profile to allow for x64 profile.
|
2012-01-15 01:29:36 +00:00 |
|
|
mike.auty@gmail.com
|
5a2850f48c
|
Fix up poor naming of the native types.
|
2012-01-15 01:29:23 +00:00 |
|
|
mike.auty@gmail.com
|
aa32dfb813
|
Add in generated vtypes for the x64 profiles.
|
2012-01-13 23:54:21 +00:00 |
|
|
mike.auty@gmail.com
|
74337956a9
|
Ensure SSDT only runs on profiles that work correctly.
|
2012-01-13 23:43:01 +00:00 |
|
|
iMHLv2
|
7a79d98fa8
|
add textual vad protection and vad type output to vadinfo. Fixes Issue #143
|
2012-01-11 19:49:27 +00:00 |
|
|
iMHLv2
|
8a16c16f37
|
removed vad flag overlays from profiles. updated vadinfo to use new object classes instead of overlays. Fixes Issue #144
|
2012-01-11 14:42:35 +00:00 |
|
|
iMHLv2
|
564241eb42
|
add comments/descriptions to new vad flag classes
|
2012-01-11 14:35:30 +00:00 |
|
|
iMHLv2
|
a76f132337
|
add object classes for MMVAD_FLAGS, MMVAD_FLAGS2, and MMSECTION_FLAGS (see Issue #144)
|
2012-01-11 14:33:05 +00:00 |
|
|
iMHLv2
|
c6f7b16b9e
|
remove unused column header in VADWalk
|
2012-01-10 03:19:07 +00:00 |
|
|
iMHLv2
|
43c92ba70d
|
add better description of CA Flags to distinguish it from other Vad Flags
|
2012-01-10 03:18:17 +00:00 |
|
|
iMHLv2
|
02a1cddf7a
|
fix a bad format() bug in obj.py when instantiating NoneObject
|
2012-01-09 04:11:31 +00:00 |
|
|
mike.auty@gmail.com
|
a9107db1b4
|
Add in 64-bit address space support.
|
2012-01-04 22:22:54 +00:00 |
|
|
mike.auty@gmail.com
|
2042fe7051
|
Add in 64-bit native types.
|
2012-01-04 20:56:24 +00:00 |
|
|
mike.auty@gmail.com
|
c71e3b7be4
|
Add in a default memory_model for profiles.
|
2012-01-04 20:53:20 +00:00 |
|
|
mike.auty@gmail.com
|
9100a60394
|
Flip the level mask, and minor style change.
|
2012-01-02 17:44:41 +00:00 |
|
|
mike.auty@gmail.com
|
7b22e259c2
|
Not sure how this crept bad in, looks like I made a bad commit.
|
2012-01-02 17:40:46 +00:00 |
|
|
mike.auty@gmail.com
|
80e44ca5b0
|
Add in pool alignment changes for future profile types.
|
2012-01-02 14:19:36 +00:00 |
|
|
mike.auty@gmail.com
|
e984ae4fbd
|
Add in SSDT warning message if we don't find any entries.
|
2012-01-02 14:19:29 +00:00 |
|
|
mike.auty@gmail.com
|
789041b563
|
Ensure MMVAD's based on NULL pointers don't throw a pointless warning.
|
2012-01-01 01:45:46 +00:00 |
|
|
mike.auty@gmail.com
|
4bd5bab0e1
|
Since dereferencing may be using a different AS now (native_vm), we should check that the offset's valid.
|
2012-01-01 01:19:22 +00:00 |
|
|
mike.auty@gmail.com
|
16926baa29
|
Ensure we don't let a bad MMVAD tag slip through as an MMVAD_LONG.
|
2012-01-01 01:19:17 +00:00 |
|
|
mike.auty@gmail.com
|
602353c533
|
Consolidate the dereference_as functions, and pylint one line.
|
2012-01-01 01:19:11 +00:00 |
|
|
mike.auty@gmail.com
|
c78301f2b9
|
Ensure that the _EPROCESS vm was found before we even try to instantiate an _MMVAD_LONG on it.
|
2012-01-01 01:19:00 +00:00 |
|
|
iMHLv2
|
1e251672b9
|
create an object class for _CM_KEY_BODY and remove the full_key_name function from handles plugin
|
2011-12-31 23:13:48 +00:00 |
|
|
iMHLv2
|
52270b151d
|
patch from ikelos so that TCP_OBJECT and ADDRESS_OBJECT use standard overlays instead of defining specific overlay classes for each
|
2011-12-31 21:37:22 +00:00 |
|
|
iMHLv2
|
a3c9edee17
|
s/h/handle/g and s/otype/object_type/g for readability in handles.py
|
2011-12-31 21:24:48 +00:00 |
|
|
iMHLv2
|
24238f549d
|
modify handles plugin to use _OBJECT_HEADER.dereference_as
|
2011-12-31 21:22:03 +00:00 |
|
|
iMHLv2
|
3eb31d2bba
|
add _OBJECT_HEADER.dereference_as to instantiate objects of the given type from _OBJECT_HEADER.Body offset
|
2011-12-31 21:16:11 +00:00 |
|
|
iMHLv2
|
ba336a41ff
|
remove the set_native_vm(kernel_as) call in handles plugin...objects already have a native_vm set
|
2011-12-31 21:14:16 +00:00 |
|
|
iMHLv2
|
e0f2d454e5
|
add back the parent argument to _EX_FAST_REF
|
2011-12-31 21:12:30 +00:00 |
|
|
iMHLv2
|
9f7f1696ea
|
remove extraneous import statement from handles.py
|
2011-12-31 21:09:18 +00:00 |
|
|
iMHLv2
|
40f2f32195
|
add GrantedAccess property to _OBJECT_HEADER, treat _HANDLE_TABLE_ENTRY.Object as _EX_FAST_REF, modify _EX_FAST_REF.dereference_as to accept kwargs
|
2011-12-31 06:51:47 +00:00 |
|
|
mike.auty@gmail.com
|
ed1b006486
|
Ensure psscan creates objects that can dereference properly.
|
2011-12-31 01:10:03 +00:00 |
|
|
iMHLv2
|
417eda2e5d
|
Handles doesn't need to inherit from FileScan now that parse_string is gone
|
2011-12-30 22:22:37 +00:00 |
|
|
iMHLv2
|
17773d1b74
|
fix a bug in the vad factory always returning _MMVAD_LONG even for VadS tags
|
2011-12-30 19:53:46 +00:00 |
|
|
mike.auty@gmail.com
|
5c78c0b08e
|
Port across the Vad Tag handling from the win64-support branch.
|
2011-12-30 15:56:43 +00:00 |
|
|
mike.auty@gmail.com
|
a2771c5e4c
|
Rename nativevm to native_vm to improve readability and fix muscle-memory typos.
|
2011-12-30 15:37:51 +00:00 |
|
|
mike.auty@gmail.com
|
5df2c5efaa
|
Change del to pop to ensure we don't error out if for some reason we're not given CType initalizers.
|
2011-12-30 15:22:23 +00:00 |
|
|
mike.auty@gmail.com
|
13a0b18f28
|
Fix up _MMVAD object creation due to kwargs being passed in obj.Object to types.
|
2011-12-30 13:14:47 +00:00 |
|
|
iMHLv2
|
02e9909efe
|
dereference _OBJECT_TYPE.Type in virtual space (obj_nativevm) instead of physcal space
|
2011-12-30 03:37:21 +00:00 |
|
|
mike.auty@gmail.com
|
1a567aa284
|
Fix typo made in the recent nativevm patch.
|
2011-12-29 19:52:35 +00:00 |
|
|
mike.auty@gmail.com
|
7df6910986
|
Move across the obj.py changes that didn't make it from the svn rebase.
|
2011-12-29 13:50:11 +00:00 |
|
|
mike.auty@gmail.com
|
70c19885bb
|
Add in repr wrappers around all the Unicode names pulled out of handles.
|
2011-12-29 13:36:06 +00:00 |
|
|
mike.auty@gmail.com
|
40ad0e59ae
|
Convert _vol_offsetlayer into obj_nativevm.
|
2011-12-29 13:35:59 +00:00 |
|
|
mike.auty@gmail.com
|
2fb6964c9a
|
Change module scanning plugins to eliminate parse_string.
|
2011-12-29 13:35:51 +00:00 |
|
|
mike.auty@gmail.com
|
c318153737
|
Add in the all-important proper VM for dereferencing as a different type.
|
2011-12-29 13:35:43 +00:00 |
|
|
mike.auty@gmail.com
|
f95a6644b5
|
Fix up EX_FAST_REF to use the highest VM available.
|
2011-12-29 13:35:38 +00:00 |
|
|
mike.auty@gmail.com
|
0129921aa8
|
Add in changes to the object model to support higher level VMs, with lower level offsets.
|
2011-12-29 13:35:31 +00:00 |
|