 iMHLv2
|
10cd0e4f58
|
add a new set of message hook offsets for win32k.sys 5.1.2600.6149
|
2012-11-12 19:53:39 +00:00 |
|
|
mike.auty@gmail.com
|
518294754d
|
Merge 2.3-devel into trunk.
|
2012-10-13 21:31:29 +00:00 |
|
|
iMHLv2
|
be2b480c12
|
fix an ommission from r2604
|
2012-09-29 01:24:00 +00:00 |
|
|
iMHLv2
|
33f08f6422
|
ensure all win32k.sys plugins inherit from AbstractWindowsCommand instead of Command, so they don't show up in command listings when linux profiles are in use
|
2012-09-24 03:35:29 +00:00 |
|
|
iMHLv2
|
9dd3a3b256
|
add a new set of (_catomSysTableEntries, _aatomSysLoaded) offsets to messagehooks plugin
|
2012-09-08 22:50:42 +00:00 |
|
|
iMHLv2
|
9c73b18aed
|
small refactor to the _MM_SESSION_SPACE.find_shared_info() method, which allows us to find tagSHAREDINFO in the following conditions: 1) win32k.sys PE header is memory resident 2) win32k.sys PE header is not memory resident 3) win32k.sys PE header is memory resident but zeroed out or corrupted.
|
2012-09-08 21:41:00 +00:00 |
|
|
iMHLv2
|
3a85ac0226
|
get the gditimer owner information from the _HANDLEENTRY rather than the TYPE_TIMER object. the handle entry structure is more reliable since its consistent on all windows profiles of the same architecture, as opposed to the timer object which changes between xp, 2003, vista, and 7 etc
|
2012-09-07 14:47:11 +00:00 |
|
|
iMHLv2
|
21e2d7b022
|
in rare cases, the PE header of win32k.sys and several pages after it are not memory resident. this prevents the moddump-ing of win32k.sys but more importantly it prevents plugins such as clipboard, userhandles, eventhooks, and gditimers from working properly. they rely on parsing the PE header to find the .data and/or .rdata section in win32k.sys to then scan for critical structures in those sections. this patch adds a fallback mechanism to allow the mentioned plugins to work even if the PE header of win32k.sys is paged or corrupted by malware. it basically scans 5MB from the base of win32k.sys to find the structures
|
2012-09-07 03:19:27 +00:00 |
|
|
iMHLv2
|
7da0e55e66
|
add a pair of offsets to messagehooks plugin for win 2008 r2 sp1 x64
|
2012-09-07 01:51:57 +00:00 |
|
|
iMHLv2
|
9932a2ef54
|
change the pool scanning check for window station objects - don't look in paged pools
|
2012-09-06 23:46:12 +00:00 |
|
|
iMHLv2
|
99efb3f0f0
|
on small and medium memory systems the atoms and atomscan plugins work great, however on large memory systems (i.e. 80 GB) there were some false positives showing up. this patch adds a filter that only displays string atoms (i.e. atoms with ID 0xC000 to 0xFFFF). this helps reduce false positives in the big memory systems without negatively affecting the small/medium systems
|
2012-09-06 15:06:19 +00:00 |
|
|
iMHLv2
|
b0212e88dd
|
prevent exceptions when finding shared info structures in sessions that have since terminated
|
2012-09-06 05:36:10 +00:00 |
|
|
iMHLv2
|
bcc75b6e49
|
fix a typo in a win32k_core.py comment
|
2012-09-06 03:31:13 +00:00 |
|
|
iMHLv2
|
2aae4e00f3
|
add the win32k suite. reviewed and tested by gleeda, aw, and ikelos
|
2012-09-05 02:09:58 +00:00 |
|