iMHLv2 047ee58491 refs #147 fix apihooks unicode error in 2.4.1

2014-12-04 12:38:12 -06:00

..

__init__.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

crash_vtypes.py

sync with 2.3.1 from trunk

2013-10-31 11:06:08 -04:00

hibernate_vtypes.py

sync with 2.3.1 from trunk

2013-10-31 11:06:08 -04:00

kdbg_vtypes.py

update timers plugin to work on 64-bit windows (requires pointer decode with patch guard magic)

2014-03-30 11:11:37 +02:00

kpcr_vtypes.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

pe_vtypes.py

refs #147 fix apihooks unicode error in 2.4.1

2014-12-04 12:38:12 -06:00

ssdt_vtypes.py

implementing windows 8.1 and server 2012 R2

2013-11-01 01:14:25 -04:00

tcpip_vtypes.py

fixes #29 add support for win8/8.1/2012/2012 both 32 and 64 bit TCP/UDP activity

2014-07-21 12:36:30 -05:00

vad_vtypes.py

refs #58 miscalculation in VAD is_valid check

2014-07-30 23:47:53 -05:00

vista_sp0_x64_syscalls.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

vista_sp0_x64_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

vista_sp0_x86_syscalls.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

vista_sp0_x86_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

vista_sp1_x64_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

vista_sp1_x86_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

vista_sp2_x64_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

vista_sp2_x86_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

vista_sp12_x64_syscalls.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

vista_sp12_x86_syscalls.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

vista.py

adding fixes for lsadump and cachedump

2014-01-19 09:14:09 -05:00

win7_sp0_x64_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

win7_sp0_x86_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

win7_sp1_x64_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

win7_sp1_x86_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

win7_sp01_x64_syscalls.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

win7_sp01_x86_syscalls.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

win7.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

win8_kdbg.py

handle memdumps from tools that decode KDBG on win8/2012 x64 but leave KdpDataBlockEncoded==1

2014-07-17 12:40:38 -05:00

win8_sp0_x64_syscalls.py

normalizing line endings for LF

2013-10-07 18:31:53 -04:00

win8_sp0_x64_vtypes.py

add the win8 and server2012 vtypes and syscalls

2013-10-07 12:00:26 -04:00

win8_sp0_x86_syscalls.py

implementing windows 8.1 and server 2012 R2

2013-11-01 01:14:25 -04:00

win8_sp0_x86_vtypes.py

add the win8 and server2012 vtypes and syscalls

2013-10-07 12:00:26 -04:00

win8_sp1_x64_syscalls.py

implementing windows 8.1 and server 2012 R2

2013-11-01 01:14:25 -04:00

win8_sp1_x64_vtypes.py

add vtypes for 8.1 32 and 8.1/2012R2 64-bit

2013-10-31 10:52:58 -04:00

win8_sp1_x86_syscalls.py

implementing windows 8.1 and server 2012 R2

2013-11-01 01:14:25 -04:00

win8_sp1_x86_vtypes.py

add vtypes for 8.1 32 and 8.1/2012R2 64-bit

2013-10-31 10:52:58 -04:00

win8.py

update win8 profile descriptions

2014-09-12 11:14:44 -05:00

win2003_sp0_x86_syscalls.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

win2003_sp0_x86_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

win2003_sp1_x64_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

win2003_sp1_x86_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

win2003_sp2_x64_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

win2003_sp2_x86_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

win2003_sp12_x64_syscalls.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

win2003_sp12_x86_syscalls.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

win2003.py

changing email

2014-07-08 18:36:25 -04:00

windows64.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

windows.py

move VolatilityMaxAddress to a basic type so its accessible to mac/linux profiles

2014-09-08 13:57:44 -05:00

xp_sp2_x86_syscalls.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

xp_sp2_x86_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

xp_sp3_x86_vtypes.py

Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype.

2012-03-15 22:35:56 +00:00

xp.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00