Michael Ligh b3db0ccc83 Broaden the conditions under which we skip duplicate PTE entries in the get_available_pages API. It used to apply only to 64-bit Windows 10, but we've started seeing similar entries on Windows 8 / Server 2012.

2017-07-11 13:37:57 -05:00

..

__init__.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

amd64.py

Broaden the conditions under which we skip duplicate PTE entries in the get_available_pages API. It used to apply only to 64-bit Windows 10, but we've started seeing similar entries on Windows 8 / Server 2012.

2017-07-11 13:37:57 -05:00

arm.py

update some pydocs

2015-10-14 10:27:14 -05:00

crash.py

Add very minor optimizations of not reconstructing the long/longlong structures on each read, as suggested by bcostanzo in pull request #88.

2014-11-25 17:27:48 +00:00

crashbmp.py

removing hard tabs

2015-01-27 16:31:21 -05:00

elfcoredump.py

handle more recent versions of virtual box ELF core dumps

2016-10-13 08:21:00 -05:00

hibernate.py

add an assertion to the hiber AS to make sure the first table page is <= 10. this prevents volatility from going off the deep end when an incorrect profile is supplied (i.e. WinXP instead of Win7 or vice versa)

2016-08-20 16:53:41 -05:00

hpak.py

better fixes to the hpak extract / decompress function

2014-06-16 12:27:31 -05:00

ieee1394.py

sync with r3581 of trunk

2014-01-17 14:21:55 -06:00

intel.py

Add APIs to paged address spaces (Intel x86 and AMD64 so far) to allow easy lookups of PTE flags.

2016-01-11 09:01:09 -05:00

lime.py

these address spaces don't need to define self.runs, that is done in AbstractRunBasedMemory

2014-09-18 00:55:19 -05:00

macho.py

Mac - remove macho vtype info from macho address space file

2014-04-25 22:42:55 -05:00

osxpmemelf.py

fix linux elf AS to not falsely trigger - by asserting on the number of runs

2014-10-14 13:52:22 -05:00

paged.py

Add APIs to paged address spaces (Intel x86 and AMD64 so far) to allow easy lookups of PTE flags.

2016-01-11 09:01:09 -05:00

standard.py

Add very minor optimizations of not reconstructing the long/longlong structures on each read, as suggested by bcostanzo in pull request #88.

2014-11-25 17:27:48 +00:00

vmem.py

fixing address

2015-06-29 14:29:17 -04:00

vmware.py

closes #9 remove the CR dependency on vmware metadata files

2014-06-19 16:45:44 -05:00