iMHLv2 02e9909efe dereference _OBJECT_TYPE.Type in virtual space (obj_nativevm) instead of physcal space

2011-12-30 03:37:21 +00:00

..

addrspaces

Apply the IOError exception catching in a few more places.

2011-12-19 23:02:18 +00:00

overlays

dereference _OBJECT_TYPE.Type in virtual space (obj_nativevm) instead of physcal space

2011-12-30 03:37:21 +00:00

registry

Add in a convenience function for volatility magic to save scudette's fingers, and ensure we require valid arguments to the Object factory.

2011-10-01 16:19:51 +00:00

__init__.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

bioskbd.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

common.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

connections.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

connscan.py

Changed all scanner headers from "Offset" to "Offset(P)" and committing MHL's SymLinkScan. Fixes issue 136.

2011-09-15 14:03:56 +00:00

crashinfo.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

dlldump.py

allow dlldump to work on PE's not in the PEB list. remove try/except block from moddump. Fixes Issue #109

2011-11-30 18:25:17 +00:00

fileparam.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

filescan.py

Add in repr wrappers around all the Unicode names pulled out of handles.

2011-12-29 13:36:06 +00:00

getsids.py

added two more known sids (http://support.microsoft.com/kb/956572)

2011-09-02 21:40:38 +00:00

handles.py

Add in repr wrappers around all the Unicode names pulled out of handles.

2011-12-29 13:36:06 +00:00

hibinfo.py

Remove hibdump in favour of the generic imagecopy plugin.

2011-07-27 22:07:01 +00:00

imagecopy.py

Allow overwriting of empty files using imagecopy.

2011-11-25 08:33:13 +00:00

imageinfo.py

Add in a convenience function for volatility magic to save scudette's fingers, and ensure we require valid arguments to the Object factory.

2011-10-01 16:19:51 +00:00

kdbgscan.py

Add in a convenience function for volatility magic to save scudette's fingers, and ensure we require valid arguments to the Object factory.

2011-10-01 16:19:51 +00:00

kpcrscan.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

moddump.py

allow dlldump to work on PE's not in the PEB list. remove try/except block from moddump. Fixes Issue #109

2011-11-30 18:25:17 +00:00

modscan.py

Add in repr wrappers around all the Unicode names pulled out of handles.

2011-12-29 13:36:06 +00:00

modules.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

netscan.py

Changed all scanner headers from "Offset" to "Offset(P)" and committing MHL's SymLinkScan. Fixes issue 136.

2011-09-15 14:03:56 +00:00

patcher.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

procdump.py

create object classes for PE header structs, add sanity checks for MZ and PE signatures. Fixes Issue #155

2011-10-27 23:41:33 +00:00

pstree.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

sockets.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

sockscan.py

Changed all scanner headers from "Offset" to "Offset(P)" and committing MHL's SymLinkScan. Fixes issue 136.

2011-09-15 14:03:56 +00:00

ssdt.py

move find_space to win32.tasks and extend _EPROCESS for DLL listings. Fixes Issue #160

2011-10-26 20:10:43 +00:00

strings.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

taskmods.py

move find_space to win32.tasks and extend _EPROCESS for DLL listings. Fixes Issue #160

2011-10-26 20:10:43 +00:00

unittests.py

Move the Volatility-1.4_rc1 branch over to trunk.

2011-06-29 21:01:19 +00:00

userassist.py

userassist: replaced old hexdump function w/new one

2011-09-09 14:49:31 +00:00

vadinfo.py

dont print the ControlArea for VADs marked private, the CA is only valid for shared memory. Fixes Issue #164

2011-12-15 21:53:26 +00:00

volshell.py

allow volshell's dt() to accept an address space, handle callable offsets/members. Fixes Issue #172

2011-12-14 21:30:57 +00:00