iMHLv2 75b936a40d threads plugin doesn't print _KTRAP_FRAME.SegFs, now it does. spotted by carl pulley. fixes issue #395

2013-03-29 12:05:15 +00:00

..

__init__.py

make a future home for malware plugins in volatility/plugins/malware

2012-03-08 19:25:21 +00:00

apihooks.py

fix a small issue with the disassembly printed by apihooks for NT syscall type hooks. it assumes the system call is done with CALL [EDX] but it is sometimes done with CALL EDX (no deref)

2013-03-08 06:38:07 +00:00

callbacks.py

add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369

2013-02-20 02:56:19 +00:00

cmdhistory.py

fix the source and target length calculations for aliases in cmdscan/consoles plugins. the length is total bytes of the unicode string (not characters), and the string is not null terminated

2013-02-13 15:57:39 +00:00

devicetree.py

add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369

2013-02-20 02:56:19 +00:00

idt.py

rework the detection of idt hooks using gdt selectors. ignore gdt entries that aren't for code segments

2013-03-25 17:46:53 +00:00

impscan.py

the --pid parameter to impscan should be an integer (comma separated strings are not accepted)

2012-11-23 16:32:11 +00:00

malfind.py

add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369

2013-02-20 02:56:19 +00:00

psxview.py

fix a typo in psxview column headers s/pspcdid/pspcid/

2012-10-30 20:22:22 +00:00

svcscan.py

bring back the render_dot function for svcscan to find unlinked service records on xp/2003 images

2012-11-22 18:04:20 +00:00

threads.py

threads plugin doesn't print _KTRAP_FRAME.SegFs, now it does. spotted by carl pulley. fixes issue #395

2013-03-29 12:05:15 +00:00

timers.py

add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369

2013-02-20 02:56:19 +00:00