iMHLv2 3a85ac0226 get the gditimer owner information from the _HANDLEENTRY rather than the TYPE_TIMER object. the handle entry structure is more reliable since its consistent on all windows profiles of the same architecture, as opposed to the timer object which changes between xp, 2003, vista, and 7 etc

2012-09-07 14:47:11 +00:00

..

vtypes

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

__init__.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

atoms.py

on small and medium memory systems the atoms and atomscan plugins work great, however on large memory systems (i.e. 80 GB) there were some false positives showing up. this patch adds a filter that only displays string atoms (i.e. atoms with ID 0xC000 to 0xFFFF). this helps reduce false positives in the big memory systems without negatively affecting the small/medium systems

2012-09-06 15:06:19 +00:00

clipboard.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

constants.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

desktops.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

eventhooks.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

gahti.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

gditimers.py

get the gditimer owner information from the _HANDLEENTRY rather than the TYPE_TIMER object. the handle entry structure is more reliable since its consistent on all windows profiles of the same architecture, as opposed to the timer object which changes between xp, 2003, vista, and 7 etc

2012-09-07 14:47:11 +00:00

messagehooks.py

add a pair of offsets to messagehooks plugin for win 2008 r2 sp1 x64

2012-09-07 01:51:57 +00:00

screenshot.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

sessions.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

userhandles.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

win32k_core.py

in rare cases, the PE header of win32k.sys and several pages after it are not memory resident. this prevents the moddump-ing of win32k.sys but more importantly it prevents plugins such as clipboard, userhandles, eventhooks, and gditimers from working properly. they rely on parsing the PE header to find the .data and/or .rdata section in win32k.sys to then scan for critical structures in those sections. this patch adds a fallback mechanism to allow the mentioned plugins to work even if the PE header of win32k.sys is paged or corrupted by malware. it basically scans 5MB from the base of win32k.sys to find the structures

2012-09-07 03:19:27 +00:00

windows.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

windowstations.py

change the pool scanning check for window station objects - don't look in paged pools

2012-09-06 23:46:12 +00:00