iMHLv2 f606ffd282 add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369

2013-02-20 02:56:19 +00:00

..

vtypes

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

__init__.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

atoms.py

fix an ommission from r2604

2012-09-29 01:24:00 +00:00

clipboard.py

ensure all win32k.sys plugins inherit from AbstractWindowsCommand instead of Command, so they don't show up in command listings when linux profiles are in use

2012-09-24 03:35:29 +00:00

constants.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

desktops.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

eventhooks.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

gahti.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

gditimers.py

gditimers - get the process info from the object handle header if available, otherwise from the timer object itself. spotted by Bartosz Inglot

2013-02-19 15:59:16 +00:00

messagehooks.py

add a new set of message hook offsets for win32k.sys 5.1.2600.6149

2012-11-12 19:53:39 +00:00

screenshot.py

Merge 2.3-devel into trunk.

2012-10-13 21:31:29 +00:00

sessions.py

add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369

2013-02-20 02:56:19 +00:00

userhandles.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

win32k_core.py

small refactor to the _MM_SESSION_SPACE.find_shared_info() method, which allows us to find tagSHAREDINFO in the following conditions: 1) win32k.sys PE header is memory resident 2) win32k.sys PE header is not memory resident 3) win32k.sys PE header is memory resident but zeroed out or corrupted.

2012-09-08 21:41:00 +00:00

windows.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

windowstations.py

change the pool scanning check for window station objects - don't look in paged pools

2012-09-06 23:46:12 +00:00