iMHLv2 680d676e49 use distorm3's DecomposeGenerator instead of Decompose, otherwise large amounts of memory can be consumed when data is all decomposed at once. fixes issue #400 reported by carl pulley

2013-04-03 16:25:48 +00:00

..

__init__.py

make a future home for malware plugins in volatility/plugins/malware

2012-03-08 19:25:21 +00:00

apihooks.py

use distorm3's DecomposeGenerator instead of Decompose, otherwise large amounts of memory can be consumed when data is all decomposed at once. fixes issue #400 reported by carl pulley

2013-04-03 16:25:48 +00:00

callbacks.py

add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369

2013-02-20 02:56:19 +00:00

cmdhistory.py

fix the source and target length calculations for aliases in cmdscan/consoles plugins. the length is total bytes of the unicode string (not characters), and the string is not null terminated

2013-02-13 15:57:39 +00:00

devicetree.py

add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369

2013-02-20 02:56:19 +00:00

idt.py

rework the detection of idt hooks using gdt selectors. ignore gdt entries that aren't for code segments

2013-03-25 17:46:53 +00:00

impscan.py

use distorm3's DecomposeGenerator instead of Decompose, otherwise large amounts of memory can be consumed when data is all decomposed at once. fixes issue #400 reported by carl pulley

2013-04-03 16:25:48 +00:00

malfind.py

add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369

2013-02-20 02:56:19 +00:00

psxview.py

fix a typo in psxview column headers s/pspcdid/pspcid/

2012-10-30 20:22:22 +00:00

svcscan.py

bring back the render_dot function for svcscan to find unlinked service records on xp/2003 images

2012-11-22 18:04:20 +00:00

threads.py

move the thread starting address module resolution code from threads.render_text() into threads.calculate(). this is work that should by design be done in calculate() instead. also, it allows us to track which processes we've already enumerated dlls for, so we don't parse the same lists twice++

2013-04-02 12:41:59 +00:00

timers.py

add API functions to the address space for pointer masking. this is in favor of doing the bit mask in Pointer.__eq__ and Pointer.v() which is how volatility 2.2 did it. fixes issue #369

2013-02-20 02:56:19 +00:00