iMHLv2 9dd3a3b256 add a new set of (_catomSysTableEntries, _aatomSysLoaded) offsets to messagehooks plugin

2012-09-08 22:50:42 +00:00

..

vtypes

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

__init__.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

atoms.py

on small and medium memory systems the atoms and atomscan plugins work great, however on large memory systems (i.e. 80 GB) there were some false positives showing up. this patch adds a filter that only displays string atoms (i.e. atoms with ID 0xC000 to 0xFFFF). this helps reduce false positives in the big memory systems without negatively affecting the small/medium systems

2012-09-06 15:06:19 +00:00

clipboard.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

constants.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

desktops.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

eventhooks.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

gahti.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

gditimers.py

get the gditimer owner information from the _HANDLEENTRY rather than the TYPE_TIMER object. the handle entry structure is more reliable since its consistent on all windows profiles of the same architecture, as opposed to the timer object which changes between xp, 2003, vista, and 7 etc

2012-09-07 14:47:11 +00:00

messagehooks.py

add a new set of (_catomSysTableEntries, _aatomSysLoaded) offsets to messagehooks plugin

2012-09-08 22:50:42 +00:00

screenshot.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

sessions.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

userhandles.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

win32k_core.py

small refactor to the _MM_SESSION_SPACE.find_shared_info() method, which allows us to find tagSHAREDINFO in the following conditions: 1) win32k.sys PE header is memory resident 2) win32k.sys PE header is not memory resident 3) win32k.sys PE header is memory resident but zeroed out or corrupted.

2012-09-08 21:41:00 +00:00

windows.py

add the win32k suite. reviewed and tested by gleeda, aw, and ikelos

2012-09-05 02:09:58 +00:00

windowstations.py

change the pool scanning check for window station objects - don't look in paged pools

2012-09-06 23:46:12 +00:00