From 61d45c2c36fc16c6529e07e4fc404fcb7a86221b Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 22 Feb 2016 01:54:53 +0000 Subject: [PATCH] Add another demonstration image with handily the same system process offset, to demonstrate selecting PAE or 32bit. --- volatility/cli/__init__.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index 68fe5526f..e3aacac4a 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -47,9 +47,13 @@ class CommandLine(object): # UI fills in the config: ctx = contexts.Context() ctx.config["pslist.primary.memory_layer.filename"] = "/run/media/mike/disk/memory/xp-laptop-2005-07-04-1430.img" - # ctx.config["pslist.primary.page_map_offset"] = 0x39000 ctx.config["pslist.offset"] = 0x823c87c0 + # ctx.config["pslist.primary.memory_layer.filename"] = "/run/media/mike/disk/memory/private/mhl-dreamon.dmp" + # ctx.config["pslist.offset"] = 0x823c87c0 + + # ctx.config["pslist.primary.page_map_offset"] = 0x39000 + config_path = plugin.__name__.lower() windows = True