Something happened when picking _EPROCESS members before that caused
this to not function properly. This one relies on a more stable type
removal instead of _EPROCESS members.
This was originally done to solve a problem where `f32` wasn't available
in the native types from every kernel version. However, it ended up not
being necessary - we can just omit `native_types` from the method call,
and it will construct the types as-needed using the definition for
`float` in `base_types` from the JSON files.
This adds the windowstations, desktops, and deskscan plugins, and
removes the gui.py plugin file that was stubbed out in the introductory
work for the effort.
It also adds a new method to the poolscanner class, but does not bump
the poolscanner version number since there is already a major version
number bump going into this PR.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the Windows pool extension with a new get_name() method,
and changes the method signature for another. We'll need to figure out
if there is a good way to version extension classes.
Deskscan requires this in order to use get_name with an alternate
(non-kernel) symbol table.
This updates all plugins that both depend on PEDump and won't require
breaking changes of their own. They now call the updated method
signature, and have their pedump requirement version bumped
appropriately.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates PEDump to use the latest version of PsList, updates the
dependency version number, changes one of it's own method signatures to
facilitate the pslist change, and does a major bump of its own version
number.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates all dependents on windows.pslist.PsList that could be
updated without breaking interface changes of their own to use the
latest windows.pslist.PsList plugin version with a simplified method
signature
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the windows.consoles.Consoles plugin to use the updated
hivelist method signature, changing one of its own method signatures as
required and doing a major version bump of its own.
Plugins that depend on consoles also have their method calls changed,
and their dependency versions bumped.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the debugregisters and suspended threads plugins' threads
requirement with the latest major version bump.
Co-authored-by: Andrew Case <andrew@dfir.org>
This updates the windows.threads plugin with a method signature change:
`module_name` is now `kernel_module_name` for clarity.
Co-authored-by: Andrew Case <andrew@dfir.org>
Andrew Case