Files
volatility3/volatility/framework
memoryforensics1andikelos 6be5716195 Add FILE_OBJECT and EPROCESS extestions, kthread, token struct
add functionality to:
FILE_OBJECT:
         access_string function
EPROCESS:
         environment_variables function

new structs:
TOKEN:
         get_sids function
         privileges funciton
KTHREAD:
         get_state function
         get_wait_reason function
2020-09-02 10:52:53 +01:00
..
2020-08-31 17:05:20 +01:00
2020-08-31 17:05:20 +01:00