2 Commits

Author	SHA1	Message	Date
nganhkhoa	8cb553eb11	Update base code for windows 7, 8, 8.1 ... Because the tag is different in lower version of Windows, need to change the tag in scan algorithm 4b29cf1986/volatility/framework/plugins/windows/poolscanner.py (L229)	2020-06-30 04:09:13 +07:00
nganhkhoa	72a947ccd7	Update scan algorithm ... - Scan _ETHREAD with PoolTag='Thre' - Parse pid/ppid from _EPROCESS - Build process tree from output log - Static link for machine missing Windows C++ dev environment	2020-06-09 04:13:15 +07:00