nganhkhoa 72a947ccd7 Update scan algorithm ...

- Scan _ETHREAD with PoolTag='Thre'
- Parse pid/ppid from _EPROCESS
- Build process tree from output log
- Static link for machine missing Windows C++ dev environment

2020-06-09 04:13:15 +07:00

..

dump_test/1

add dump test 1

2020-06-05 19:37:13 +07:00

build_process_tree.py

Update scan algorithm

2020-06-09 04:13:15 +07:00

eprocess_scan_log_2.txt

check read access when dump file name in _FILE_OBJECT

2020-05-29 01:39:32 +07:00

eprocess_scan.log

Update scan algorithm

2020-06-09 04:13:15 +07:00

file_object_scan_log_2.txt

check read access when dump file name in _FILE_OBJECT

2020-05-29 01:39:32 +07:00