ppd6016 / volatility

Automatically exported from code.google.com/p/volatility
GNU General Public License v2.0
0 stars 0 forks source link

Enhancement request: APIHOOKS plugin work on Win2008R2SP1x64 #303

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1. # vol.py --dtb=0x187000 -f myimage.vmss --profile=Win2008R2SP1x64 apihooks
2.
3.

What is the expected output? What do you see instead?
Hooked APIS!

What version of the product are you using? On what operating system?
Volatility 2.1RC1 on Ubuntu 12 LTS

Please provide any additional information below.
# vol.py --dtb=0x187000 -f myimage.vmss --profile=Win2008R2SP1x64 apihooks
Volatile Systems Volatility Framework 2.1_rc1
ERROR   : volatility.plugins.malware.apihooks: This command does not support 
the selected profile.

Original issue reported on code.google.com by jessebow...@gmail.com on 17 Jul 2012 at 2:31

GoogleCodeExporter commented 9 years ago
Hey Jesse, 

Thanks for the report. As you'll notice, several of the malware plugins are 
currently still x86 only (see the features by plugin wiki [1] for an exact 
list). Also if you check out the new roadmap [2], I've made entries to ensure 
they're brought up to speed by at least 3.0. If there's time to get it done 
sooner, then it will definitely be nice, but we're gonna make a big push to get 
all the 2.2 items completed first. 

[1]. http://code.google.com/p/volatility/wiki/FeaturesByPlugin21
[2]. 
http://code.google.com/p/volatility/wiki/VolatilityRoadmap#Volatility_3.0_(Offic
ial_Tech_Preview_Merge)

Original comment by michael.hale@gmail.com on 17 Jul 2012 at 3:41

GoogleCodeExporter commented 9 years ago
Oops I didn't mean to mark this as done, but now that I think of it, its 
probably OK since its on our to-do list anyway ;-)

Original comment by michael.hale@gmail.com on 17 Jul 2012 at 3:42