tking2 / volatility

Automatically exported from code.google.com/p/volatility
GNU General Public License v2.0
0 stars 1 forks source link

Linux kmem_cache + plugins #328

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
The following patches add an easy kmem_cache interface.  I've also written some 
plugins to show how to use it.  Slab only for now.  Slub coming soon.

The plugin patches obviously depend on the kmem_cache patch.

Original issue reported on code.google.com by Joe.Sylve@gmail.com on 25 Aug 2012 at 4:20

Attachments:

GoogleCodeExporter commented 9 years ago
I will take care of getting this one in. Some of the slab walking stuff is 
based on the old slab code we had and the new stuff Joe went through it with me 
before putting it all together so its pretty close to how we want it. 

I will make some minor changes, such as fixing the inheriting in pslist_cache 
and the register_options call before committing. 

Original comment by atc...@gmail.com on 25 Aug 2012 at 4:30

GoogleCodeExporter commented 9 years ago
Fixed the option registration in pslist_cache

Original comment by Joe.Sylve@gmail.com on 25 Aug 2012 at 4:44

Attachments:

GoogleCodeExporter commented 9 years ago
[deleted comment]
GoogleCodeExporter commented 9 years ago
cleaned up some dead code in kmem_cache

Original comment by Joe.Sylve@gmail.com on 25 Aug 2012 at 5:04

Attachments:

GoogleCodeExporter commented 9 years ago
Fixed option registration in mount_cache
changed option in netstat for to avoid collision with future netstat_cache 
command 

Original comment by Joe.Sylve@gmail.com on 25 Aug 2012 at 5:27

Attachments:

GoogleCodeExporter commented 9 years ago
[deleted comment]
GoogleCodeExporter commented 9 years ago
Didn't catch all the dead code.  

Here are the updated patches that need to be run.

Original comment by Joe.Sylve@gmail.com on 25 Aug 2012 at 4:20

Attachments:

GoogleCodeExporter commented 9 years ago
These are now in

Original comment by atc...@gmail.com on 25 Aug 2012 at 5:16