Re: [Vol-dev] New memory profile and kpcrscan question

Sorry for the confusion, I should've posted to the list but we solved this offline. The Vista profile was based mostly off of XPSP2, hence the VolatilityMagic request for the KPCR was returning the same fixed KPCR as for XPSP2. Inheriting the appropriate line from the win7_x86_sp0 overlay: win7sp0x86overlays['VOLATILITY_MAGIC'][1]['KPCR'][1] = ['VolatilityKPCR'] solves the problem by using the KPCR scanner to carry out the check. I've now modified the kpcrscan plugin to ensure it always scans, rather than asking VolatiltiyMagic for an answer, but that was what was causing the original problem. The Vista profile hasn't been updated in the main tree yet either, but we're working on getting Windows 7 going first, and then porting all the relevant change across to Vista... Mike 5:)