1:37 p.m.
All,
While fixing some bugs in scan2.py, I noticed a reference to _LDR_MODULE. I
have never seen that name in a PDB before, possibly it should read
_LDR_DATA_TABLE_ENTRY instead. Or is there a subtle difference that I'm not
aware of?
Both structures are defined in vtypes.py of SVN rev 12. I suggest to remove
_LDR_MODULE and change any references to it into _LDR_DATA_TABLE_ENTRY. At
least we should add a comment in order to avoid confusion.
Any comments on this?
Cheers,
Andreas
2:06 p.m.
LDR_MODULE is what LDR_DATA_TABLE_ENTRY was called in Volatility
until I asked if we could change it ;) Any remaining references mean
that I goofed and didn't get them all when I submitted the patch to
AAron. I'll see about cleaning up the stragglers.
We may want to leave it in vtypes.py for the time being in order to
support older plugins, but putting in a comment is a good idea.
-Brendan
On Jul 7, 2009, at 1:37 PM, Andreas Schuster wrote:
All,
While fixing some bugs in scan2.py, I noticed a reference to
_LDR_MODULE. I have never seen that name in a PDB before, possibly
it should read _LDR_DATA_TABLE_ENTRY instead. Or is there a subtle
difference that I'm not aware of?
Both structures are defined in vtypes.py of SVN rev 12. I suggest
to remove _LDR_MODULE and change any references to it into
_LDR_DATA_TABLE_ENTRY. At least we should add a comment in order to
avoid confusion.
Any comments on this?
Cheers,
Andreas
_______________________________________________
Vol-dev mailing list
Vol-dev(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-dev
5562
days inactive
5562
days old
vol-dev@lists.volatilityfoundation.org
1 comments
2 participants
participants (2)
-
Andreas Schuster -
Brendan Dolan-Gavitt