[Vol-dev] _LDR_MODULE

Brendan Dolan-Gavitt bdolangavitt at wesleyan.edu
Tue Jul 7 13:06:24 CDT 2009


LDR_MODULE is what LDR_DATA_TABLE_ENTRY was called in Volatility  
until I asked if we could change it ;) Any remaining references mean  
that I goofed and didn't get them all when I submitted the patch to  
AAron. I'll see about cleaning up the stragglers.

We may want to leave it in vtypes.py for the time being in order to  
support older plugins, but putting in a comment is a good idea.

-Brendan

On Jul 7, 2009, at 1:37 PM, Andreas Schuster wrote:

> All,
>
> While fixing some bugs in scan2.py, I noticed a reference to  
> _LDR_MODULE. I have never seen that name in a PDB before, possibly  
> it should read _LDR_DATA_TABLE_ENTRY instead. Or is there a subtle  
> difference that I'm not aware of?
>
> Both structures are defined in vtypes.py of SVN rev 12. I suggest  
> to remove _LDR_MODULE and change any references to it into  
> _LDR_DATA_TABLE_ENTRY. At least we should add a comment in order to  
> avoid confusion.
>
> Any comments on this?
>
> Cheers,
> Andreas
> _______________________________________________
> Vol-dev mailing list
> Vol-dev at volatilesystems.com
> http://lists.volatilesystems.com/mailman/listinfo/vol-dev
>



More information about the Vol-dev mailing list