pat_h/to/file

I've got a profile here for `Ubuntu 21.04`, kernel `5.11.0-17`: https://github.com/pathtofile/volatility2-profile-ubuntu2104

Cleaned Dockerfile CMD entrypoints to make it easier to extend or buil…

1

Cleaned Dockerfile CMD entrypoints to make it easier to extend or build on top of built image. In some situations you might want to run extra setup inside the container...

New Linux examples - LD_PRELOAD and commandline cloaking

1

Added two new linux examples: - building a library to use as `LD_PRELOAD` to hook libc - Some various techniques to hide your real process name and commandline arguments -...

Opcodes can be larger than 9

1

Hi there, When filtering by opcode, e.g. `-f Opcode -fv 2`, you limit the possible opcode to filter on to be 0-9, in this code: ```c# SilkUtility.FilterValueObject = byte.Parse(FilterValue); if...

Fixes this issue: https://github.com/fireeye/SilkETW/issues/13 When filtering by opcode, e.g. -f Opcode -fv 2, you limit the possible opcode to filter on to be 0-9. However in the underlying ETW API,...