volatility3 icon indicating copy to clipboard operation
volatility3 copied to clipboard

PE header info/Control Flow Guard plugin request

Open ilaypilo opened this issue 2 years ago • 1 comments

ilaypilo avatar Jul 27 '23 21:07 ilaypilo

Could you please clarify what you mean by that? I assume you mean Control Flow Guard? In that case it looks like that's stored in the PE header of the executable, so you should already be able to dump the PE using an existing plugin (I'm not sure exactly which one), but it might be worthwhile having plugin that extracts as much PE information as possible? I'll need to have a think over what it does and doesn't try to get...

ikelos avatar Jul 27 '23 23:07 ikelos