volatility3
volatility3 copied to clipboard
PE header info/Control Flow Guard plugin request
Could you please clarify what you mean by that? I assume you mean Control Flow Guard? In that case it looks like that's stored in the PE header of the executable, so you should already be able to dump the PE using an existing plugin (I'm not sure exactly which one), but it might be worthwhile having plugin that extracts as much PE information as possible? I'll need to have a think over what it does and doesn't try to get...