Skip to content

Commit ff5d736

Browse files
authored
Amend SvcDiff comments at top of file
Previously contained information about Skeleton_Key_Check, change this to be about SvcDiff.
1 parent fa73298 commit ff5d736

File tree

1 file changed

+5
-7
lines changed

1 file changed

+5
-7
lines changed

volatility3/framework/plugins/windows/svcdiff.py

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,13 @@
11
# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
22
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
33
#
4-
5-
# This module attempts to locate skeleton-key like function hooks.
6-
# It does this by locating the CSystems array through a variety of methods,
7-
# and then validating the entry for RC4 HMAC (0x17 / 23)
4+
# This module compares services found through list walking versus scanning,
5+
# with the aim of finding hidden services.
86
#
9-
# For a thorough walkthrough on how the R&D was performed to develop this plugin,
10-
# please see our blogpost here:
7+
# For background of hidden services and a real-world example of the use of this plugin,
8+
# please see our blogpost:
119
#
12-
# https://volatility-labs.blogspot.com/2021/10/memory-forensics-r-illustrated.html
10+
# https://volatilityfoundation.org/memory-forensics-rd-illustrated-detecting-hidden-windows-services/
1311

1412
import logging
1513

0 commit comments

Comments
 (0)