Version 5.8.24

README.md

@@ -197,10 +197,10 @@ v1.1-v4.9
 
 Latest:
 * Bug fixes.
-* ntfs module: improvements.
-* web module: improved support and move from misc/web -> forenic/web.
+* Module improvements: ntfs, procinfo, web.
 * C# API: improvements.
 * Java API: support for java.lang.foreign (JDK21+) for efficient memory accesses.
 * Linux PCIe FPGA performance improvements.
 * FindEvil: AV detections from Windows Defender residing on the analyzed system.
 * Python API: new functionality (multi-read, type-read) and improved scatter read performance.
+* Support for Proxmox memory dump files.

includes/leechcore.h

@@ -11,7 +11,7 @@
 // - README: https://github.com/ufrisk/LeechCore
 // - GUIDE:  https://github.com/ufrisk/LeechCore/wiki
 //
-// (c) Ulf Frisk, 2020-2023
+// (c) Ulf Frisk, 2020-2024
 // Author: Ulf Frisk, pcileech@frizk.net
 //
 // Header Version: 2.16.1

m_vmemd/version.h

@@ -3,8 +3,8 @@
 
 #define VERSION_MAJOR               5
 #define VERSION_MINOR               8
-#define VERSION_REVISION            23
-#define VERSION_BUILD               143
+#define VERSION_REVISION            24
+#define VERSION_BUILD               144
 
 #define VER_FILE_DESCRIPTION_STR    "MemProcFS : Plugin vmemd"
 #define VER_FILE_VERSION            VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD

memprocfs/version.h

@@ -3,8 +3,8 @@
 
 #define VERSION_MAJOR               5
 #define VERSION_MINOR               8
-#define VERSION_REVISION            23
-#define VERSION_BUILD               143
+#define VERSION_REVISION            24
+#define VERSION_BUILD               144
 
 #define VER_FILE_DESCRIPTION_STR    "MemProcFS"
 #define VER_FILE_VERSION            VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD

vmm/pdb.c

@@ -1328,6 +1328,13 @@ fail_mspdb:
         strncat_s(szPathLib, MAX_PATH, "libpdbcrust", _TRUNCATE);
         strncat_s(szPathLib, MAX_PATH, VMM_LIBRARY_FILETYPE, _TRUNCATE);
         ctx->crust.hModule = LoadLibraryA(szPathLib);
+#ifndef _WIN32
+        if(!ctx->crust.hModule) {
+            strncat_s(szPathLib, MAX_PATH, "libpdbcrust2", _TRUNCATE);
+            strncat_s(szPathLib, MAX_PATH, VMM_LIBRARY_FILETYPE, _TRUNCATE);
+            ctx->crust.hModule = LoadLibraryA(szPathLib);
+        }
+#endif /* _WIN32 */
         if(!ctx->crust.hModule) {
             PDB_PrintError(H, "Reason: Could not load PDB required file - libpdbcrust.dll/so.", szErrorMSPDB);
             goto fail;

vmm/version.h

@@ -3,8 +3,8 @@
 
 #define VERSION_MAJOR               5
 #define VERSION_MINOR               8
-#define VERSION_REVISION            23
-#define VERSION_BUILD               143
+#define VERSION_REVISION            24
+#define VERSION_BUILD               144
 
 #define VER_FILE_DESCRIPTION_STR    "MemProcFS : Core"
 #define VER_FILE_VERSION            VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD

vmmpyc/version.h

@@ -3,8 +3,8 @@
 
 #define VERSION_MAJOR               5
 #define VERSION_MINOR               8
-#define VERSION_REVISION            23
-#define VERSION_BUILD               143
+#define VERSION_REVISION            24
+#define VERSION_BUILD               144
 
 #define VER_FILE_DESCRIPTION_STR    "MemProcFS : Python API"
 #define VER_FILE_VERSION            VERSION_MAJOR, VERSION_MINOR, VERSION_REVISION, VERSION_BUILD

vmmrust/leechcore_example/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "leechcore_example"
-version = "5.8.23"
+version = "5.8.24"
 edition = "2021"
 publish = false
 

vmmrust/m_example_plugin/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "m_example_plugin"
-version = "5.8.23"
+version = "5.8.24"
 edition = "2021"
 publish = false
 

vmmrust/memprocfs/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "memprocfs"
-version = "5.8.23"
+version = "5.8.24"
 edition = "2021"
 description = "MemProcFS - Physical Memory Analysis Framework"
 homepage = "https://github.com/ufrisk/MemProcFS"

vmmrust/memprocfs_example/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "memprocfs_example"
-version = "5.8.23"
+version = "5.8.24"
 edition = "2021"
 publish = false