--- Volatility\vmodules.py	Wed Jun 17 23:35:54 2009
+++ Volatility-SVN\Volatility\vmodules.py	Sat Apr 11 09:08:37 2009
@@ -464,0 +460,2 @@
+    if obj is None:
+        return
@@ -2114,2 +2082,2 @@
-    print "PID    TID    Time created             Time exited              Offset    \n"+ \
-          "------ ------ ------------------------ ------------------------ ----------\n";
+    print "No.  PID    TID    Offset    \n"+ \
+          "---- ------ ------ ----------\n";
--- Volatility\vtypes.py	Wed Jun 17 23:08:48 2009
+++ Volatility-SVN\Volatility\vtypes.py	Sat Apr 11 09:08:37 2009
@@ -217,2 +216,0 @@
-  'CreateTime' : [ 0x1c0, ['_LARGE_INTEGER']], \
-  'ExitTime' : [ 0x1c8, ['_LARGE_INTEGER']], \
--- Volatility\forensics\win32\scan.py	Sat Jun 20 23:14:23 2009
+++ Volatility-SVN\Volatility\forensics\win32\scan.py	Sat Apr 11 09:08:35 2009
@@ -33 +32,0 @@
-from forensics.win32.datetime import *
@@ -404,30 +402,0 @@
-    # calculate CreateTime, 3 LSB are flags!
-    (time_offset, tmp) = get_obj_offset(object.types, ['_ETHREAD', 'CreateTime'])
-    low_time  = read_obj(object.addr_space, object.types, \
-        ['_KSYSTEM_TIME', 'LowPart'], address+time_offset)
-    high_time = read_obj(object.addr_space, object.types, \
-        ['_KSYSTEM_TIME', 'High1Time'], address+time_offset) 
-    if low_time == None or high_time == None:
-        create_time = 0
-    else:
-        create_time = ((high_time << 32) | low_time) >> 3
-        create_time = windows_to_unix_time(create_time)               
-    if create_time == 0:
-        CreateTime = ""
-    else:
-        CreateTime = format_time(create_time)
-    
-    (time_offset, tmp) = get_obj_offset(object.types, ['_ETHREAD', 'ExitTime'])
-    low_time  = read_obj(object.addr_space, object.types, \
-        ['_KSYSTEM_TIME', 'LowPart'], address+time_offset)
-    high_time = read_obj(object.addr_space, object.types, \
-        ['_KSYSTEM_TIME', 'High1Time'], address+time_offset) 
-    if low_time == None or high_time == None:
-        exit_time = 0
-    else:
-        exit_time = (high_time << 32) | low_time
-        exit_time = windows_to_unix_time(exit_time)               
-    if exit_time == 0:
-        ExitTime = ""
-    else:
-        ExitTime = format_time(exit_time)
@@ -435,2 +404,2 @@
-    print "%4d %6d %6d %24s %24s 0x%0.8x"%(cnt, UniqueProcess, UniqueThread,\
-        CreateTime, ExitTime, address)
+
+    print "%4d %6d %6d 0x%0.8x"%(cnt,UniqueProcess,UniqueThread,address)
@@ -456,2 +425,2 @@
-    "No.  PID    TID    Time created             Time exited              Offset    \n"+ \
-    "---- ------ ------ ------------------------ ------------------------ ----------\n";
+    "No.  PID    TID    Offset    \n"+ \
+    "---- ------ ------ ----------\n";
--- Volatility\forensics\win32\scan2.py	Wed Jun 17 23:34:51 2009
+++ Volatility-SVN\Volatility\forensics\win32\scan2.py	Sat Apr 11 09:08:35 2009
@@ -842,23 +846,0 @@
-            # calculate CreateTime, 3 LSB are flags!
-            (time_offset, tmp) = get_obj_offset(self.data_types, ['_ETHREAD', 'CreateTime'])
-            low_time  = read_obj_from_buf(buff, self.data_types, \
-                ['_KSYSTEM_TIME', 'LowPart'], object_offset+time_offset)
-            high_time = read_obj_from_buf(buff, self.data_types, \
-                ['_KSYSTEM_TIME', 'High1Time'], object_offset+time_offset) 
-            if low_time == None or high_time == None:
-                create_time = 0
-            else:
-                create_time = ((high_time << 32) | low_time) >> 3
-                create_time = windows_to_unix_time(create_time)               
-            if create_time == 0:
-                CreateTime = ""
-            else:
-                CreateTime = self.format_time(create_time)
-                
-            exit_time = read_time_buf(buff, self.data_types,\
-                ['_ETHREAD', 'ExitTime'], object_offset)
-            if exit_time == 0:
-                ExitTime = ""
-            else:
-                ExitTime = self.format_time(exit_time)
-
@@ -866,5 +847,0 @@
-            
-            print "%6d %6d %24s %24s 0x%0.8x" % \
-                (UniqueProcess, UniqueThread, \
-                CreateTime, ExitTime, address)
-
@@ -871,0 +849 @@
+            print "%6d %6d 0x%0.8x"%(UniqueProcess, UniqueThread, address)
