Re: [Vol-dev] ITES and logformat

Hi Thorsten, Sorry for the delayed reply, we've been cramming to get some things fixed for the 2.1 release and your question required a little more thought. So, yes, being able to use volatility in cuckoo (or any other framework) via flexible API and easily integrated/parsed output formatting is a major goal of ours. Especially if the product of the work is going back into another open-source project. We're aware of SRI's "malgram" sandbox [1] which they built using cuckoo and volatility for introspection, but its a proprietary system. So I thought we had some documentation on rendering output, but I can't find it right now, so I'll just give you a quick walk-through. Each plugin has a render_text method, which is used by default from the command line. For example when you run python vol.py -f image.dmp pslist, the following rendering function executes to print the values to your terminal: https://code.google.com/p/volatility/source/browse/trunk/volatility/plugins… Assuming you wanted the output in JSON format, you could write a new method called render_json to the PSList class. I attached a simple example patch to this email. After applying the patch, you could run the pslist command again, but using the --output=json parameter like this: $ python vol.py -f image.dmp pslist --output=json Volatile Systems Volatility Framework 2.1_alpha {"Start": "2012-05-31 13:58:55 ", "Sess": "", "Exit": "", "Name": "System", "Wow64": false, "Offset": 2215873656, "PPid": 0, "Pid": 4, "Thds": 444}{"Start": "2012-05-31 13:58:55 ", "Sess": "", "Exit": "", "Name": "smss.exe", "Wow64": false, "Offset": 2242990112, "PPid": 4, "Pid": 276, "Thds": 30}<snip> So the information you want to log would really be up to you. Any data carved/produced by the plugins could be output in JSON format. Also in the past one of our developers, Gleeda, wrote some example render_sql functions which output data directly to an sqlite3 database [2], that would be an option for you as well. If there's anything else we can help with, please let us know! MHL [1]. public.mtc.sri.com/MalgramIntroduction.pptx [2]. http://gleeda.blogspot.com/2010/02/briefly-volatility-news-214.html On Mon, Jun 25, 2012 at 8:18 AM, Thorsten Sick &lt;thorsten.sick(a)avira.com&gt; wrote: