Re: [Vol-dev] Pythonisms and volatility-isms for structs

Hey Edwin, 1) It depends what type of pattern you're trying to match. If the pattern is a simple byte string like "one" or "\x0d\x0a" you can just do address_space.zread(address, size) == "one". If the pattern is a regular expression you can also use the python re module (some examples in the moddump and driverirp plugins). Also you can use yara for pattern matching (there's a yarascan for windows and now a linux_yarascan plugin so look in there for examples). Also if you do happen to want to search also, you can use proc.search_process_memory(["one", "two"]) etc. 2) There is partial documentation on the wiki, see the 2.0 developers guide https://code.google.com/p/volatility/wiki/VolatilityObjects20. Its obviously a little dated since we're almost in 2.3 but most is still accurate. Or just check out how its done in one of the other plugins like dumpcerts ( https://code.google.com/p/volatility/source/browse/trunk/volatility/plugins…) which manually defines a vtype (the structure name, members, offsets, types) and then creates an "object class" (inherits from obj.CType) to give it custom methods etc. Hope it helps, MHL On Mon, Apr 15, 2013 at 8:37 AM, Edwin Smulders <edwin.smulders(a)gmail.com>wrote: