Re: [Vol-dev] question on the code
6 Oct
2008
6 Oct
'08
12:34 p.m.
Jesse,
We described a lot of the changes at OMFW during my presentation on
Volatility 1.3 and during Brendan's presentation on VolShell. If you look
at the examples provided in memory_plugins, you will also see how the
usage has changed. I also believe many of Brendan's plugins use the new
object model as well.
For example with the new object model it is possible to do this:
image_file_name = eprocess.ImageFileName
as opposed to having to define an explicit accessor function:
image_file_name = process_imagename(addr_space, types, task)
As for vmodules, all of those modules will eventually be converted to the
new object model.
So if you are working on a new plugin, I would suggest using the new
object model similar to that found in the plugin examples.
AW
On Mon, 6 Oct 2008, Jesse Kornblum wrote:
What is the old object model? Can you give an example
of how things have
changed? Will the scripts in vmodules be changing as well, or are they
already using the new model?
--
Jesse
jessek(a)speakeasy.net
On Fri Oct 3 18:07 , AAron Walters sent:
Jun,
I don't know about a trap, but it is something. By the way, you may want
to check out the examples in the memory_plugins directory. These plugins
all use the new object model which everything will be transitioning to in
the near future.
Thanks,
AW
On Sat, 4 Oct 2008, Jun Koi wrote:
_______________________________________________
Vol-dev mailing list
Vol-dev(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-dev
On Fri, Oct 3, 2008 at 10:36 PM, AAron Walters
awalters(a)4tphi.net> wrote:
_______________________________________________
Vol-dev mailing list
Vol-dev(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-dev
Jun,
The types variable is instantiated from vtypes.py. This is the part of the
Profile used to describe the operating system's data types.
What a trap!
Thanks,
J
On Fri, 3 Oct 2008, Jun Koi wrote:
> Hi,
>
> I am trying to read the code, and found this in vmodules.py:
>
> def get_connections(cmdname, argv):
> """
>
> Function prints a list of open connections
> """
> op = get_standard_parser(cmdname)
> opts, args = op.parse_args(argv)
>
> star_line = '*'*72
>
> (addr_space, symtab, types) = load_and_identify_image(op, opts) #
> Here
>
> connections = tcb_connections(addr_space, types, symtab)
> ....
>
> I dont understand what the "types" variable above means. Even track
> back the source, I dont see how it is produced.
>
> Anybody could explain a bit, so I can continue to dig? (sorry that my
> Python skill is still very modest)
>
> Thanks,
> J
> _______________________________________________
> Vol-dev mailing list
> Vol-dev(a)volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-dev
>