9:08 a.m.
Hi Folks,
I was recently trying to dig up a quick, easy method for
parsing Windows commandline history records out of memory dumps, and
came across a reference to Eoghan Casey's 2010 article. Extracting
Windows command line details from physical memory. When I pinged him
about the cmd_history.py Volatility plugin he wrote along with that
paper, he said he'd sent it in to the Volatility development group, and
had presumed it would be included at some point. I've been digging
around, but I can't find it. Any idea what happened to it?
Thanks
John
----------------------------------------------------------
Quis custodiet ipsos custodes?... I do!
2:41 a.m.
Hi John,
It's been a while since we have seen you around the mailing list. I
didn't realize you were still using Volatility.
Eoghan did recently send us the plugin and it is in the queue to be ported
to Volatility 2.X. There were a number of things that needed to be
updated and cleaned up so it did not make it in the upcoming release. It
is one of the plugins on the roadmap for the next release. If you would
like to help with that effort, I'm sure people would be more than
greatful.
Hope all is well!
AW
The Volatility Project
On Thu, 28 Jul 2011, McCash John-GKJN37 wrote:
Hi Folks,
I was recently trying to dig up a quick, easy method for
parsing Windows commandline history records out of memory dumps, and
came across a reference to Eoghan Casey's 2010 article. Extracting
Windows command line details from physical memory. When I pinged him
about the cmd_history.py Volatility plugin he wrote along with that
paper, he said he'd sent it in to the Volatility development group, and
had presumed it would be included at some point. I've been digging
around, but I can't find it. Any idea what happened to it?
Thanks
John
----------------------------------------------------------
Quis custodiet ipsos custodes?... I do!
4:07 p.m.
Aaron,
I just pulled down the latest subversion snapshot, and noticed it's calling itself
2.1_alpha. I still don't see this plugin in the list though. Am I missing it
somewhere?
Thanks
John
-----Original Message-----
From: AAron Walters [mailto:awalters@4tphi.net]
Sent: Friday, July 29, 2011 1:41 AM
To: McCash John-GKJN37
Cc: vol-dev(a)volatilityfoundation.org
Subject: Re: [Vol-dev] Looking for Eoghan Casey's cmd_history.py Volatility plugin
Hi John,
It's been a while since we have seen you around the mailing list. I
didn't realize you were still using Volatility.
Eoghan did recently send us the plugin and it is in the queue to be ported
to Volatility 2.X. There were a number of things that needed to be
updated and cleaned up so it did not make it in the upcoming release. It
is one of the plugins on the roadmap for the next release. If you would
like to help with that effort, I'm sure people would be more than
greatful.
Hope all is well!
AW
The Volatility Project
On Thu, 28 Jul 2011, McCash John-GKJN37 wrote:
Hi Folks,
I was recently trying to dig up a quick, easy method for
parsing Windows commandline history records out of memory dumps, and
came across a reference to Eoghan Casey's 2010 article. Extracting
Windows command line details from physical memory. When I pinged him
about the cmd_history.py Volatility plugin he wrote along with that
paper, he said he'd sent it in to the Volatility development group, and
had presumed it would be included at some point. I've been digging
around, but I can't find it. Any idea what happened to it?
Thanks
John
----------------------------------------------------------
Quis custodiet ipsos custodes?... I do!
3:34 a.m.
John,
I created this issue to track this plugin:
http://code.google.com/p/volatility/issues/detail?id=148
Thanks
Michael.
On 6 October 2011 22:07, McCash John-GKJN37
<john.mccash(a)motorolasolutions.com> wrote:
Aaron,
I just pulled down the latest subversion snapshot, and noticed it's calling
itself 2.1_alpha. I still don't see this plugin in the list though. Am I missing it
somewhere?
Thanks
John
-----Original Message-----
From: AAron Walters [mailto:awalters@4tphi.net]
Sent: Friday, July 29, 2011 1:41 AM
To: McCash John-GKJN37
Cc: vol-dev(a)volatilityfoundation.org
Subject: Re: [Vol-dev] Looking for Eoghan Casey's cmd_history.py Volatility plugin
Hi John,
It's been a while since we have seen you around the mailing list. I
didn't realize you were still using Volatility.
Eoghan did recently send us the plugin and it is in the queue to be ported
to Volatility 2.X. There were a number of things that needed to be
updated and cleaned up so it did not make it in the upcoming release. It
is one of the plugins on the roadmap for the next release. If you would
like to help with that effort, I'm sure people would be more than
greatful.
Hope all is well!
AW
The Volatility Project
On Thu, 28 Jul 2011, McCash John-GKJN37 wrote:
Hi Folks,
I was recently trying to dig up a quick, easy method for
parsing Windows commandline history records out of memory dumps, and
came across a reference to Eoghan Casey's 2010 article. Extracting
Windows command line details from physical memory. When I pinged him
about the cmd_history.py Volatility plugin he wrote along with that
paper, he said he'd sent it in to the Volatility development group, and
had presumed it would be included at some point. I've been digging
around, but I can't find it. Any idea what happened to it?
Thanks
John
----------------------------------------------------------
Quis custodiet ipsos custodes?... I do!
_______________________________________________
Vol-dev mailing list
Vol-dev(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-dev
4740
days inactive
4811
days old
vol-dev@lists.volatilityfoundation.org
3 comments
3 participants
participants (3)
-
AAron Walters -
McCash John-GKJN37 -
Michael Cohen