8:16 a.m.
Hello again,
I managed to get something that guess the OS of a memory dump. I was
planning to call imageinfo from it in the case of a Windows dump or
get_mac_profile in case of an OSX dump (will figure out Linux later).
So my questions are:
- Does this kind of feature fits into Volatility, or do you prefer that
the plugins follow the Single Responsability Principle ?
- If not, what is the cleanest way to call a plugin from another one ?
Thank you !
--
Stanislas 'P1kachu' Lejay
EPITA - LSE
If you're sleeping, you're doing it wrong.
5:01 p.m.
You can create an instance of the "other" plugin by passing it your
self._config object and then calling its calculate() method.
For example:
https://github.com/volatilityfoundation/volatility/blob/master/volatility/p…
To be honest, I would recommend starting with the Linux profile
guessing, since that is what the framework is currently lacking (and
thus what will be most useful to the users). It should only take a
couple lines of code to "glue" them all together at that point and make
a single guess_profile plugin that tries all 3 OS methods in sequence
(or parallel).
Cheers,
MHL
On 5/11/16 5:16 AM, P1kachu wrote:
Hello again,
I managed to get something that guess the OS of a memory dump. I was
planning to call imageinfo from it in the case of a Windows dump or
get_mac_profile in case of an OSX dump (will figure out Linux later).
So my questions are:
- Does this kind of feature fits into Volatility, or do you prefer that
the plugins follow the Single Responsability Principle ?
- If not, what is the cleanest way to call a plugin from another one ?
Thank you !
3109
days inactive
3109
days old
vol-users@lists.volatilityfoundation.org
1 comments
2 participants
participants (2)
-
Michael Ligh -
P1kachu