7:38 a.m.
Hello,
I am having some trouble loading a simple plugin with the '--plugins=.'
option. It seems to be loaded (there were some errors that were fixed
thanks to volatility displaying them) but it doesn't appear in the
--info list. If I try this option in one of the community folder, it
works (the plugins appear).
What is the basic requirement for a plugin to be recognized, and what
could I miss ? I started mine based on one from the
community folder (CsabaBarta/usnjrnl.py)
Thank you,
--
Stanislas 'P1kachu' Lejay
EPITA - LSE
If you're sleeping, you're doing it wrong.
10:03 a.m.
Hey,
Depending on how you have volatility installed you can get at the plugins
folder several ways.
The easiest way is to invoke a plugin folder is to point to it like this
(pg 59 in the Art of memory forensics book, the plugin DIR is required
before any other commands):
vol.py --plugin=<DIR> psscan --profile=Win7SP1x64
Best,
Jared
On Tue, May 10, 2016 at 7:38 AM, P1kachu <p1kachu(a)lse.epita.fr> wrote:
Hello,
I am having some trouble loading a simple plugin with the '--plugins=.'
option. It seems to be loaded (there were some errors that were fixed
thanks to volatility displaying them) but it doesn't appear in the
--info list. If I try this option in one of the community folder, it
works (the plugins appear).
What is the basic requirement for a plugin to be recognized, and what
could I miss ? I started mine based on one from the
community folder (CsabaBarta/usnjrnl.py)
Thank you,
--
Stanislas 'P1kachu' Lejay
EPITA - LSE
If you're sleeping, you're doing it wrong.
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
10:07 a.m.
Hi,
The least amount of code I could write for a plugin is:
# -- START --
import volatility.commands as commands
class Hello(commands.Command):
"""Prints 'hello world'"""
def render_text(self, outfd, data):
outfd.write('Hello world!\n')
# -- END --
Obviously this doesn't do anything with the memory image.
Quick tips:
- outfd: the stream to which output is written (stdout)
- data: the data yielded by the plugin's calculate method (in this example,
inherits from commands.Command)
Good luck!
Adam
On 10 May 2016 at 12:38, P1kachu <p1kachu(a)lse.epita.fr> wrote:
Hello,
I am having some trouble loading a simple plugin with the '--plugins=.'
option. It seems to be loaded (there were some errors that were fixed
thanks to volatility displaying them) but it doesn't appear in the
--info list. If I try this option in one of the community folder, it
works (the plugins appear).
What is the basic requirement for a plugin to be recognized, and what
could I miss ? I started mine based on one from the
community folder (CsabaBarta/usnjrnl.py)
Thank you,
--
Stanislas 'P1kachu' Lejay
EPITA - LSE
If you're sleeping, you're doing it wrong.
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
11:36 a.m.
Hiya,
Volatility 2.x imports all .py (or .pyc if no .py with the same name is
found) under the plugin directories recursively. The --plugins
parameter can be a colon separated list of directories to be treated as
part of the plugins namespace. Once these files have been imported, all
classes derived from the Command class are displayed as plugins. If
your class inherits from object and does not have Command somewhere in
its inheritance tree, then it won't show up in the output from --info
and will not be usable...
Hope that helps?
Mike 5:)
3110
days inactive
3110
days old
vol-users@lists.volatilityfoundation.org
3 comments
4 participants
participants (4)
-
Bridgey theGeek -
Jared Greenhill -
Mike Auty -
P1kachu