WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-05 01:07:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Tweak the getting started linux tutorial

Browse Source
This commit is contained in:
j-t-1
2024-12-12 17:36:51 +00:00
committed by GitHub
parent b6717d80d9
commit 6ffef285f4
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/source/getting-started-linux-tutorial.rst
+5 -5
View File
@@ -27,7 +27,7 @@ To create a symbol table please refer to :ref:`symbol-tables:Mac or Linux symbol
Listing plugins
---------------
The following is a sample of the linux plugins available for volatility3, it is not complete and more more plugins may
The following is a sample of the linux plugins available for volatility3, it is not complete and more plugins may
be added. For a complete reference, please see the volatility 3 :doc:`list of plugins <volatility3.plugins>`.
For plugin requests, please create an issue with a description of the requested plugin.
@@ -40,7 +40,7 @@ For plugin requests, please create an issue with a description of the requested
linux.check_creds.Check_creds
linux.check_idt.Check_idt
.. note:: Here the the command is piped to grep and head in-order to provide the start of the list of linux plugins.
.. note:: Here the the command is piped to grep and head to provide the start of the list of linux plugins.
Using plugins
@@ -80,9 +80,9 @@ Thanks go to `stuxnet <https://github.com/stuxnet999/>`_ for providing this memo
The above command helps us to find the memory dump's kernel version and the distribution version. Now using the above banner we can search for the needed ISF file from the ISF server.
If ISF file cannot be found then, follow the instructions on :ref:`getting-started-linux-tutorial:Procedure to create symbol tables for linux`. After that, place the ISF file under the ``volatility3/symbols/linux`` directory.
If an ISF file cannot be found then, follow the instructions on :ref:`getting-started-linux-tutorial:Procedure to create symbol tables for linux`. After that, place the ISF file under the ``volatility3/symbols/linux`` directory.
.. tip:: Use the banner text which is most repeated to search from ISF Server.
.. tip:: Use the banner text which is most repeated to search on the ISF Server.
linux.pslist
~~~~~~~~~~~~
@@ -157,7 +157,7 @@ linux.pstree
***** 1548 1266 gsd-keyboard
***** 1550 1266 gsd-media-keys
``linux.pstree`` helps us to display the parent child relationships between processes.
``linux.pstree`` helps us to display the parent-child relationships between processes.
linux.bash
~~~~~~~~~~