diff --git a/volatility/plugins/volshell.py b/volatility/plugins/volshell.py new file mode 100644 index 000000000..92651fe62 --- /dev/null +++ b/volatility/plugins/volshell.py @@ -0,0 +1,53 @@ +import code +import inspect + +from volatility.framework import renderers +from volatility.framework.configuration import requirements +from volatility.framework.interfaces import plugins + + +class Volshell(plugins.PluginInterface): + """Lists the processes present in a particular memory image""" + + @classmethod + def get_requirements(cls): + return [requirements.TranslationLayerRequirement(name = 'primary', + description = 'Kernel Address Space', + architectures = ["Intel32", "Intel64"])] + + def update_configuration(self): + """No operation since all values provided by config/requirements initially""" + + def run(self, additional_locals = None): + + # Provide some OS-agnostic convenience elements for ease + context = self.context + config = self.config + layer_name = self.config['primary'] + kvo = config.get('primary.kernel_virtual_offset', None) + members = lambda x: list(sorted(x.vol.members.keys())) + + # Determine locals + curframe = inspect.currentframe() + vars = curframe.f_globals.copy() + vars.update(curframe.f_locals) + if additional_locals is not None: + vars.update(additional_locals) + + # Try to enable tab completion + try: + import readline + except ImportError: + pass + else: + import rlcompleter + completer = rlcompleter.Completer(namespace = vars) + readline.set_completer(completer.complete) + readline.parse_and_bind("tab: complete") + print("Readline imported successfully") + + # TODO: provide help, consider generic functions (pslist?) and/or providing windows/linux functions + + code.interact(local = vars) + + return renderers.TreeGrid([], lambda: []) diff --git a/volatility/plugins/windows/volshell.py b/volatility/plugins/windows/volshell.py index 13582c31d..92ddeefac 100644 --- a/volatility/plugins/windows/volshell.py +++ b/volatility/plugins/windows/volshell.py @@ -1,9 +1,8 @@ -import code import inspect -from volatility.framework import renderers from volatility.framework.configuration import requirements from volatility.framework.interfaces import plugins +from volatility.plugins import volshell class Volshell(plugins.PluginInterface): @@ -11,13 +10,11 @@ class Volshell(plugins.PluginInterface): @classmethod def get_requirements(cls): - return [requirements.TranslationLayerRequirement(name = 'primary', - description = 'Kernel Address Space', - architectures = ["Intel32", "Intel64"]), - requirements.SymbolRequirement(name = "nt", description = "Windows OS"), - requirements.IntRequirement(name = 'pid', - description = "Process ID", - optional = True)] + return (volshell.Volshell.get_requirements() + + [requirements.SymbolRequirement(name = "nt", description = "Windows OS"), + requirements.IntRequirement(name = 'pid', + description = "Process ID", + optional = True)]) def update_configuration(self): """No operation since all values provided by config/requirements initially""" @@ -50,6 +47,8 @@ class Volshell(plugins.PluginInterface): yield proc def run(self): + # Determine locals + curframe = inspect.currentframe() # Provide some OS-agnostic convenience elements for ease context = self.context @@ -59,32 +58,13 @@ class Volshell(plugins.PluginInterface): nt = context.module(config['nt'], layer_name = layer_name, offset = kvo) ps = lambda: list(self.list_processes()) - members = lambda x: list(sorted(x.vol.members.keys())) pid = self.config.get('pid', None) eproc = None if pid: - eproc = [x for x in ps() if x.UniqueProcessId == pid] + for _x in ps(): + if _x.UniqueProcessId == pid: + eproc = _x + break - # Determine locals - curframe = inspect.currentframe() - vars = curframe.f_globals.copy() - vars.update(curframe.f_locals) - - # Try to enable tab completion - try: - import readline - except ImportError: - pass - else: - import rlcompleter - completer = rlcompleter.Completer(namespace = vars) - readline.set_completer(completer.complete) - readline.parse_and_bind("tab: complete") - print("Readline imported successfully") - - # TODO: provide help, consider generic functions (pslist?) and/or providing windows/linux functions - - code.interact(local = vars) - - return renderers.TreeGrid([], lambda: []) + return volshell.Volshell(self.context, "plugins.Volshell").run(curframe.f_locals)