mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-22 22:32:22 +02:00
77 lines
2.9 KiB
Python
77 lines
2.9 KiB
Python
import argparse
|
|
import logging
|
|
import sys
|
|
|
|
import volatility.framework
|
|
import volatility.plugins
|
|
from volatility.cli import argparse_adapter
|
|
from volatility.framework import plugins, contexts
|
|
from volatility.framework.automagic import windows as windows_automagic
|
|
from volatility.framework.configuration import depresolver
|
|
from volatility.framework.configuration.depresolver import DependencyError
|
|
from volatility.framework.renderers.text import TextRenderer
|
|
|
|
__author__ = 'mike'
|
|
|
|
logging.basicConfig(filename = 'example.log', level = logging.DEBUG)
|
|
logger = logging.getLogger("volatility")
|
|
|
|
|
|
class CommandLine(object):
|
|
def __init__(self):
|
|
pass
|
|
|
|
def run(self):
|
|
ver = volatility.framework.version()
|
|
sys.stdout.write("Volatility Framework 3 (version " + "{0}.{1}.{2}".format(ver[0], ver[1], ver[2]) + ")\n")
|
|
|
|
volatility.framework.require_version(3, 0, 0)
|
|
|
|
# TODO: Get CLI config options
|
|
plugins.import_plugins()
|
|
|
|
# TODO: Choose a plugin
|
|
plugin = volatility.plugins.windows.pslist.PsList
|
|
parser = argparse.ArgumentParser(prog = 'volatility',
|
|
description = "An open-source memory forensics framework")
|
|
# argparse_adapter.adapt_config(context.config, parser)
|
|
|
|
# Run the argparser
|
|
parser.parse_args()
|
|
|
|
# Determine the selected plugin
|
|
# Resolve the dependencies on that plugin
|
|
dldr = depresolver.DependencyResolver()
|
|
deptree = dldr.build_tree(plugin)
|
|
|
|
# UI fills in the config:
|
|
ctx = contexts.Context()
|
|
ctx.config["pslist.primary.memory_layer.filename"] = "/run/media/mike/disk/memory/xp-laptop-2005-07-04-1430.img"
|
|
ctx.config["pslist.offset"] = 0x823c87c0
|
|
|
|
ctx.config["pslist.primary.memory_layer.filename"] = "/run/media/mike/disk/memory/private/jon-fres.dmp"
|
|
ctx.config["pslist.offset"] = 0x81bcc830
|
|
|
|
# ctx.config["pslist.primary.page_map_offset"] = 0x39000
|
|
|
|
config_path = plugin.__name__.lower()
|
|
|
|
windows = True
|
|
if windows:
|
|
# Traverse the dependency tree and tag the config with the appropriate page_map_offset values where not already applied
|
|
deptree.traverse(windows_automagic.PageMapOffsetHelper(context = ctx),
|
|
config_path = config_path,
|
|
short_circuit = False)
|
|
|
|
# Walk down the tree attempting to fulfil each requirement (recursive) and backtrack when necessary
|
|
# Translate the parsed args to a context configuration
|
|
if dldr.validate_dependencies(deptree, context = ctx, path = config_path):
|
|
# Construct and run the plugin
|
|
TextRenderer().render(plugin(ctx, config_path).run())
|
|
else:
|
|
raise DependencyError("Unable to validate all the dependencies, please check configuration parameters")
|
|
|
|
|
|
def main():
|
|
CommandLine().run()
|