mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-21 05:52:22 +02:00
85 lines
3.1 KiB
Python
85 lines
3.1 KiB
Python
import code
|
|
import inspect
|
|
import typing
|
|
|
|
from volatility.framework import renderers, interfaces
|
|
from volatility.framework.configuration import requirements
|
|
|
|
|
|
class Volshell(interfaces.plugins.PluginInterface):
|
|
"""Shell environment to directly interact with a memory image"""
|
|
|
|
@classmethod
|
|
def get_requirements(cls):
|
|
return [requirements.TranslationLayerRequirement(name = 'primary',
|
|
description = 'Kernel Address Space',
|
|
architectures = ["Intel32", "Intel64"])]
|
|
|
|
def run(self, additional_locals: typing.Dict[str, typing.Any] = None) -> interfaces.renderers.TreeGrid:
|
|
"""Runs the interactive volshell plugin
|
|
|
|
Returns:
|
|
Return a TreeGrid but this is always empty since the point of this plugin is to run interactively
|
|
|
|
"""
|
|
|
|
# Provide some OS-agnostic convenience elements for ease
|
|
context = self.context
|
|
config = self.config
|
|
layer_name = self.config['primary']
|
|
kvo = context.memory[layer_name].config.get('kernel_virtual_offset')
|
|
members = lambda x: list(sorted(x.vol.members))
|
|
|
|
# Determine locals
|
|
curframe = inspect.currentframe()
|
|
vars = {} # type: typing.Dict[str, typing.Any]
|
|
if curframe:
|
|
vars = curframe.f_globals.copy()
|
|
vars.update(curframe.f_locals)
|
|
if additional_locals is not None:
|
|
vars.update(additional_locals)
|
|
|
|
vars.update(self.load_functions())
|
|
|
|
# Try to enable tab completion
|
|
try:
|
|
import readline
|
|
except ImportError:
|
|
pass
|
|
else:
|
|
import rlcompleter
|
|
completer = rlcompleter.Completer(namespace = vars)
|
|
readline.set_completer(completer.complete)
|
|
readline.parse_and_bind("tab: complete")
|
|
print("Readline imported successfully")
|
|
|
|
# TODO: provide help, consider generic functions (pslist?) and/or providing windows/linux functions
|
|
|
|
code.interact(local = vars)
|
|
|
|
return renderers.TreeGrid([], None)
|
|
|
|
def load_functions(self) -> typing.Dict[str, typing.Callable]:
|
|
"""Returns a dictionary listing the functions to be added to the environment"""
|
|
return {"dt": self.display_type}
|
|
|
|
def display_type(self, object: interfaces.objects.ObjectInterface):
|
|
"""Display Type"""
|
|
longest_member = longest_offset = 0
|
|
for member in object.vol.members:
|
|
relative_offset, member_type = object.vol.members[member]
|
|
longest_member = max(len(member), longest_member)
|
|
longest_offset = max(len(hex(relative_offset)), longest_offset)
|
|
|
|
for member in object.vol.members:
|
|
relative_offset, member_type = object.vol.members[member]
|
|
len_offset = len(hex(relative_offset))
|
|
len_member = len(member)
|
|
print(" " * (longest_offset - len_offset),
|
|
hex(relative_offset),
|
|
"\t\t",
|
|
member,
|
|
" " * (longest_member - len_member),
|
|
"\t\t",
|
|
member_type.vol.type_name)
|