mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-21 22:12:23 +02:00
65 lines
2.3 KiB
Python
65 lines
2.3 KiB
Python
from volatility import framework
|
|
|
|
__author__ = 'mike'
|
|
|
|
import sys
|
|
import logging
|
|
import volatility.framework
|
|
import volatility.plugins
|
|
from volatility.framework import plugins, config, contexts
|
|
|
|
logging.basicConfig(filename='example.log',level = logging.DEBUG)
|
|
logger = logging.getLogger("volatility")
|
|
|
|
class CommandLine(object):
|
|
def __init__(self):
|
|
pass
|
|
|
|
def run(self):
|
|
ver = volatility.framework.version()
|
|
sys.stdout.write("Volatility Framework 3 (version " + "{0}.{1}.{2}".format(ver[0], ver[1], ver[2]) + ")\n")
|
|
|
|
volatility.framework.require_version(3,0,0)
|
|
|
|
#TODO: Get global config options
|
|
plugins.import_plugins()
|
|
|
|
#TODO: Choose a plugin
|
|
plugin = volatility.plugins.windows.pslist.PsList
|
|
context = self.handle_plugin_requirements(plugin)
|
|
|
|
# Construct the plugin
|
|
runner = plugin(context)
|
|
# Run the plugin
|
|
runner()
|
|
|
|
def construct_layer_factory(self, name):
|
|
"""Turns a configuration from a plugin into a """
|
|
factory = contexts.LayerFactory(name, [contexts.physical.PhysicalContextModifier,
|
|
contexts.intel.IntelContextModifier,
|
|
contexts.windows.WindowsContextModifier])
|
|
return factory
|
|
|
|
def handle_plugin_requirements(self, plugin):
|
|
"""Populates the input values for the plugin"""
|
|
reqs = plugin.requirements()
|
|
context = contexts.Context()
|
|
|
|
for req in reqs:
|
|
context.config.add_item(req, plugin.__name__)
|
|
if isinstance(req, config.TranslationLayerRequirement):
|
|
# Choose an appropriate LayerFactory (add layer to the req.name so we don't blat the requirement itself
|
|
namespace = config.namespace_join([plugin.__name__, req.name + "_layer"])
|
|
factory = self.construct_layer_factory(namespace)
|
|
facreqs = factory.requirements()
|
|
for facreq in facreqs:
|
|
context.config.add_item(facreq, namespace = namespace)
|
|
#TODO: Validate factory requirements
|
|
context = factory(context)
|
|
context.config.get(config.namespace_join([plugin.__name__, req.name])).value = 'intel'
|
|
return context
|
|
|
|
|
|
|
|
def main():
|
|
CommandLine().run() |