mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-21 14:02:22 +02:00
54 lines
1.9 KiB
Python
54 lines
1.9 KiB
Python
import code
|
|
import inspect
|
|
|
|
from volatility.framework import renderers
|
|
from volatility.framework.configuration import requirements
|
|
from volatility.framework.interfaces import plugins
|
|
|
|
|
|
class Volshell(plugins.PluginInterface):
|
|
"""Shell environment to directly interact with a memory image"""
|
|
|
|
@classmethod
|
|
def get_requirements(cls):
|
|
return [requirements.TranslationLayerRequirement(name = 'primary',
|
|
description = 'Kernel Address Space',
|
|
architectures = ["Intel32", "Intel64"])]
|
|
|
|
def update_configuration(self):
|
|
"""No operation since all values provided by config/requirements initially"""
|
|
|
|
def run(self, additional_locals = None):
|
|
|
|
# Provide some OS-agnostic convenience elements for ease
|
|
context = self.context
|
|
config = self.config
|
|
layer_name = self.config['primary']
|
|
kvo = context.memory[layer_name].config.get('kernel_virtual_offset')
|
|
members = lambda x: list(sorted(x.vol.members.keys()))
|
|
|
|
# Determine locals
|
|
curframe = inspect.currentframe()
|
|
vars = curframe.f_globals.copy()
|
|
vars.update(curframe.f_locals)
|
|
if additional_locals is not None:
|
|
vars.update(additional_locals)
|
|
|
|
# Try to enable tab completion
|
|
try:
|
|
import readline
|
|
except ImportError:
|
|
pass
|
|
else:
|
|
import rlcompleter
|
|
completer = rlcompleter.Completer(namespace = vars)
|
|
readline.set_completer(completer.complete)
|
|
readline.parse_and_bind("tab: complete")
|
|
print("Readline imported successfully")
|
|
|
|
# TODO: provide help, consider generic functions (pslist?) and/or providing windows/linux functions
|
|
|
|
code.interact(local = vars)
|
|
|
|
return renderers.TreeGrid([], lambda: [])
|