forked from volatilityfoundation/volatility
-
Notifications
You must be signed in to change notification settings - Fork 3
/
vol.py
225 lines (188 loc) · 6.5 KB
/
vol.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
#!/usr/bin/env python
# -*- mode: python; -*-
#
# Volatility
# Copyright (C) 2007-2013 Volatility Foundation
#
# This file is part of Volatility.
#
# Volatility is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# Volatility is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Volatility. If not, see <http://www.gnu.org/licenses/>.
#
"""
@author: AAron Walters
@license: GNU General Public License 2.0
@contact: [email protected]
@organization: Volatility Foundation
"""
# pylint: disable-msg=C0111
import sys
if sys.version_info < (3, 6, 0):
sys.stderr.write(
"Volatility requires python version 3.6 or later, please upgrade your python installation."
)
sys.exit(1)
try:
import psyco # pylint: disable-msg=W0611,F0401
except ImportError:
pass
if False:
# Include a fake import for things like pyinstaller to hit
# since this is a dependency of the malware plugins
import yara
import textwrap
import operator
import volatility.conf as conf
config = conf.ConfObject()
import volatility.constants as constants
import volatility.registry as registry
import volatility.exceptions as exceptions
import volatility.obj as obj
import volatility.debug as debug
import volatility.addrspace as addrspace
import volatility.commands as commands
import volatility.scan as scan
config.add_option(
"INFO",
default=None,
action="store_true",
cache_invalidator=False,
help="Print information about all registered objects",
)
def list_plugins():
result = "\n\tSupported Plugin Commands:\n\n"
cmds = registry.get_plugin_classes(commands.Command, lower=True)
profs = registry.get_plugin_classes(obj.Profile)
if config.PROFILE == None:
config.update("PROFILE", "WinXPSP2x86")
if config.PROFILE not in profs:
raise BaseException("Invalid profile " + config.PROFILE + " selected")
profile = profs[config.PROFILE]()
wrongprofile = ""
for cmdname in sorted(cmds):
command = cmds[cmdname]
helpline = command.help() or ''
## Just put the title line (First non empty line) in this
## abbreviated display
for line in helpline.splitlines():
if line:
helpline = line
break
if command.is_valid_profile(profile):
result += "\t\t{0:15}\t{1}\n".format(cmdname, helpline)
else:
wrongprofile += "\t\t{0:15}\t{1}\n".format(cmdname, helpline)
if wrongprofile and config.VERBOSE:
result += "\n\tPlugins requiring a different profile:\n\n"
result += wrongprofile
return result
def command_help(command):
outputs = []
for item in dir(command):
if item.startswith("render_"):
outputs.append(item.split("render_", 1)[-1])
outputopts = "\nModule Output Options: " + "{0}\n".format(
"{0}".format("\n".join([", ".join(o for o in sorted(outputs))]))
)
result = textwrap.dedent(
"""
---------------------------------
Module {0}
---------------------------------\n""".format(
command.__class__.__name__
)
)
return outputopts + result + command.help() + "\n\n"
def print_info():
""" Returns the results """
categories = {
addrspace.BaseAddressSpace: 'Address Spaces',
commands.Command: 'Plugins',
obj.Profile: 'Profiles',
scan.ScannerCheck: 'Scanner Checks',
}
for c, n in sorted(categories.items(), key=operator.itemgetter(1)):
lower = c == commands.Command
plugins = registry.get_plugin_classes(c, lower=lower)
print("\n")
print("{0}".format(n))
print("-" * len(n))
result = []
max_length = 0
for clsname, cls in sorted(plugins.items()):
try:
doc = cls.__doc__.strip().splitlines()[0]
except AttributeError:
doc = 'No docs'
result.append((clsname, doc))
max_length = max(len(clsname), max_length)
for (name, doc) in result:
print("{0:{2}} - {1:15}".format(name, doc, max_length))
def main():
# Get the version information on every output from the beginning
# Exceptionally useful for debugging/telling people what's going on
sys.stderr.write(
"Volatility Foundation Volatility Framework {0}\n".format(
constants.VERSION
)
)
sys.stderr.flush()
# Setup the debugging format
debug.setup()
# Load up modules in case they set config options
registry.PluginImporter()
## Register all register_options for the various classes
registry.register_global_options(config, addrspace.BaseAddressSpace)
registry.register_global_options(config, commands.Command)
if config.INFO:
print_info()
sys.exit(0)
## Parse all the options now
config.parse_options(False)
# Reset the logging level now we know whether debug is set or not
debug.setup(config.DEBUG)
module = None
## Try to find the first thing that looks like a module name
cmds = registry.get_plugin_classes(commands.Command, lower=True)
for m in config.args:
if m in list(cmds.keys()):
module = m
break
if not module:
config.parse_options()
debug.error("You must specify something to do (try -h)")
try:
if module in list(cmds.keys()):
command = cmds[module](config)
## Register the help cb from the command itself
config.set_help_hook(obj.Curry(command_help, command))
config.parse_options()
if not config.LOCATION:
debug.error("Please specify a location (-l) or filename (-f)")
command.execute()
except exceptions.VolatilityException as e:
print(e)
if __name__ == "__main__":
config.set_usage(
usage="Volatility - A memory forensics analysis platform."
)
config.add_help_hook(list_plugins)
try:
main()
except Exception as ex:
if config.DEBUG:
debug.post_mortem()
else:
raise
except KeyboardInterrupt:
print("Interrupted")