Python registry.PluginImporter方法代码示例

# 需要导入模块: from volatility import registry [as 别名]
# 或者: from volatility.registry import PluginImporter [as 别名]
def __init__(self, memdump, osprofile=None):
        """@param memdump: the memdump file path
        @param osprofile: the profile (OS type)
        """
        registry.PluginImporter()
        self.memdump = memdump
        self.osprofile = osprofile
        self.config = None
        self.addr_space = None
        self.__config() 

# 需要导入模块: from volatility import registry [as 别名]
# 或者: from volatility.registry import PluginImporter [as 别名]
def vol_profiles(self):
        '''
        Load available Volatility profiles

        @return: the list of loaded Volatility profiles
        '''
        prof = obj.Profile
        registry.PluginImporter()
        profList = sorted([i.__name__.split('.')[-1] for i in prof.__subclasses__()])
        return profList 

# 需要导入模块: from volatility import registry [as 别名]
# 或者: from volatility.registry import PluginImporter [as 别名]
def __init__(self, profile, mem_path):
        """
        setup base config
        :param profile:
        :param mem_path:
        :return:
        """
        debug.setup()
        registry.PluginImporter()
        self.memdump = mem_path
        self.osprofile = profile
        self.config = None
        self.addr_space = None
        self.init_config() 

# 需要导入模块: from volatility import registry [as 别名]
# 或者: from volatility.registry import PluginImporter [as 别名]
def __init__(self, path, profile='WinXPSP2x86'):
        self.config = conf.ConfObject()
        registry.PluginImporter()
        registry.register_global_options(self.config, commands.Command)
        registry.register_global_options(self.config, addrspace.BaseAddressSpace)
        # self.config.parse_options()
        self.config.PROFILE = profile
        self.config.LOCATION = "file://" + path
        self.Memory = utils.load_as(self.config)
        self.Processes = self.__getProcesses()
        self.Threads = self.__getThreads() 

# 需要导入模块: from volatility import registry [as 别名]
# 或者: from volatility.registry import PluginImporter [as 别名]
def main():

    # Get the version information on every output from the beginning
    # Exceptionally useful for debugging/telling people what's going on
    sys.stderr.write("Volatility Foundation Volatility Framework {0}\n".format(constants.VERSION))
    sys.stderr.flush()

    # Setup the debugging format
    debug.setup()
    # Load up modules in case they set config options
    registry.PluginImporter()

    ## Register all register_options for the various classes
    registry.register_global_options(config, addrspace.BaseAddressSpace)
    registry.register_global_options(config, commands.Command)

    if config.INFO:
        print_info()
        sys.exit(0)

    ## Parse all the options now
    config.parse_options(False)
    # Reset the logging level now we know whether debug is set or not
    debug.setup(config.DEBUG)

    module = None
    ## Try to find the first thing that looks like a module name
    cmds = registry.get_plugin_classes(commands.Command, lower = True)
    for m in config.args:
        if m in cmds.keys():
            module = m
            break

    if not module:
        config.parse_options()
        debug.error("You must specify something to do (try -h)")

    try:
        if module in cmds.keys():
            command = cmds[module](config)

            ## Register the help cb from the command itself
            config.set_help_hook(obj.Curry(command_help, command))
            config.parse_options()

            if not config.LOCATION:
                debug.error("Please specify a location (-l) or filename (-f)")

            command.execute()
    except exceptions.VolatilityException, e:
        print e 

# 需要导入模块: from volatility import registry [as 别名]
# 或者: from volatility.registry import PluginImporter [as 别名]
def __init__(self, profile, kdbg, memimg):
        '''
        @profile: a Volatality profile string
        @kdbg: a kdbg address string
        @memimg: a memory image file name
        '''
        # volatility black magic
        registry.PluginImporter()
        self.config = conf.ConfObject()
        self.config.optparser.set_conflict_handler(handler="resolve")
        registry.register_global_options(self.config, commands.Command)

        if memimg:
          
            self.base_conf = {'profile': profile,
                'use_old_as': None,
                'kdbg': None if kdbg is None else int(kdbg, 16),
                'help': False,
                'kpcr': None,
                'tz': None,
                'pid': None,
                'output_file': None,
                'physical_offset': None,
                'conf_file': None,
                'dtb': None,
                'output': None,
                'info': None,
                'location': "file://" + memimg,
                'plugins': None,
                'debug': None,
                'cache_dtb': True,
                'filename': None,
                'cache_directory': None,
                'verbose': None,
                'write': False}

            # set the default config
            for k, v in self.base_conf.items():
                self.config.update(k, v)
         
            if profile == None:
                profile = self.guess_profile(memimg)
                sys.stderr.write("Using profile: %s\n" % profile)