bridgeythegeek

My First PANDA

Introduction

Being someone who tries to play a lot with Windows memory, I really wanted to play with PANDA, but I was slightly scared because I'd never touched qemu before - all my experience had been with VirtualBox and VMware.

My goal was to install PANDA into a (relatively) clean install of Debian 8 'Jessie', capture a recording and successfully run a PANDA plugin.

1. Get PANDA

bridgeythegeek

import argparse
import cmd
import os
import sys

class MML(cmd.Cmd):
    """Handy lookup for Volatility's memmap output"""

    def __init__(self, map_file):
        cmd.Cmd.__init__(self)

bridgeythegeek

My First Volatility Plugin

This is out of date!

There is an updated version of this mini-tutorial which includes the much-encouraged unified_output.

Introduction

Although there are many excellent resources for learning Volatility available (The Art of Memory Forensics book, the vol-users mailing list, the Volatility Labs blog, and the Memory Analysis training course to name a few), I've never really seen a good absolute beginners guide to writing your first plugin. So if you find yourself needing that, hopefully this will help.

The Aim

bridgeythegeek

My First Volatility Plugin with Unified Output

Introduction

Although there are many excellent resources for learning Volatility available (The Art of Memory Forensics book, the vol-users mailing list, the Volatility Labs blog, and the Memory Analysis training course to name a few), I've never really seen a good absolute beginners guide to writing your first plugin. So if you find yourself needing that, hopefully this will help.

Also, it's worth checking out @jameshabben's post on the topic.

The Aim

bridgeythegeek

import argparse
import glob
import logging
import os

log = logging.getLogger(__name__)

# Gather the arguments
argp = argparse.ArgumentParser()
argp.add_argument('-v', '--verbose', action='store_const', dest='loglevel', const=logging.INFO, default=logging.WARNING)

bridgeythegeek

Keybase proof

I hereby claim:

• I am bridgeythegeek on github.
• I am bridgeythegeek (https://keybase.io/bridgeythegeek) on keybase.
• I have a public key ASAJ-OxLCfEIkwITQS5xLoD9lgpgRO_7k07y97yMGDYCSQo

To claim this, I am signing this object: