Skip to content

Instantly share code, notes, and snippets.

Keybase proof

I hereby claim:

  • I am bridgeythegeek on github.
  • I am bridgeythegeek (https://keybase.io/bridgeythegeek) on keybase.
  • I have a public key ASAJ-OxLCfEIkwITQS5xLoD9lgpgRO_7k07y97yMGDYCSQo

To claim this, I am signing this object:

@bridgeythegeek
bridgeythegeek / template_files.py
Last active March 22, 2020 15:05
python template for working with files
import argparse
import glob
import logging
import os
log = logging.getLogger(__name__)
# Gather the arguments
argp = argparse.ArgumentParser()
argp.add_argument('-v', '--verbose', action='store_const', dest='loglevel', const=logging.INFO, default=logging.WARNING)
@bridgeythegeek
bridgeythegeek / MyFirstVolatilityPluginWithUnifiedOutput.md
Last active April 24, 2020 13:52
My First Volatility Plugin with Unified Output

My First Volatility Plugin with Unified Output

Introduction

Although there are many excellent resources for learning Volatility available (The Art of Memory Forensics book, the vol-users mailing list, the Volatility Labs blog, and the Memory Analysis training course to name a few), I've never really seen a good absolute beginners guide to writing your first plugin. So if you find yourself needing that, hopefully this will help.

Also, it's worth checking out @jameshabben's post on the topic.

The Aim

@bridgeythegeek
bridgeythegeek / MyFirstVolatilityPlugin.md
Last active March 1, 2021 16:48
My First Volatility Plugin

My First Volatility Plugin

This is out of date!

There is an updated version of this mini-tutorial which includes the much-encouraged unified_output.

Introduction

Although there are many excellent resources for learning Volatility available (The Art of Memory Forensics book, the vol-users mailing list, the Volatility Labs blog, and the Memory Analysis training course to name a few), I've never really seen a good absolute beginners guide to writing your first plugin. So if you find yourself needing that, hopefully this will help.

The Aim

@bridgeythegeek
bridgeythegeek / mml.py
Created May 9, 2016 16:07
Lookup dump file offsets from Volatility's memmap/memdump plugins.
import argparse
import cmd
import os
import sys
class MML(cmd.Cmd):
"""Handy lookup for Volatility's memmap output"""
def __init__(self, map_file):
cmd.Cmd.__init__(self)
@bridgeythegeek
bridgeythegeek / MyFirstPANDA.md
Last active August 15, 2023 10:48
My First PANDA

My First PANDA

Introduction

Being someone who tries to play a lot with Windows memory, I really wanted to play with PANDA, but I was slightly scared because I'd never touched qemu before - all my experience had been with VirtualBox and VMware.

My goal was to install PANDA into a (relatively) clean install of Debian 8 'Jessie', capture a recording and successfully run a PANDA plugin.

1. Get PANDA