Skip to content

Instantly share code, notes, and snippets.

@deeso
Created April 27, 2015 17:57
Show Gist options
  • Save deeso/7121947364de5ffb94d6 to your computer and use it in GitHub Desktop.
Save deeso/7121947364de5ffb94d6 to your computer and use it in GitHub Desktop.
Basic usage of volatility as a library (from way back when, http://dsocon.blogspot.com/2012/08/using-volatility-framework-as-library.html)
# basic recreation of the connections
# command using Volatility Framework
# as a Library
import volatility.conf as conf
import volatility.registry as registry
import volatility.commands as commands
import volatility.win32.network as network
import volatility.utils as utils
# configure volatility
registry.PluginImporter()
config = conf.ConfObject()
registry.register_global_options(config, commands.Command)
the_file = "file:///winxpsp3_analysis_img.bin"
# default config (note my .volatilityrc is missing some values,
# so I just used pdb to figure out which values needed setting
base_conf = {'profile': 'WinXPSP3x86',
'use_old_as': None,
'kdbg': None,
'help': False,
'kpcr': None,
'tz': None,
'pid': None,
'output_file': None,
'physical_offset': None,
'conf_file': None,
'dtb': None,
'output': None,
'info': None,
'location': the_file,
'plugins': None,
'debug': None,
'cache_dtb': True,
'filename': None,
'cache_directory': None,
'verbose': None, 'write':False}
# set the default config
for k,v in base_conf.items():
config.update(k, v)
# configuration complete
# now load up the address space
# pretty interesting to note that this is actually an iterative process
# first the FileAddressSpace from plugins/addr_spaces/standard/ is created
# with the file, and then a JKIA32PagedMemoryPae from volatility/plugins/addrspaces/intel
# is created. If ['write', 'cache_dtb', 'kdbg'] are not set, this fails
addr_space = utils.load_as(config)
# now create the connections like in
# plugins/connections.py
conns = [conn for conn in network.determine_connections(addr_space)]
for i in conns:
offset = conn.obj_vm.vtop(conn.obj_offset)
local = "{0}:{1}".format(conn.LocalIpAddress, conn.LocalPort)
remote = "{0}:{1}".format(conn.RemoteIpAddress, conn.RemotePort)
print ('w00t, now I know that %s ===> %s'%(local, remote))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment