volatility_gimp_helper.sh

volatility_gimp_helper.sh

# Observe process memory dump
function volatility_screenshot {
  OS=$1
  PID=$2
  if ! [ -f "/tmp/${PID}.memdump/${PID}.data" ]; then
    mkdir -p "/tmp/${PID}.memdump/"
    if [ "$OS" == "windows" ]; then
      volatility -f dump.raw --profile=Win7SP1x86_23418 memdump -p "${PID}" --dump-dir "/tmp/${PID}.memdump/"
      mv "/tmp/${PID}.memdump/${PID}.dmp" "/tmp/${PID}.memdump/${PID}.data"
    elif [ "$OS" == "mac" ]; then
      volatility -f dump.raw --profile=MacMountainLion_10_8_1_AMDx64 mac_memdump -p "${PID}" --dump-dir "/tmp/${PID}.memdump/"
      mv "/tmp/${PID}.memdump/"*.dmp "/tmp/${PID}.memdump/${PID}.data"
    else
      echo "Not implemented"
      return
    fi
  fi
  if ! [ -f "/tmp/${PID}.memdump/${PID}.data" ]; then
    echo "No data for Gimp... :("
    return
  fi
  gimp "/tmp/${PID}.memdump/${PID}.data"
}

# Usage
$ volatility_screenshot windows PID
$ volatility_screenshot mac PID