volatilityfoundation / volatilityfoundation/volatility3
Can I provide a plugin with requirements without running automagic?
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 4.4k
- Forks
- 705
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 3
Description
Hello everyone
I tried to connect volatility as a library to my script using the pslist plugin
I do everything according to the instructions, but I can't connect the parameters to the plugin, the check for unsatisfied does not pass, please tell me what is wrong.
framework.require_interface_version(1,0,2)
ctx = contexts.Context()
failures = framework.import_files(plugins, True)
plugin_list = framework.list_plugins()
ctx.config['automagic.LayerStacker.PsList.single_location'] = 'file:///OtterCTF.vmem'
config_path = path_join('plugins','windows.pslist.PsList','nt_symbols.class')
ctx.config['plugins.windows.pslist.PsList.nt_symbols.class'] = 'volatility3.framework.symbols.windows.WindowsKernelIntermedSymbols'
config_path = path_join('plugins','windows.pslist.PsList','nt_symbols.isf_url')
ctx.config['plugins.windows.pslist.PsList.nt_symbols.isf_url'] = 'file:///123.json'
unsatisfied = pslist.PsList.unsatisfied(ctx, 'plugins.windows.pslist.PsList')
available = automagic.available(ctx)
automagics = automagic.choose_automagic(available,pslist.PsList)
errors = automagic.run(automagics, ctx, pslist.PsList, 'plugins.windows.pslist.PsList')
print(unsatisfied)
Checking for unsatisfied returns the following
{'plugins.windows.pslist.PsList.primary': <TranslationLayerRequirement: primary>, 'plugins.windows.pslist.PsList.nt_symbols': <SymbolTableRequirement: nt_symbols>}
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the snippet with volatility3's framework, pslist.PsList.unsatisfied, and the automagic selection and run calls. Read the requirement handling around the primary and nt_symbols entries; done means the issue explains or supports supplying those requirements without automagic, with the unsatisfied result resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100