volatilityfoundation / volatilityfoundation/volatility3
Write a cross platform plugin ?
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 4.4k
- Forks
- 705
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 3
Description
Hey, I hope this is the right place to ask such question, sorry if it's not.
I'd like to write a plugin to analyze a specific application on any platform (Windows, Linux and MacOS). The idea would be to have a platform specific entry point that will gather all the needed information, and then dispatch it to a common processing function that will do the same thing regardless of the underlying OS.
I have not been able to find any online material on how to do such thing, feel free to redirect me to any external website.
Note that I'm not familiar at all with volatility's code, this is a first for me.
So, my plugin will depend on the PsList plugin (and probably others later), and I'd like to use the appropriate one depending on the OS being analyzed.
I was hoping I could do something like that :
class MyPlugin(PluginInterface):
@classmethod
def get_requirements(cls):
if os == "Windows":
from volatility3.framework.plugins.windows.pslist import PsList
kernel_req = ModuleRequirement(name = 'kernel', description = 'Windows kernel', architectures = ["Intel32", "Intel64"])
elif os == "Linux":
from volatility3.framework.plugins.linux.pslist import PsList
kernel_req = ModuleRequirement(name = 'kernel', description = 'Linux kernel', architectures = ["Intel32", "Intel64"])
else:
raise NotImplemented
return [
kernel_req,
ListRequirement(name = 'pid',
element_type = int,
description = "PIDs to include (all other processes are excluded)",
optional = True),
PluginRequirement(name = 'pslist',
plugin = PsList,
version=(2, 0, 0))
]
But get_requirements() being a class method, I guess there are no way to retrieve context information from there. So what's the best way to achieve that ? Is there a way to call other plugins at runtime (by runtime I mean in the run() function) even if the plugin was not listed as a requirement ?
Any help would be greatly appreciated, thanks for reading me !
EDIT: is it even possible to have a common function to analyze an application on any OS ? I was hoping the memory layout would be close enough on all platforms to allow me do to that. Any tips on how to abstract that would be appreciated as well :)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading PluginInterface.get_requirements() and run(), then compare the Windows and Linux pslist plugin entry points named in the issue. The issue does not define an implementation path or tests; done would require an agreed design for selecting platform-specific requirements and sharing analysis logic across operating systems.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- operating-systems, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100