volatilityfoundation / volatilityfoundation/volatility3

Write a cross platform plugin ?

Open
#868 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

question
Dominant language
Python
Stars
4.4k
Forks
705
Avg merge
1d 10h
Merged PRs (30d)
3

Description

Hey, I hope this is the right place to ask such question, sorry if it's not.

I'd like to write a plugin to analyze a specific application on any platform (Windows, Linux and MacOS). The idea would be to have a platform specific entry point that will gather all the needed information, and then dispatch it to a common processing function that will do the same thing regardless of the underlying OS.

I have not been able to find any online material on how to do such thing, feel free to redirect me to any external website.

Note that I'm not familiar at all with volatility's code, this is a first for me.

So, my plugin will depend on the PsList plugin (and probably others later), and I'd like to use the appropriate one depending on the OS being analyzed.

I was hoping I could do something like that :

class MyPlugin(PluginInterface):

    @classmethod
    def get_requirements(cls):
        if os == "Windows":
            from volatility3.framework.plugins.windows.pslist import PsList
            kernel_req = ModuleRequirement(name = 'kernel', description = 'Windows kernel', architectures = ["Intel32", "Intel64"])

        elif os == "Linux":
            from volatility3.framework.plugins.linux.pslist import PsList
            kernel_req = ModuleRequirement(name = 'kernel', description = 'Linux kernel', architectures = ["Intel32", "Intel64"])
        else:
            raise NotImplemented

        return [
            kernel_req,
            ListRequirement(name = 'pid',
                            element_type = int,
                            description = "PIDs to include (all other processes are excluded)",
                            optional = True),

            PluginRequirement(name = 'pslist',
                              plugin = PsList,
                              version=(2, 0, 0))
        ]

But get_requirements() being a class method, I guess there are no way to retrieve context information from there. So what's the best way to achieve that ? Is there a way to call other plugins at runtime (by runtime I mean in the run() function) even if the plugin was not listed as a requirement ?

Any help would be greatly appreciated, thanks for reading me !

EDIT: is it even possible to have a common function to analyze an application on any OS ? I was hoping the memory layout would be close enough on all platforms to allow me do to that. Any tips on how to abstract that would be appreciated as well :)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading PluginInterface.get_requirements() and run(), then compare the Windows and Linux pslist plugin entry points named in the issue. The issue does not define an implementation path or tests; done would require an agreed design for selecting platform-specific requirements and sharing analysis logic across operating systems.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
operating-systems, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.