search

volatilityfoundation / volatility3

Volatility 3.0 development
http://volatilityfoundation.org/
Other
2.72k stars 461 forks source link

Add pedump plugin and unified API for extracting PE files to disk #1204

Closed atcuno closed 4 months ago

atcuno commented 4 months ago

This addresses all the feedback from the previous pedump PR as well as adds a unified API for extracting files. The previous dump_pe API in Volatility was specific to LDR_DATA_TABLE_ENTRY instances, which is how DLLs and kernel modules are tracked. The changes in this PR provide unified APIs for extracting the LDR instances plus PE files at any base address in process or kernel memory. Kernel modules are extracted in the correct session layer by default. Version number bumped for dlllist and correct requirements in place for pedump.

atcuno commented 4 months ago

All the feedback is addressed now.