ikelos
commented
1 year ago Hi there, so the reason for not combining everything is because scanning for all possible operating systems to find the right one can be time consuming and also may result in an image being classed as both windows as well as linux/mac or being classed as neither. The ModuleRequirement name isn't important, so you could just have one called 'kernel', no need to duplicate those. You'd need to depend on all the pslist plugins you'd want to use (the windows, linux and mac ones) since PsList in your example above is actually imported from a specific python module.
You'd then need some way to figure out which operating system volatility had found when it made your kernel, but the associated SymbolTable or possibly even the layer's metadata field might tell you, so that's probably not too difficult?
The trick of the plugins happening to have the same parameter names is coincidence, and will likely not hold up for all plugins, and you're right, you can't decide beforehand which parameters to ask for, because you haven't done anything with the image yet! That means you'll need to ask for all the possible parameters you may need and then figure out how to populate the configuration with the details you've got, that'll be the glue that joins the plugins together into one.
The memory layout is dependent on the architecture, so that is common for most of the operating systems but the structure of processes and the way they work/the information that's relevant to them, that's all OS specific. As such, I'm not sure I'd get your hopes up about being able to have one tool that automatically does everything you want?
Hope that helps answer your question?
ShellCode33
Hey, I hope this is the right place to ask such question, sorry if it's not.
I'd like to write a plugin to analyze a specific application on any platform (Windows, Linux and MacOS). The idea would be to have a platform specific entry point that will gather all the needed information, and then dispatch it to a common processing function that will do the same thing regardless of the underlying OS.
I have not been able to find any online material on how to do such thing, feel free to redirect me to any external website.
Note that I'm not familiar at all with volatility's code, this is a first for me.
So, my plugin will depend on the PsList plugin (and probably others later), and I'd like to use the appropriate one depending on the OS being analyzed.
I was hoping I could do something like that :
But
get_requirements()being a class method, I guess there are no way to retrieve context information from there. So what's the best way to achieve that ? Is there a way to call other plugins at runtime (by runtime I mean in therun()function) even if the plugin was not listed as a requirement ?Any help would be greatly appreciated, thanks for reading me !
EDIT: is it even possible to have a common function to analyze an application on any OS ? I was hoping the memory layout would be close enough on all platforms to allow me do to that. Any tips on how to abstract that would be appreciated as well :)