Package modules :: Package processing :: Module memory :: Class VolatilityAPI
[hide private]
[frames] | no frames]

Class VolatilityAPI

source code

object --+
         |
        VolatilityAPI

Volatility API interface.

Instance Methods [hide private]
 
__init__(self, memdump, osprofile=None)
x.__init__(...) initializes x; see help(type(x)) for signature
source code
 
get_dtb(self)
Use psscan to get system dtb and apply it.
source code
 
init_config(self)
Creates a volatility configuration.
source code
 
pslist(self)
Volatility pslist plugin.
source code
 
psxview(self)
Volatility psxview plugin.
source code
 
callbacks(self)
Volatility callbacks plugin.
source code
 
idt(self)
Volatility idt plugin.
source code
 
gdt(self)
Volatility gdt plugin.
source code
 
ssdt(self)
Volatility ssdt plugin.
source code
 
timers(self)
Volatility timers plugin.
source code
 
messagehooks(self)
Volatility messagehooks plugin.
source code
 
getsids(self)
Volatility getsids plugin.
source code
 
privs(self)
Volatility privs plugin.
source code
 
malfind(self, dump_dir=None)
Volatility malfind plugin.
source code
 
yarascan(self)
Volatility yarascan plugin.
source code
 
apihooks(self)
Volatility apihooks plugin.
source code
 
dlllist(self)
Volatility dlllist plugin.
source code
 
handles(self)
Volatility handles plugin.
source code
 
ldrmodules(self)
Volatility ldrmodules plugin.
source code
 
mutantscan(self)
Volatility mutantscan plugin.
source code
 
devicetree(self)
Volatility devicetree plugin.
source code
 
svcscan(self)
Volatility svcscan plugin - scans for services.
source code
 
modscan(self)
Volatility modscan plugin.
source code
 
imageinfo(self)
Volatility imageinfo plugin.
source code
 
sockscan(self)
Volatility sockscan plugin.
source code
 
netscan(self)
Volatility sockscan plugin.
source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__init__(self, memdump, osprofile=None)
(Constructor)

source code 

x.__init__(...) initializes x; see help(type(x)) for signature

Parameters:
  • memdump - the memdump file path
  • osprofile - the profile (OS type)
Overrides: object.__init__

pslist(self)

source code 

Volatility pslist plugin. @see volatility/plugins/taskmods.py

psxview(self)

source code 

Volatility psxview plugin. @see volatility/plugins/malware/psxview.py

callbacks(self)

source code 

Volatility callbacks plugin. @see volatility/plugins/malware/callbacks.py

idt(self)

source code 

Volatility idt plugin. @see volatility/plugins/malware/idt.py

gdt(self)

source code 

Volatility gdt plugin. @see volatility/plugins/malware/idt.py

ssdt(self)

source code 

Volatility ssdt plugin. @see volatility/plugins/ssdt.py

timers(self)

source code 

Volatility timers plugin. @see volatility/plugins/malware/timers.py

messagehooks(self)

source code 

Volatility messagehooks plugin. @see volatility/plugins/malware/messagehooks.py

getsids(self)

source code 

Volatility getsids plugin. @see volatility/plugins/malware/getsids.py

privs(self)

source code 

Volatility privs plugin. @see volatility/plugins/malware/privs.py

malfind(self, dump_dir=None)

source code 

Volatility malfind plugin.

Parameters:
  • dump_dir - optional directory for dumps @see volatility/plugins/malware/malfind.py

yarascan(self)

source code 

Volatility yarascan plugin. @see volatility/plugins/malware/yarascan.py

apihooks(self)

source code 

Volatility apihooks plugin. @see volatility/plugins/malware/apihooks.py

dlllist(self)

source code 

Volatility dlllist plugin. @see volatility/plugins/taskmods.py

handles(self)

source code 

Volatility handles plugin. @see volatility/plugins/handles.py

ldrmodules(self)

source code 

Volatility ldrmodules plugin. @see volatility/plugins/malware/malfind.py

mutantscan(self)

source code 

Volatility mutantscan plugin. @see volatility/plugins/filescan.py

devicetree(self)

source code 

Volatility devicetree plugin. @see volatility/plugins/malware/devicetree.py

svcscan(self)

source code 

Volatility svcscan plugin - scans for services. @see volatility/plugins/malware/svcscan.py

modscan(self)

source code 

Volatility modscan plugin. @see volatility/plugins/modscan.py

imageinfo(self)

source code 

Volatility imageinfo plugin. @see volatility/plugins/imageinfo.py

sockscan(self)

source code 

Volatility sockscan plugin. @see volatility/plugins/sockscan.py

netscan(self)

source code 

Volatility sockscan plugin. @see volatility/plugins/netscan.py