modules.processing.memory.VolatilityAPI

Package modules :: Package processing :: Module memory :: Class VolatilityAPI |
[hide private]
[frames] | no frames]

# Class VolatilityAPI

source code

    object --+
             |
            VolatilityAPI

Volatility API interface.

Instance Methods | [hide private]
__init__(self, memdump, osprofile=None) x.__init__(...) initializes x; see help(type(x)) for signature | source code
get_dtb(self) Use psscan to get system dtb and apply it. | source code
init_config(self) Creates a volatility configuration. | source code
pslist(self) Volatility pslist plugin. | source code
psxview(self) Volatility psxview plugin. | source code
callbacks(self) Volatility callbacks plugin. | source code
idt(self) Volatility idt plugin. | source code
gdt(self) Volatility gdt plugin. | source code
ssdt(self) Volatility ssdt plugin. | source code
timers(self) Volatility timers plugin. | source code
messagehooks(self) Volatility messagehooks plugin. | source code
getsids(self) Volatility getsids plugin. | source code
privs(self) Volatility privs plugin. | source code
malfind(self, dump_dir=None) Volatility malfind plugin. | source code
yarascan(self) Volatility yarascan plugin. | source code
apihooks(self) Volatility apihooks plugin. | source code
dlllist(self) Volatility dlllist plugin. | source code
handles(self) Volatility handles plugin. | source code
ldrmodules(self) Volatility ldrmodules plugin. | source code
mutantscan(self) Volatility mutantscan plugin. | source code
devicetree(self) Volatility devicetree plugin. | source code
svcscan(self) Volatility svcscan plugin - scans for services. | source code
modscan(self) Volatility modscan plugin. | source code
imageinfo(self) Volatility imageinfo plugin. | source code
sockscan(self) Volatility sockscan plugin. | source code
netscan(self) Volatility sockscan plugin. | source code
Inherited from `object`: `__delattr__`, `__format__`, `__getattribute__`, `__hash__`, `__new__`, `__reduce__`, `__reduce_ex__`, `__repr__`, `__setattr__`, `__sizeof__`, `__str__`, `__subclasshook__`

Properties | [hide private]
Inherited from `object`: `__class__`

Method Details | [hide private]

### __init__(self, memdump, osprofile=None) (Constructor) | source code
x.__init__(...) initializes x; see help(type(x)) for signature Parameters: `memdump` - the memdump file path `osprofile` - the profile (OS type) Overrides: object.__init__

### pslist(self) | source code
Volatility pslist plugin. @see volatility/plugins/taskmods.py

### psxview(self) | source code
Volatility psxview plugin. @see volatility/plugins/malware/psxview.py

### callbacks(self) | source code
Volatility callbacks plugin. @see volatility/plugins/malware/callbacks.py

### idt(self) | source code
Volatility idt plugin. @see volatility/plugins/malware/idt.py

### gdt(self) | source code
Volatility gdt plugin. @see volatility/plugins/malware/idt.py

### ssdt(self) | source code
Volatility ssdt plugin. @see volatility/plugins/ssdt.py

### timers(self) | source code
Volatility timers plugin. @see volatility/plugins/malware/timers.py

### messagehooks(self) | source code
Volatility messagehooks plugin. @see volatility/plugins/malware/messagehooks.py

### getsids(self) | source code
Volatility getsids plugin. @see volatility/plugins/malware/getsids.py

### privs(self) | source code
Volatility privs plugin. @see volatility/plugins/malware/privs.py

### malfind(self, dump_dir=None) | source code
Volatility malfind plugin. Parameters: `dump_dir` - optional directory for dumps @see volatility/plugins/malware/malfind.py

### yarascan(self) | source code
Volatility yarascan plugin. @see volatility/plugins/malware/yarascan.py

### apihooks(self) | source code
Volatility apihooks plugin. @see volatility/plugins/malware/apihooks.py

### dlllist(self) | source code
Volatility dlllist plugin. @see volatility/plugins/taskmods.py

### handles(self) | source code
Volatility handles plugin. @see volatility/plugins/handles.py

### ldrmodules(self) | source code
Volatility ldrmodules plugin. @see volatility/plugins/malware/malfind.py

### mutantscan(self) | source code
Volatility mutantscan plugin. @see volatility/plugins/filescan.py

### devicetree(self) | source code
Volatility devicetree plugin. @see volatility/plugins/malware/devicetree.py

### svcscan(self) | source code
Volatility svcscan plugin - scans for services. @see volatility/plugins/malware/svcscan.py

### modscan(self) | source code
Volatility modscan plugin. @see volatility/plugins/modscan.py

### imageinfo(self) | source code
Volatility imageinfo plugin. @see volatility/plugins/imageinfo.py

### sockscan(self) | source code
Volatility sockscan plugin. @see volatility/plugins/sockscan.py

### netscan(self) | source code
Volatility sockscan plugin. @see volatility/plugins/netscan.py