The Volatility Framework
 All Classes Functions Variables
volatility.commands.Command Class Reference

Base class for each plugin command. More...

Inheritance diagram for volatility.commands.Command:
volatility.plugins.common.AbstractWindowsCommand volatility.plugins.imagecopy.ImageCopy volatility.plugins.linux.common.AbstractLinuxCommand volatility.plugins.mac.common.AbstractMacCommand volatility.plugins.mbrparser.MBRParser volatility.plugins.patcher.Patcher volatility.plugins.registry.shimcache.ShimCache volatility.plugins.bigpagepools.BigPools volatility.plugins.bioskbd.BiosKbd volatility.plugins.common.AbstractScanCommand volatility.plugins.connections.Connections volatility.plugins.crashinfo.CrashInfo volatility.plugins.dumpfiles.DumpFiles volatility.plugins.evtlogs.EvtLogs volatility.plugins.getservicesids.GetServiceSids volatility.plugins.gui.atoms.Atoms volatility.plugins.gui.clipboard.Clipboard volatility.plugins.gui.gditimers.GDITimers volatility.plugins.gui.sessions.Sessions volatility.plugins.hibinfo.HibInfo volatility.plugins.kdbgscan.KDBGScan volatility.plugins.kpcrscan.KPCRScan volatility.plugins.malware.cmdhistory.CmdScan volatility.plugins.malware.idt.GDT volatility.plugins.malware.idt.IDT volatility.plugins.malware.impscan.ImpScan volatility.plugins.malware.psxview.PsXview volatility.plugins.malware.svcscan.SvcScan volatility.plugins.malware.timers.Timers volatility.plugins.mftparser.MFTParser volatility.plugins.modules.Modules volatility.plugins.modules.UnloadedModules volatility.plugins.pooltracker.PoolPeek volatility.plugins.pooltracker.PoolTracker volatility.plugins.pstree.PSTree volatility.plugins.registry.auditpol.Auditpol volatility.plugins.registry.dumpregistry.DumpRegistry volatility.plugins.registry.lsadump.CacheDump volatility.plugins.registry.lsadump.HashDump volatility.plugins.registry.lsadump.LSADump volatility.plugins.registry.printkey.HiveDump volatility.plugins.registry.shellbags.ShellBags volatility.plugins.registry.userassist.UserAssist volatility.plugins.sockets.Sockets volatility.plugins.ssdt.SSDT volatility.plugins.strings.Strings volatility.plugins.taskmods.DllList volatility.plugins.tcaudit.TrueCryptMaster volatility.plugins.tcaudit.TrueCryptPassphrase volatility.plugins.tcaudit.TrueCryptSummary volatility.plugins.timeliner.TimeLiner volatility.plugins.volshell.volshell volatility.plugins.raw2dmp.Raw2dmp volatility.plugins.linux.common.AbstractLinuxARMCommand volatility.plugins.linux.common.AbstractLinuxIntelCommand volatility.plugins.mac.apihooks_kernel.mac_apihooks_kernel volatility.plugins.mac.check_mig_table.mac_check_mig_table volatility.plugins.mac.check_syscall_shadow.mac_check_syscall_shadow volatility.plugins.mac.check_syscall_table.mac_check_syscalls volatility.plugins.mac.check_sysctl.mac_check_sysctl volatility.plugins.mac.check_trap_table.mac_check_trap_table volatility.plugins.mac.dmesg.mac_dmesg volatility.plugins.mac.dump_files.mac_dump_file volatility.plugins.mac.find_aslr_shift.mac_find_aslr_shift volatility.plugins.mac.gkextmap.mac_lsmod_kext_map volatility.plugins.mac.ifconfig.mac_ifconfig volatility.plugins.mac.list_files.mac_list_files volatility.plugins.mac.list_zones.mac_list_zones volatility.plugins.mac.lsmod.mac_lsmod volatility.plugins.mac.lsmod_iokit.mac_lsmod_iokit volatility.plugins.mac.machine_info.mac_machine_info volatility.plugins.mac.moddump.mac_moddump volatility.plugins.mac.mount.mac_mount volatility.plugins.mac.netconns.mac_network_conns volatility.plugins.mac.print_boot_cmdline.mac_print_boot_cmdline volatility.plugins.mac.pslist.mac_pslist volatility.plugins.mac.psxview.mac_psxview volatility.plugins.mac.route.mac_route volatility.plugins.mac.version.mac_version

Public Member Functions

def __init__
 Constructor uses args as an initializer. More...
 
def help
 This function returns a string that will be displayed when a user lists available plugins.
 
def calculate
 This function is responsible for performing all calculations. More...
 
def execute
 Executes the plugin command. More...
 
def format_value
 Formats an individual field using the table formatting codes.
 
def table_header
 Table header renders the title row of a table. More...
 
def table_row
 Outputs a single row of a table.
 

Static Public Member Functions

def register_options
 Registers options into a config object provided.
 
def is_valid_profile
 

Static Public Attributes

string op = ""
 
string opts = ""
 
string args = ""
 
string cmdname = ""
 
dictionary meta_info = {}
 
 elide_data = True
 
string tablesep = " "
 

Detailed Description

Base class for each plugin command.

Constructor & Destructor Documentation

def volatility.commands.Command.__init__ (   self,
  config,
  _args,
  _kwargs 
)

Constructor uses args as an initializer.

It creates an instance of OptionParser, populates the options, and finally parses the command line. Options are stored in the self.opts attribute.

Member Function Documentation

def volatility.commands.Command.calculate (   self)

This function is responsible for performing all calculations.

We should not have any output functions (e.g. print) in this function at all.

If this function is expected to take a long time to return some data, the function should return a generator.

def volatility.commands.Command.execute (   self)

Executes the plugin command.

def volatility.commands.Command.table_header (   self,
  outfd,
  title_format_list = None 
)

Table header renders the title row of a table.

This also stores the header types to ensure everything is formatted appropriately. It must be a list of tuples rather than a dict for ordering purposes.


The documentation for this class was generated from the following file: