Skip to content

Commit e7d8a6a

Browse files
authored
Merge pull request #193 from Wenzel/doc/volatility/asciinema
doc: update integration
2 parents 84c94d4 + f06ecc4 commit e7d8a6a

File tree

1 file changed

+12
-9
lines changed

1 file changed

+12
-9
lines changed

doc/src/tutorial/integration/volatility3.md

+12-9
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,11 @@ Combined with libmicrovmi, you can run volatility3 on top of a live virtual mach
88
Thanks to volatility3's modular architecture the libmicrovmi integration doesn't require any upstream modification.
99
Instead we need to indicate to volatility3 how to locate our plugin.
1010

11+
# Setup
12+
1113
This guide assumes you already have a working installation of libmicrovmi Python in a virtualenv.
1214
Please refer to the [documentation](https://wenzel.github.io/libmicrovmi/tutorial/installation.html).
1315

14-
# Setup
15-
1616
We need the development version of volatility3, from git:
1717

1818
~~~
@@ -21,21 +21,20 @@ We need the development version of volatility3, from git:
2121
(venv) $ pip install .
2222
~~~
2323

24-
The `microvmi` python package comes with a [`volatility`](https://github.com/Wenzel/libmicrovmi/tree/master/python/microvmi/volatility) directory which contains the connection plugin.
24+
The `microvmi` python package comes with a [`volatility`](https://github.com/Wenzel/libmicrovmi/tree/master/python/microvmi/volatility)
25+
directory which contains the connection plugin.
2526

2627
We need to add this directory to volatility's search path.
2728

2829
To locate the volatility directory in your `venv`:
2930

3031
~~~
3132
(venv) $ find venv/ -type d -wholename '*microvmi/volatility*'
32-
venv/lib/python3.8/site-packages/microvmi-0.0.2-py3.8-linux-x86_64.egg/microvmi/volatility
33+
venv/lib/python3.7/site-packages/microvmi/volatility
3334
~~~
3435

3536
# Usage
3637

37-
To run volatility3 with libmicrovmi, specify the additional plugin path with flag `-p`.
38-
3938
## VMI scheme URL
4039

4140
The libmicrovmi handler for volatility is a URL handler with the following syntax:
@@ -61,13 +60,17 @@ Let's put all of this together and run volatility3 combined with libmicrovmi.
6160
(venv) $ vol -p <plugin_dir> --single-location vmi:///vm_name <volatility plugin>
6261
~~~
6362

64-
Example listing the processes on Xen:
63+
### Example listing processes on Xen
6564

6665
~~~bash
6766
(venv) $ sudo -E ./venv/bin/vol \ # running volatility3 as root (required by the Xen driver)
68-
-p ./venv/lib/python3.8/site-packages/microvmi-0.0.2-py3.8-linux-x86_64.egg/microvmi/volatility \ # path to the microvmi connection plugin
67+
-p venv/lib/python3.7/site-packages/microvmi/volatility \ # path to the microvmi connection plugin
6968
--single-location vmi:///winxp \ # specify the resource location
7069
windows.pslist.PsList # volatility's pslist plugin
7170
~~~
7271

73-
![demo](./volatility3-demo.png)
72+
🎥 [asciicast](https://asciinema.org/a/6YOXUkEwt53uYcU5rXxoWaFLq)
73+
74+
### Example listing processes on KVM
75+
76+
🎥 [asciicast](https://asciinema.org/a/DTyjM0rnq26RYbFX7hbS7jXvP)

0 commit comments

Comments
 (0)