-
-
Notifications
You must be signed in to change notification settings - Fork 4.5k
volatility3: add page #16383
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
volatility3: add page #16383
Conversation
created page for volatility3
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This page should be moved to the Windows folder; the examples you described apply to the Windows plugins
Co-authored-by: Sebastiaan Speck <[email protected]>
|
||
- Display help: | ||
|
||
`python3 vol.py -h` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
`python3 vol.py -h` | |
`python3 vol.py {{[-h|--help]}}` |
|
||
- Get information about a memory dump file: | ||
|
||
`python3 vol.py -f {{path/to/memory_dump_file}} windows.info` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
`python3 vol.py -f {{path/to/memory_dump_file}} windows.info` | |
`python3 vol.py {{[-f|--filename]}} {{path/to/memory_dump_file}} windows.info` |
|
||
- List active processes: | ||
|
||
`python3 vol.py -f {{path/to/ memory_dump_file}} windows.pslist` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
`python3 vol.py -f {{path/to/ memory_dump_file}} windows.pslist` | |
`python3 vol.py {{[-f|--filename]}} {{path/to/memory_dump_file}} windows.pslist` |
|
||
- List hashes of users on system: | ||
|
||
`python3 vol.py -f {{path/to/ memory_dump_file}} windows.hashdump` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
`python3 vol.py -f {{path/to/ memory_dump_file}} windows.hashdump` | |
`python3 vol.py {{[-f|--filename]}} {{path/to/memory_dump_file}} windows.hashdump` |
|
||
- List active network connections: | ||
|
||
`python3 vol.py -f {{path/to/ memory_dump_file}} windows.netstat` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
`python3 vol.py -f {{path/to/ memory_dump_file}} windows.netstat` | |
`python3 vol.py {{[-f|--filename]}} {{path/to/memory_dump_file}} windows.netstat` |
@sebastiaanspeck Based on the wiki, it can be used in Windows/Linux/macOS. So I think having this in |
But why not have a specific page for each OS and a overview page in |
That's a good idea. See |
created page for volatility3
common
,linux
,osx
,windows
,sunos
,android
, etc.