def calculate(self): addr_space = utils.load_as(self._config) if not self.is_valid_profile(addr_space.profile): debug.error("This command does not support the selected profile.") return network.determine_connections(addr_space)
def calculate(self): addr_space = utils.load_as(self._config) if not self.is_valid_profile(addr_space.profile): debug.error("This command does not support the selected profile.") return network.determine_connections(addr_space)
def calculate(self): addr_space = utils.load_as(self._config) return network.determine_connections(addr_space)
'plugins': None, 'debug': None, 'cache_dtb': True, 'filename': None, 'cache_directory': None, 'verbose': None, 'write':False} # set the default config for k,v in base_conf.items(): config.update(k, v) # configuration complete # now load up the address space # pretty interesting to note that this is actually an iterative process # first the FileAddressSpace from plugins/addr_spaces/standard/ is created # with the file, and then a JKIA32PagedMemoryPae from volatility/plugins/addrspaces/intel # is created. If ['write', 'cache_dtb', 'kdbg'] are not set, this fails addr_space = utils.load_as(config) # now create the connections like in # plugins/connections.py conns = [conn for conn in network.determine_connections(addr_space)] for i in conns: offset = conn.obj_vm.vtop(conn.obj_offset) local = "{0}:{1}".format(conn.LocalIpAddress, conn.LocalPort) remote = "{0}:{1}".format(conn.RemoteIpAddress, conn.RemotePort) print ('w00t, now I know that %s ===> %s'%(local, remote))