VolMalfindDumpAgent

Volatility script for command ldrmodules

Source

var res = [];
var output = {Success: false};
var cmdline = 'sudo vol.py -f ' + args.memdump + ' malfind';
if (args.pid) {
   cmdline = cmdline + ' -p ' + args.pid;
}
var dumpdir = args.dumpdir;
cmdline = cmdline + ' -D ' + dumpdir;

executeCommand('RemoteExec', {system:args.system, cmd:'sudo mkdir ' + dumpdir});
var volExec = executeCommand('RemoteExec', {system:args.system, cmd: cmdline})[0];
res.push(volExec);
if (volExec.Type !== entryTypes.error) {
   // we need to take all the files and move them over.
   res.push(executeCommand('copy-from', {using:args.system, file: dumpdir + '/*'}));
}
if ('true' === args.dodelete) {
    res.push(executeCommand('RemoteExec', {system:args.system, cmd:'sudo rm -rf ' + dumpdir}));
}

return res;

README

Use the Volatility script to command ldrmodules.

Script Data

Name	Description
Script Type	javascript
Tags	volatility

Inputs

Argument Name	Description
memdump	The path to memory dump the file on the system being used.
pid	The process ID to pass to volatility malfind command.
dumpdir	The path to the directory in which to save the dumped memory sections.
dodelete	Whether to delete the directory with the VAD dumps.
system	The Volatility system to run the script on.

Outputs

There are no outputs for this script.