VolMalfindDumpAgent

Volatility script for command ldrmodules

Details

ID	`VolMalfindDumpAgent`
Language	javascript
From Version	5.0.0
Tags	volatility

README

Use the Volatility script to command ldrmodules.

Script Data

Name	Description
Script Type	javascript
Tags	volatility

Inputs

Argument Name	Description
memdump	The path to memory dump the file on the system being used.
pid	The process ID to pass to volatility malfind command.
dumpdir	The path to the directory in which to save the dumped memory sections.
dodelete	Whether to delete the directory with the VAD dumps.
system	The Volatility system to run the script on.

Outputs

There are no outputs for this script.

Source

VolMalfindDumpAgent.js VolMalfindDumpAgent.yml

Download History Raw

commonfields:
  id: VolMalfindDumpAgent
  version: -1
name: VolMalfindDumpAgent
script: ''
type: javascript
tags:
- volatility
comment: Volatility script for command ldrmodules
system: true
args:
- name: memdump
  required: true
  default: true
  description: Path to memory dump file on the system being used
- name: pid
  required: true
  description: Process ID to pass to volatility malfind command
- name: dumpdir
  required: true
  description: Path to directory in which to save dumped memory sections
- name: dodelete
  description: If "true", deletes the dir with the VAD dumps
- name: system
  required: true
  description: Volatility system to run the script on.
scripttarget: 0
dependson: {}
timeout: 0s
fromversion: 5.0.0