VolRunCmds

Execute volatility with command and return tabular output. Incase where proper json output is not supported, scripts returns error. User should use raw command.

javascript · Volatility (Deprecated)

Source

var cmds = args.cmds.split(',');
var resultarr = [];
for (var i = 0; i < cmds.length; i++) {
    var cmdline = cmds[i];
    if (args.profile) {
        cmdline = cmdline + ' --profile=' + args.profile;
    }
    var out = executeCommand('VolJson', {file:args.memdump, system: args.system, cmd:cmdline});
    if (out) {
        var mapper = function(columns) {
            return function(val) {
                return val.reduce(function(prev, curr, i) {
                    prev[columns[i]] = '' + curr;
                    return prev;
                }, {});
            };
        };
        for (var r = 0; r < out.length; r++) {
            if (out[r].Type !== entryTypes.error) {
                var jsonout = JSON.parse(out[r].Contents);
                result = {};
                result.Contents = jsonout.rows.map(mapper(jsonout.columns));
                result.ContentsFormat = formats.table;
                result.Type = entryTypes.note;
                resultarr.push(result);
            }
            else
            {
                result = {};
                var errstring = out[r].Contents;
                result.Contents = errstring.split('Stderr:')[1];
                result.ContentsFormat = formats.text;
                result.Type = entryTypes.error;
                resultarr.push(result);
            }
        }
    }
}
return resultarr;

README

Executes Volatility with a command and returns tabular output. In casse where proper JSON output is not supported, the script will return an error. The user should use a raw command.

Script Data


Name Description
Script Type javascript
Tags memory, forensics, volatility, server

Inputs


Argument Name Description
cmds The comma-separated list of volatility commands/modules to run.
memdump The path to memory dump the file on the system being used.
system The system with Volatility installed to be used for the analysis.
profile The Volatility profile to use.

Outputs


There are no outputs for this script.