VolRunCmds
Execute volatility with command and return tabular output. Incase where proper json output is not supported, scripts returns error. User should use raw command.
javascript · Volatility (Deprecated)
Source
var cmds = args.cmds.split(','); var resultarr = []; for (var i = 0; i < cmds.length; i++) { var cmdline = cmds[i]; if (args.profile) { cmdline = cmdline + ' --profile=' + args.profile; } var out = executeCommand('VolJson', {file:args.memdump, system: args.system, cmd:cmdline}); if (out) { var mapper = function(columns) { return function(val) { return val.reduce(function(prev, curr, i) { prev[columns[i]] = '' + curr; return prev; }, {}); }; }; for (var r = 0; r < out.length; r++) { if (out[r].Type !== entryTypes.error) { var jsonout = JSON.parse(out[r].Contents); result = {}; result.Contents = jsonout.rows.map(mapper(jsonout.columns)); result.ContentsFormat = formats.table; result.Type = entryTypes.note; resultarr.push(result); } else { result = {}; var errstring = out[r].Contents; result.Contents = errstring.split('Stderr:')[1]; result.ContentsFormat = formats.text; result.Type = entryTypes.error; resultarr.push(result); } } } } return resultarr;
README
Executes Volatility with a command and returns tabular output. In casse where proper JSON output is not supported, the script will return an error. The user should use a raw command.
Script Data
| Name | Description |
|---|---|
| Script Type | javascript |
| Tags | memory, forensics, volatility, server |
Inputs
| Argument Name | Description |
|---|---|
| cmds | The comma-separated list of volatility commands/modules to run. |
| memdump | The path to memory dump the file on the system being used. |
| system | The system with Volatility installed to be used for the analysis. |
| profile | The Volatility profile to use. |
Outputs
There are no outputs for this script.