ABCDEFGHIJKLMNOPQRSTU
1
qcModuleDescriptionOwnerCompletion
2
Linux SupportNOTES
3
linux_arp Print the ARP table100%arp
4
linux_banner Prints the Linux banner information 100%banner
5
linux_bash Recover bash history from bash process memory50%bashSometimes doesn't work? Need to check if this is a 32 vs 64bit problem. Have problems in some tests VMs where no strings are found (and I had planted them ;))
6
linux_check_afinfoVerifies the operation function pointers of network protocols100%check_afinfo
7
linux_check_credsChecks if any processes are sharing credential structures100%check_creds
8
linux_check_fopCheck file operation structures for rootkit modifications100%called check_proc_fopsFixed to interact better with Kernel tha may be swapped ? (VMs)
9
linux_check_idtChecks if the IDT has been altered 100%check_idtfixed, improved a tad, depends on lsmod
10
linux_check_modulesCompares module list to sysfs info, if available100%check_modulesdepends on lsmod
11
linux_check_syscallChecks if the system call table has been altered 100%
12
linux_check_ttyChecks tty devices for hooks100%check_ttys
13
linux_cpuinfo Prints info about each active processor100%cpuinfoDidn't really work on current multicore systems. Fixed
14
linux_dentry_cacheGather files from the dentry cacheDepends on slub
15
linux_dmesg Gather dmesg buffer100%dmesg
16
linux_dump_map Writes selected memory mappings to disk 100%vaddump
17
linux_find_fileRecovers tmpfs filesystems from memory100%mls & mcatReplaced by 2 plugins that, instead, allow you to list and cat any files in memory.
18
linux_ifconfig Gathers active interfaces100%ifconfig
19
linux_iomem Provides output similar to /proc/iomem100%iomem
20
linux_keyboard_notifierParses the keyboard notifier call chain100%keyboard_notifier_check
21
linux_lsmod Gather loaded kernel modules100%lsmod
22
linux_lsof Lists open files100%lsof
23
linux_memmap Dumps the memory map for linux tasks100%
24
linux_moddump Extract loaded kernel modules100%
25
linux_mount Gather mounted fs/devices80%mountPorted for 2.6-3.13 kernels, pending support for 3.14Will want to add fs-specific flags too
26
linux_mount_cacheGather mounted fs/devices from kmem_cache0%slub. Likely unnecessary
27
linux_netstat Lists open sockets100%netstatActually, this was broken. Fixed it and changed the output a bit
28
linux_pidhashtableEnumerates processes through the PID hash table100%pidhashtable (times)Fixed date issue
29
linux_pkt_queuesWrites per-process packet queues out to disk100%pkt_queuesNeeds a tad more testing
30
linux_proc_mapsGathers process maps for linux100%maps
31
linux_psaux Gathers processes along with full command line and start time100%psaux
32
linux_pslist Gather active tasks by walking the task_struct->task list100%pslistFixed date issue
33
linux_pslist_cacheGather tasks from the kmem_cache0%slub
34
linux_pstree Shows the parent/child relationship between processespstree
35
linux_psxview Find hidden processes with various process listings100%
36
linux_route_cacheRecovers the routing cache from memory 0%slub
37
linux_sk_buff_cacheRecovers packets from the sk_buff kmem_cache0%slub
38
linux_slabinfo Mimics /proc/slabinfo on a running machine0%most systems use slub now so this need to be reimplementedslub
39
linux_tmpfs Recovers tmpfs filesystems from memory80%Replaced by mls
40
linux_vma_cacheGather VMAs from the vm_area_struct cache0%slub?
41
linux_volshell Shell in the memory imageDeprecated
42
linux_yarascan Yara Scan over memory100%
43
mbrparser Scans for and parses potential Master Boot Records (MBRs) 0%I don't think this plugin is great but it just gives way too many False Positives (the levenstein option maybe is a bit more useful)
After reading the article about it, it may be worth porting. I'll give it a shot and maybe improve it a bit
44
Address spaces
45
addrspaces/amd64.pyStandard AMD 64-bit address space.100%
46
addrspaces/crash.pywindows Crash Dump format 100%
47
addrspaces/ewf.pyThis Address Space allows us to open ewf files
48
VMWareSnapshotFile This AS supports VMware snapshot files
49
addrspaces/hibernate.pyWindows hibernation filesDeprecated - Replace with conversion plugin
50
addrspaces/ieee1394.pyFirewire address spaces.Deprecated
51
addrspaces/intel.pyStandard Intel 32-bit address space.100%
52
addrspaces/mmap_address_space.pyan AS which uses an mmap of a file.100%
53
addrspaces/standard.pydirect file AS100%
54
Support
55
Windows XP
56
Windows 7
57
Windows 7 64 bit
58
Windows 8 64 bitDone Win8 8.1 64 and 32 bits.
59
Windows 2003
60
Linux 64bit
61
62
Imaging functionality
63
winpmem.pyImaging of windows systems (32 and 64 bit)100%
64
pmem.cImager of linux systems100%
65
LMAPImager of linux systems100%
66
OSX pmemImager of OSX systems100%
67
Overlays
68
overlays/linux/linux.pyA Linux profile which works with dwarfdump output files.100%
69
overlays/windows/vista.pySupport Vista profiles
70
overlays/windows/win2003.pySupport Win2003 profiles(Not tested yet)
71
overlays/windows/win7.pySupport Win7 profiles100%
72
overlays/windows/windows.pyCommon windows profiles100%
73
overlays/windows/xp.pySupport XP100%
74
Core
75
volatility/obj.pyCore object parsing framework100%
76
volatility/addrspace.pyBaseclass for address spaces100%
77
volatility/obj_test.pyUnit tests for object framework100%
78
volatility/plugin.pyBaseclass for plugins100%
79
volatility/registry.pyClass registry100%
80
volatility/scan.pyScanning framework (Scanner groups, discontiguous scanners)100%
81
volatility/session.pyImplementation of the user interactive session.100%
82
Documentation
83
API Documentation
84
Sample Code
85
User manual
86
Screencasts
87
Darwin Support
88
mac_arp Prints the arp table adamsh
89
mac_check_syscallsChecks to see if system call table entries are hooked adamsh
90
mac_check_sysctlChecks for unknown sysctl handlers adamsh
91
mac_check_trap_tableChecks to see if mach trap table entries are hooked adamsh
92
mac_dead_procs Prints terminated/de-allocated processes adamsh
93
mac_dmesg Prints the kernel debug buffer adamsh
94
mac_dump_maps Dumps memory ranges of processes adamsh
95
mac_find_aslr_shiftFind the ASLR shift value for 10.8+ images adamshNot generally useful and its easily printed from the shell.
96
mac_ifconfig Lists network interface information for all devices adamsh
97
mac_ip_filters Reports any hooked IP filters adamsh
98
mac_list_sessionsEnumerates sessions adamsh
99
mac_list_zones Prints active zones adamsh
100
mac_lsmod Lists loaded kernel modules adamsh