New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add profilescan plugin suite #12

Merged
merged 2 commits into from Sep 29, 2016

Conversation

Projects
None yet
3 participants
@P1kachu
Contributor

P1kachu commented May 15, 2016

Signed-off-by: Stanislas Lejay stanislas.lejay@epita.fr

Add profilescan plugin suite
Signed-off-by: Stanislas Lejay <stanislas.lejay@epita.fr>
@iMHLv2

This comment has been minimized.

Contributor

iMHLv2 commented May 29, 2016

I ran this on a couple linux and mac memory dumps and it worked as expected. Nice job! The only thing I'd suggest aside from what's already on your TODO list is switching up the name space a bit. The way we recommend using the community branch is checking it out side by side with volatility (for example /volatility and /community) and then importing plugins by specifying --plugins=/community or --plugins=/community/author. Currently, people would need to copy your files into into the core directories (i.e. put get_profile.py in volatility/plugins/linux) since that's how profilescan.py imports it. Does that make sense? Also, you might consider submitting to the volatility plugin contest http://www.volatilityfoundation.org/#!2016/qacow.

@P1kachu

This comment has been minimized.

Contributor

P1kachu commented May 29, 2016

Thanks !

Well, I had problem loading it using --plugins=~/community/ for some strange reason, that's why I didn't do it. What do you recommend for it to work ?

@P1kachu

This comment has been minimized.

Contributor

P1kachu commented May 29, 2016

And which particular things do you recommend I change such that it matches the usual way ?

Add ICLA
Signed-off-by: Stanislas P1kachu Lejay <p1kachu@lse.epita.fr>

@gleeda gleeda merged commit 4abee87 into volatilityfoundation:master Sep 29, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment