volatility.cli.volshell package

class VolShell[source]

Bases: volatility.cli.CommandLine

Program to allow interactive interaction with a memory image.

This allows a memory image to be examined through an interactive python terminal with all the volatility support calls available.


Consumes a file as produced by a plugin.

populate_config(context, configurables_list, args, plugin_config_path)

Populate the context config based on the returned args.

We have already determined these elements must be descended from ConfigurableInterface

  • context (ContextInterface) – The volatility context to operate on

  • configurables_list (Dict[str, ConfigurableInterface]) – A dictionary of configurable items that can be configured on the plugin

  • args (Namespace) – An object containing the arguments necessary

  • plugin_config_path (str) – The path within the context’s config containing the plugin’s configuration

Return type


populate_requirements_argparse(parser, configurable)

Adds the plugin’s simple requirements to the provided parser.


Provide useful feedback if an exception occurs.


Executes the command line module, taking the system arguments, determining the plugin to run and then running it.


A convenience function for constructing and running the CommandLine’s run method.