volatility3.cli.text_renderer module

class CLIRenderer(options=None)

Bases: Renderer

Class to add specific requirements for CLI renderers.

Accepts an options object to configure the renderers.

column_hide_list: Optional[list] = None

filter: Optional[CLIFilter] = None

abstractmethod get_render_options()

Returns a list of rendering options.

Return type:

List[Any]

ignored_columns(grid)

Return type:

List[Column]

name = 'unnamed'

abstractmethod render(grid)

Takes a grid object and renders it based on the object’s preferences.

Return type:

None

structured_output = False

class CLITypeRenderer(func)

Bases: TypeRendererInterface

property options

render(data)

Renders a specific datatype

Return type:

Any

type = ~T

class CSVRenderer(options=None)

Bases: CLIRenderer

Accepts an options object to configure the renderers.

column_hide_list: Optional[list] = None

filter: Optional[text_filter.CLIFilter] = None

get_render_options()

Returns a list of rendering options.

ignored_columns(grid)

Return type:

List[Column]

name = 'csv'

render(grid)

Renders each row immediately to stdout.

Parameters:

grid (TreeGrid) – The TreeGrid object to render

Return type:

None

structured_output = True

class JsonLinesRenderer(options=None)

Bases: JsonRenderer

Accepts an options object to configure the renderers.

column_hide_list: Optional[list] = None

filter: Optional[text_filter.CLIFilter] = None

get_render_options()

Returns a list of rendering options.

Return type:

List[Any]

ignored_columns(grid)

Return type:

List[Column]

name = 'JSONL'

output_result(outfd, result)

Outputs the JSON results as JSON lines

render(grid)

Takes a grid object and renders it based on the object’s preferences.

structured_output = True

class JsonRenderer(options=None)

Bases: CLIRenderer

Accepts an options object to configure the renderers.

column_hide_list: Optional[list] = None

filter: Optional[text_filter.CLIFilter] = None

get_render_options()

Returns a list of rendering options.

Return type:

List[Any]

ignored_columns(grid)

Return type:

List[Column]

name = 'JSON'

output_result(outfd, result)

Outputs the JSON data to a file in a particular format

render(grid)

Takes a grid object and renders it based on the object’s preferences.

structured_output = True

class LayerDataRenderer

Bases: CLITypeRenderer

Renders a LayerData object into data/bytes

property options

render(data)

Renders a specific datatype

Return type:

Any

render_bytes(data)

Renders a valid LayerData into bytes (with context bytes)

Return type:

Tuple[bytes, Set[int]]

type = ~T

class MermaidRenderer(options=None)

Bases: CLIRenderer

Accepts an options object to configure the renderers.

column_hide_list: Optional[list] = None

filter: Optional[text_filter.CLIFilter] = None

get_render_options()

Returns a list of rendering options.

ignored_columns(grid)

Return type:

List[Column]

name = 'mermaid'

render(grid)

Render the TreeGrid as a Mermaid graph TD flowchart.

The renderer is plugin-agnostic: it derives the parent/child relationship from each node’s path_depth in the grid, rather than from any particular column (such as PID/PPID). This means any tree-shaped plugin output – pstree, vadwalk, handles tree, future plugins – renders without modification.

The algorithm maintains a parent stack while walking the rows in traversal order:

• descending one or more levels pushes the previously-emitted node onto the stack (once per level descended) so it becomes the current parent;

• ascending pops the same number of levels off the stack;

• the top of the stack is always the parent of the next emitted node, or empty for a root-level node.

Parameters:

grid (TreeGrid) – The TreeGrid object to render

Return type:

None

structured_output = True

class NoneRenderer(options=None)

Bases: CLIRenderer

Outputs no results

Accepts an options object to configure the renderers.

column_hide_list: Optional[list] = None

filter: Optional[text_filter.CLIFilter] = None

get_render_options()

Returns a list of rendering options.

ignored_columns(grid)

Return type:

List[Column]

name = 'none'

render(grid)

Takes a grid object and renders it based on the object’s preferences.

Return type:

None

structured_output = False

class PrettyTextRenderer(options=None)

Bases: CLIRenderer

Accepts an options object to configure the renderers.

column_hide_list: Optional[list] = None

filter: Optional[text_filter.CLIFilter] = None

get_render_options()

Returns a list of rendering options.

ignored_columns(grid)

Return type:

List[Column]

name = 'pretty'

render(grid)

Renders each column immediately to stdout.

This does not format each line’s width appropriately, it merely tab separates each field

Parameters:

grid (TreeGrid) – The TreeGrid object to render

Return type:

None

structured_output = False

tab_stop(line)

Return type:

str

class QuickTextRenderer(options=None)

Bases: CLIRenderer

Accepts an options object to configure the renderers.

column_hide_list: Optional[list] = None

filter: Optional[text_filter.CLIFilter] = None

get_render_options()

Returns a list of rendering options.

ignored_columns(grid)

Return type:

List[Column]

name = 'quick'

render(grid)

Renders each column immediately to stdout.

This does not format each line’s width appropriately, it merely tab separates each field

Parameters:

grid (TreeGrid) – The TreeGrid object to render

Return type:

None

structured_output = False

display_disassembly(disasm)

Renders a disassembly renderer type into string format.

Parameters:

disasm (Disassembly) – Input disassembly objects

Return type:

str

Returns:

A string as rendered by capstone where available, otherwise output as if it were just bytes

hex_bytes_as_text(value, width=16)

Renders HexBytes as text.

Parameters:

value (bytes) – A series of bytes to convert to text

Return type:

str

Returns:

A text representation of the hexadecimal bytes plus their ascii equivalents, separated by newline characters

multitypedata_as_text(value)

Renders the bytes as a string where possible, otherwise it displays hex data

This attempts to convert the string based on its encoding and if no data’s been lost due to the split on the null character, then it displays it as is

Return type:

str

optional(func)

Return type:

Callable[[TypeVar(T)], str]

quoted_optional(func)

Return type:

Callable