volatility3.cli package

A CommandLine User Interface for the volatility framework.

User interfaces make use of the framework to:

• determine available plugins

• request necessary information for those plugins from the user

• determine what “automagic” modules will be used to populate information the user does not provide

• run the plugin

• display the results

class CommandLine

Bases: object

Constructs a command-line interface object for users to run plugins.

CLI_NAME = 'volatility'

file_handler_class_factory(direct=True)

load_system_defaults(filename)

Modify the main configuration based on the default configuration override

Return type:

Tuple[List[Tuple[int, str]], Dict[str, Any]]

classmethod location_from_file(filename)

Returns the URL location from a file parameter (which may be a URL)

Parameters:

filename (str) – The path to the file (either an absolute, relative, or URL path)

Return type:

str

Returns:

The URL for the location of the file

order_extra_verbose_levels()

populate_config(context, configurables_list, args, plugin_config_path)

Populate the context config based on the returned args.

We have already determined these elements must be descended from ConfigurableInterface

Parameters:

• context (ContextInterface) – The volatility3 context to operate on

• configurables_list (Dict[str, Type[ConfigurableInterface]]) – A dictionary of configurable items that can be configured on the plugin

• args (Namespace) – An object containing the arguments necessary

• plugin_config_path (str) – The path within the context’s config containing the plugin’s configuration

Return type:

None

populate_requirements_argparse(parser, configurable)

Adds the plugin’s simple requirements to the provided parser.

Parameters:

• parser (Union[ArgumentParser, _ArgumentGroup]) – The parser to add the plugin’s (simple) requirements to

• configurable (Type[ConfigurableInterface]) – The plugin object to pull the requirements from

process_exceptions(excp)

Provide useful feedback if an exception occurs during a run of a plugin.

process_unsatisfied_exceptions(excp)

Provide useful feedback if an exception occurs during requirement fulfillment.

run()

Executes the command line module, taking the system arguments, determining the plugin to run and then running it.

classmethod setup_logging()

class MuteProgress

Bases: PrintedProgress

A dummy progress handler that produces no output when called.

class PrintedProgress

Bases: object

A progress handler that prints the progress value and the description onto the command line.

main()

A convenience function for constructing and running the CommandLine’s run method.

Subpackages

• volatility3.cli.volshell package
  • VolShell
    • VolShell.CLI_NAME
    • VolShell.file_handler_class_factory()
    • VolShell.load_system_defaults()
    • VolShell.location_from_file()
    • VolShell.order_extra_verbose_levels()
    • VolShell.populate_config()
    • VolShell.populate_requirements_argparse()
    • VolShell.process_exceptions()
    • VolShell.process_unsatisfied_exceptions()
    • VolShell.run()
    • VolShell.setup_logging()
  • main()
  • Submodules
    • volatility3.cli.volshell.generic module
      • NullFileHandler
      • Volshell
    • volatility3.cli.volshell.linux module
      • Volshell
    • volatility3.cli.volshell.mac module
      • Volshell
    • volatility3.cli.volshell.windows module
      • Volshell

Submodules

• volatility3.cli.text_filter module
  • CLIFilter
    • CLIFilter.filter()
  • ColumnFilter
    • ColumnFilter.find()
    • ColumnFilter.found()
• volatility3.cli.text_renderer module
  • CLIRenderer
    • CLIRenderer.filter
    • CLIRenderer.get_render_options()
    • CLIRenderer.name
    • CLIRenderer.render()
    • CLIRenderer.structured_output
  • CSVRenderer
    • CSVRenderer.filter
    • CSVRenderer.get_render_options()
    • CSVRenderer.name
    • CSVRenderer.render()
    • CSVRenderer.structured_output
  • JsonLinesRenderer
    • JsonLinesRenderer.filter
    • JsonLinesRenderer.get_render_options()
    • JsonLinesRenderer.name
    • JsonLinesRenderer.output_result()
    • JsonLinesRenderer.render()
    • JsonLinesRenderer.structured_output
  • JsonRenderer
    • JsonRenderer.filter
    • JsonRenderer.get_render_options()
    • JsonRenderer.name
    • JsonRenderer.output_result()
    • JsonRenderer.render()
    • JsonRenderer.structured_output
  • NoneRenderer
    • NoneRenderer.filter
    • NoneRenderer.get_render_options()
    • NoneRenderer.name
    • NoneRenderer.render()
    • NoneRenderer.structured_output
  • PrettyTextRenderer
    • PrettyTextRenderer.filter
    • PrettyTextRenderer.get_render_options()
    • PrettyTextRenderer.name
    • PrettyTextRenderer.render()
    • PrettyTextRenderer.structured_output
    • PrettyTextRenderer.tab_stop()
  • QuickTextRenderer
    • QuickTextRenderer.filter
    • QuickTextRenderer.get_render_options()
    • QuickTextRenderer.name
    • QuickTextRenderer.render()
    • QuickTextRenderer.structured_output
  • display_disassembly()
  • hex_bytes_as_text()
  • multitypedata_as_text()
  • optional()
  • quoted_optional()
• volatility3.cli.volargparse module
  • HelpfulArgParser
    • HelpfulArgParser.add_argument()
    • HelpfulArgParser.add_argument_group()
    • HelpfulArgParser.add_mutually_exclusive_group()
    • HelpfulArgParser.add_subparsers()
    • HelpfulArgParser.convert_arg_line_to_args()
    • HelpfulArgParser.error()
    • HelpfulArgParser.exit()
    • HelpfulArgParser.format_help()
    • HelpfulArgParser.format_usage()
    • HelpfulArgParser.get_default()
    • HelpfulArgParser.parse_args()
    • HelpfulArgParser.parse_intermixed_args()
    • HelpfulArgParser.parse_known_args()
    • HelpfulArgParser.parse_known_intermixed_args()
    • HelpfulArgParser.print_help()
    • HelpfulArgParser.print_usage()
    • HelpfulArgParser.register()
    • HelpfulArgParser.set_defaults()
  • HelpfulSubparserAction
    • HelpfulSubparserAction.add_parser()
    • HelpfulSubparserAction.format_usage()