volatility3.plugins.windows package
All Windows OS plugins.
NOTE: This file is important for core plugins to run (which certain components such as the windows registry layers) are dependent upon, please DO NOT alter or remove this file unless you know the consequences of doing so.
The framework is configured this way to allow plugin developers/users to override any plugin functionality whether existing or new.
When overriding the plugins directory, you must include a file like this in any subdirectories that may be necessary.
Subpackages
- volatility3.plugins.windows.registry package
Submodules
- volatility3.plugins.windows.amcache module
AmcacheAmcache.build_configuration()Amcache.configAmcache.config_pathAmcache.contextAmcache.generate_timeline()Amcache.get_amcache_hive()Amcache.get_requirements()Amcache.make_subconfig()Amcache.openAmcache.parse_driver_binary_key()Amcache.parse_file_key()Amcache.parse_inventory_app_file_key()Amcache.parse_inventory_app_key()Amcache.parse_programs_key()Amcache.run()Amcache.set_open_method()Amcache.unsatisfied()Amcache.version
AmcacheEntryTypeAmcacheEntryType.DriverAmcacheEntryType.FileAmcacheEntryType.ProgramAmcacheEntryType.as_integer_ratio()AmcacheEntryType.bit_count()AmcacheEntryType.bit_length()AmcacheEntryType.conjugate()AmcacheEntryType.denominatorAmcacheEntryType.from_bytes()AmcacheEntryType.imagAmcacheEntryType.numeratorAmcacheEntryType.realAmcacheEntryType.to_bytes()
Win10DriverBinaryValNameWin10InvAppFileValNameWin10InvAppValNameWin8FileValNameWin8FileValName.CompanyWin8FileValName.CompileTimeWin8FileValName.CreateTimeWin8FileValName.LastModTimeWin8FileValName.LastModTime2Win8FileValName.PEHeaderChecksumWin8FileValName.PathWin8FileValName.ProductWin8FileValName.ProgramIDWin8FileValName.SHA1HashWin8FileValName.SizeWin8FileValName.SizeOfImageWin8FileValName.Version
Win8ProgramValName
- volatility3.plugins.windows.bigpools module
- volatility3.plugins.windows.cachedump module
CachedumpCachedump.build_configuration()Cachedump.configCachedump.config_pathCachedump.contextCachedump.decrypt_hash()Cachedump.get_nlkm()Cachedump.get_requirements()Cachedump.make_subconfig()Cachedump.openCachedump.parse_cache_entry()Cachedump.parse_decrypted_cache()Cachedump.run()Cachedump.set_open_method()Cachedump.unsatisfied()Cachedump.version
- volatility3.plugins.windows.callbacks module
CallbacksCallbacks.build_configuration()Callbacks.configCallbacks.config_pathCallbacks.contextCallbacks.create_callback_scan_constraints()Callbacks.create_callback_symbol_table()Callbacks.get_requirements()Callbacks.list_bugcheck_callbacks()Callbacks.list_bugcheck_reason_callbacks()Callbacks.list_notify_routines()Callbacks.list_registry_callbacks()Callbacks.make_subconfig()Callbacks.openCallbacks.run()Callbacks.scan()Callbacks.set_open_method()Callbacks.unsatisfied()Callbacks.version
- volatility3.plugins.windows.cmdline module
- volatility3.plugins.windows.cmdscan module
- volatility3.plugins.windows.consoles module
ConsolesConsoles.build_configuration()Consoles.configConsoles.config_pathConsoles.contextConsoles.create_conhost_symbol_table()Consoles.determine_conhost_version()Consoles.find_conhost_proc()Consoles.find_conhostexe()Consoles.get_console_info()Consoles.get_console_settings_from_registry()Consoles.get_requirements()Consoles.make_subconfig()Consoles.openConsoles.run()Consoles.set_open_method()Consoles.unsatisfied()Consoles.version
- volatility3.plugins.windows.crashinfo module
- volatility3.plugins.windows.debugregisters module
DebugRegistersDebugRegisters.build_configuration()DebugRegisters.configDebugRegisters.config_pathDebugRegisters.contextDebugRegisters.get_requirements()DebugRegisters.make_subconfig()DebugRegisters.openDebugRegisters.run()DebugRegisters.set_open_method()DebugRegisters.unsatisfied()DebugRegisters.version
- volatility3.plugins.windows.devicetree module
- volatility3.plugins.windows.dlllist module
- volatility3.plugins.windows.driverirp module
- volatility3.plugins.windows.drivermodule module
- volatility3.plugins.windows.driverscan module
DriverScanDriverScan.build_configuration()DriverScan.configDriverScan.config_pathDriverScan.contextDriverScan.get_names_for_driver()DriverScan.get_requirements()DriverScan.make_subconfig()DriverScan.openDriverScan.run()DriverScan.scan_drivers()DriverScan.set_open_method()DriverScan.unsatisfied()DriverScan.version
- volatility3.plugins.windows.dumpfiles module
DumpFilesDumpFiles.build_configuration()DumpFiles.configDumpFiles.config_pathDumpFiles.contextDumpFiles.dump_file_producer()DumpFiles.get_requirements()DumpFiles.make_subconfig()DumpFiles.openDumpFiles.process_file_object()DumpFiles.run()DumpFiles.set_open_method()DumpFiles.unsatisfied()DumpFiles.version
- volatility3.plugins.windows.envars module
- volatility3.plugins.windows.filescan module
- volatility3.plugins.windows.getservicesids module
GetServiceSIDsGetServiceSIDs.build_configuration()GetServiceSIDs.configGetServiceSIDs.config_pathGetServiceSIDs.contextGetServiceSIDs.get_requirements()GetServiceSIDs.make_subconfig()GetServiceSIDs.openGetServiceSIDs.run()GetServiceSIDs.set_open_method()GetServiceSIDs.unsatisfied()GetServiceSIDs.version
createservicesid()
- volatility3.plugins.windows.getsids module
- volatility3.plugins.windows.handles module
HandlesHandles.build_configuration()Handles.configHandles.config_pathHandles.contextHandles.find_cookie()Handles.find_sar_value()Handles.get_requirements()Handles.get_type_map()Handles.handles()Handles.make_subconfig()Handles.openHandles.run()Handles.set_open_method()Handles.unsatisfied()Handles.version
- volatility3.plugins.windows.hashdump module
HashdumpHashdump.almpasswordHashdump.antpasswordHashdump.anumHashdump.aqwertyHashdump.bootkey_perm_tableHashdump.build_configuration()Hashdump.configHashdump.config_pathHashdump.contextHashdump.decrypt_single_hash()Hashdump.decrypt_single_salted_hash()Hashdump.empty_lmHashdump.empty_ntHashdump.get_bootkey()Hashdump.get_hbootkey()Hashdump.get_hive_key()Hashdump.get_requirements()Hashdump.get_user_hashes()Hashdump.get_user_keys()Hashdump.get_user_name()Hashdump.lmkeyHashdump.make_subconfig()Hashdump.odd_parityHashdump.openHashdump.run()Hashdump.set_open_method()Hashdump.sid_to_key()Hashdump.sidbytes_to_key()Hashdump.unsatisfied()Hashdump.version
- volatility3.plugins.windows.hollowprocesses module
DLLDataHollowProcessesHollowProcesses.build_configuration()HollowProcesses.configHollowProcesses.config_pathHollowProcesses.contextHollowProcesses.get_requirements()HollowProcesses.make_subconfig()HollowProcesses.openHollowProcesses.run()HollowProcesses.set_open_method()HollowProcesses.unsatisfied()HollowProcesses.version
VadData
- volatility3.plugins.windows.iat module
- volatility3.plugins.windows.info module
InfoInfo.build_configuration()Info.configInfo.config_pathInfo.contextInfo.get_depends()Info.get_kdbg_structure()Info.get_kernel_module()Info.get_kuser_structure()Info.get_ntheader_structure()Info.get_requirements()Info.get_version_structure()Info.make_subconfig()Info.openInfo.run()Info.set_open_method()Info.unsatisfied()Info.version
- volatility3.plugins.windows.joblinks module
- volatility3.plugins.windows.kpcrs module
- volatility3.plugins.windows.ldrmodules module
- volatility3.plugins.windows.lsadump module
LsadumpLsadump.build_configuration()Lsadump.configLsadump.config_pathLsadump.contextLsadump.decrypt_aes()Lsadump.decrypt_secret()Lsadump.get_lsa_key()Lsadump.get_requirements()Lsadump.get_secret_by_name()Lsadump.make_subconfig()Lsadump.openLsadump.run()Lsadump.set_open_method()Lsadump.unsatisfied()Lsadump.version
- volatility3.plugins.windows.malfind module
- volatility3.plugins.windows.mbrscan module
- volatility3.plugins.windows.memmap module
- volatility3.plugins.windows.mftscan module
- volatility3.plugins.windows.modscan module
ModScanModScan.build_configuration()ModScan.configModScan.config_pathModScan.contextModScan.dump_module()ModScan.find_session_layer()ModScan.get_requirements()ModScan.get_session_layers()ModScan.list_modules()ModScan.make_subconfig()ModScan.openModScan.run()ModScan.scan_modules()ModScan.set_open_method()ModScan.unsatisfied()ModScan.version
- volatility3.plugins.windows.modules module
ModulesModules.build_configuration()Modules.configModules.config_pathModules.contextModules.dump_module()Modules.find_session_layer()Modules.get_requirements()Modules.get_session_layers()Modules.list_modules()Modules.make_subconfig()Modules.openModules.run()Modules.set_open_method()Modules.unsatisfied()Modules.version
- volatility3.plugins.windows.mutantscan module
- volatility3.plugins.windows.netscan module
NetScanNetScan.build_configuration()NetScan.configNetScan.config_pathNetScan.contextNetScan.create_netscan_constraints()NetScan.create_netscan_symbol_table()NetScan.determine_tcpip_version()NetScan.generate_timeline()NetScan.get_requirements()NetScan.make_subconfig()NetScan.openNetScan.run()NetScan.scan()NetScan.set_open_method()NetScan.unsatisfied()NetScan.version
- volatility3.plugins.windows.netstat module
NetStatNetStat.build_configuration()NetStat.configNetStat.config_pathNetStat.contextNetStat.create_tcpip_symbol_table()NetStat.enumerate_structures_by_port()NetStat.find_port_pools()NetStat.generate_timeline()NetStat.get_requirements()NetStat.get_tcpip_module()NetStat.list_sockets()NetStat.make_subconfig()NetStat.openNetStat.parse_bitmap()NetStat.parse_hashtable()NetStat.parse_partitions()NetStat.read_pointer()NetStat.run()NetStat.set_open_method()NetStat.unsatisfied()NetStat.version
- volatility3.plugins.windows.orphan_kernel_threads module
ThreadsThreads.build_configuration()Threads.configThreads.config_pathThreads.contextThreads.filter_func()Threads.gather_thread_info()Threads.generate_timeline()Threads.get_requirements()Threads.list_orphan_kernel_threads()Threads.make_subconfig()Threads.openThreads.run()Threads.scan_threads()Threads.set_open_method()Threads.unsatisfied()Threads.version
- volatility3.plugins.windows.pe_symbols module
ExportSymbolFinderPDBSymbolFinderPESymbolFinderPESymbolsPESymbols.addresses_for_process_symbols()PESymbols.build_configuration()PESymbols.configPESymbols.config_pathPESymbols.contextPESymbols.filename_for_path()PESymbols.filepath_for_address()PESymbols.find_symbols()PESymbols.get_all_vads_with_file_paths()PESymbols.get_kernel_modules()PESymbols.get_proc_vads_with_file_paths()PESymbols.get_process_modules()PESymbols.get_requirements()PESymbols.get_vads_for_process_cache()PESymbols.make_subconfig()PESymbols.openPESymbols.os_module_namePESymbols.path_and_symbol_for_address()PESymbols.range_info_for_address()PESymbols.run()PESymbols.set_open_method()PESymbols.unsatisfied()PESymbols.version
- volatility3.plugins.windows.pedump module
PEDumpPEDump.build_configuration()PEDump.configPEDump.config_pathPEDump.contextPEDump.dump_kernel_pe_at_base()PEDump.dump_ldr_entry()PEDump.dump_pe()PEDump.dump_pe_at_base()PEDump.dump_processes()PEDump.get_requirements()PEDump.make_subconfig()PEDump.openPEDump.run()PEDump.set_open_method()PEDump.unsatisfied()PEDump.version
- volatility3.plugins.windows.poolscanner module
PoolConstraintPoolHeaderScannerPoolScannerPoolScanner.build_configuration()PoolScanner.builtin_constraints()PoolScanner.configPoolScanner.config_pathPoolScanner.contextPoolScanner.generate_pool_scan()PoolScanner.get_pool_header_table()PoolScanner.get_requirements()PoolScanner.make_subconfig()PoolScanner.openPoolScanner.pool_scan()PoolScanner.run()PoolScanner.set_open_method()PoolScanner.unsatisfied()PoolScanner.version
PoolType
- volatility3.plugins.windows.privileges module
- volatility3.plugins.windows.processghosting module
ProcessGhostingProcessGhosting.build_configuration()ProcessGhosting.configProcessGhosting.config_pathProcessGhosting.contextProcessGhosting.get_requirements()ProcessGhosting.make_subconfig()ProcessGhosting.openProcessGhosting.run()ProcessGhosting.set_open_method()ProcessGhosting.unsatisfied()ProcessGhosting.version
- volatility3.plugins.windows.pslist module
PsListPsList.PHYSICAL_DEFAULTPsList.build_configuration()PsList.configPsList.config_pathPsList.contextPsList.create_active_process_filter()PsList.create_name_filter()PsList.create_pid_filter()PsList.generate_timeline()PsList.get_requirements()PsList.list_processes()PsList.make_subconfig()PsList.openPsList.process_dump()PsList.run()PsList.set_open_method()PsList.unsatisfied()PsList.version
- volatility3.plugins.windows.psscan module
PsScanPsScan.build_configuration()PsScan.configPsScan.config_pathPsScan.contextPsScan.create_offset_filter()PsScan.generate_timeline()PsScan.get_osversion()PsScan.get_requirements()PsScan.make_subconfig()PsScan.openPsScan.physical_offset_from_virtual()PsScan.run()PsScan.scan_processes()PsScan.set_open_method()PsScan.unsatisfied()PsScan.versionPsScan.virtual_process_from_physical()
- volatility3.plugins.windows.pstree module
- volatility3.plugins.windows.psxview module
- volatility3.plugins.windows.scheduled_tasks module
ActionSetActionTypeDynamicInfoJobBucketMonthsOptionalSettingsOptionalSettings.DeadlineOptionalSettings.DeleteExpiredTaskAfterOptionalSettings.ExclusiveOptionalSettings.ExecutionTimeLimitSecondsOptionalSettings.IdleDurationSecondsOptionalSettings.NetworkIdOptionalSettings.PeriodicityOptionalSettings.PriorityOptionalSettings.PrivilegesOptionalSettings.RestartOnFailureDelayOptionalSettings.RestartOnFailureRetriesOptionalSettings.idleWaitTimeoutSeconds
PrivilegesPrivileges.SeAssignPrimaryTokenPrivilegePrivileges.SeAuditPrivilegePrivileges.SeBackupPrivilegePrivileges.SeChangeNotifyPrivilegePrivileges.SeCreateGlobalPrivilegePrivileges.SeCreatePagefilePrivilegePrivileges.SeCreatePermanentPrivilegePrivileges.SeCreateSymbolicLinkPrivilegePrivileges.SeCreateTokenPrivilegePrivileges.SeDebugPrivilegePrivileges.SeDelegateSessionUserImpersonatePrivilegePrivileges.SeEnableDelegationPrivilegePrivileges.SeImpersonatePrivilegePrivileges.SeIncreaseBasePriorityPrivilegePrivileges.SeIncreaseQuotaPrivilegePrivileges.SeIncreaseWorkingSetPrivilegePrivileges.SeLoadDriverPrivilegePrivileges.SeLockMemoryPrivilegePrivileges.SeMachineAccountPrivilegePrivileges.SeManageVolumePrivilegePrivileges.SeProfileSingleProcessPrivilegePrivileges.SeRelabelPrivilegePrivileges.SeRemoteShutdownPrivilegePrivileges.SeRestorePrivilegePrivileges.SeSecurityPrivilegePrivileges.SeShutdownPrivilegePrivileges.SeSyncAgentPrivilegePrivileges.SeSystemEnvironmentPrivilegePrivileges.SeSystemProfilePrivilegePrivileges.SeSystemtimePrivilegePrivileges.SeTakeOwnershipPrivilegePrivileges.SeTcbPrivilegePrivileges.SeTimeZonePrivilegePrivileges.SeTrustedCredManAccessPrivilegePrivileges.SeUndockPrivilege
ScheduledTasksScheduledTasks.build_configuration()ScheduledTasks.configScheduledTasks.config_pathScheduledTasks.contextScheduledTasks.generate_timeline()ScheduledTasks.get_requirements()ScheduledTasks.get_software_hive()ScheduledTasks.make_subconfig()ScheduledTasks.openScheduledTasks.parse_actions_value()ScheduledTasks.parse_dynamic_info_value()ScheduledTasks.parse_triggers_value()ScheduledTasks.run()ScheduledTasks.set_open_method()ScheduledTasks.unsatisfied()ScheduledTasks.version
SessionStateSidTypeTaskActionTaskSchedulerTimePeriodTaskTriggerTimeModeTriggerSetTriggerTypeUserInfoWeekdaydecode_sid()
- volatility3.plugins.windows.sessions module
- volatility3.plugins.windows.shimcachemem module
ShimcacheMemShimcacheMem.NT_KRNL_MODSShimcacheMem.build_configuration()ShimcacheMem.configShimcacheMem.config_pathShimcacheMem.contextShimcacheMem.create_shimcache_table()ShimcacheMem.find_shimcache_win_2k3_to_7()ShimcacheMem.find_shimcache_win_8_or_later()ShimcacheMem.find_shimcache_win_xp()ShimcacheMem.generate_timeline()ShimcacheMem.get_module_section_range()ShimcacheMem.get_requirements()ShimcacheMem.make_subconfig()ShimcacheMem.openShimcacheMem.run()ShimcacheMem.set_open_method()ShimcacheMem.try_get_shim_head_at_offset()ShimcacheMem.unsatisfied()ShimcacheMem.version
- volatility3.plugins.windows.skeleton_key_check module
Skeleton_Key_CheckSkeleton_Key_Check.build_configuration()Skeleton_Key_Check.configSkeleton_Key_Check.config_pathSkeleton_Key_Check.contextSkeleton_Key_Check.get_requirements()Skeleton_Key_Check.make_subconfig()Skeleton_Key_Check.openSkeleton_Key_Check.run()Skeleton_Key_Check.set_open_method()Skeleton_Key_Check.unsatisfied()Skeleton_Key_Check.version
- volatility3.plugins.windows.ssdt module
- volatility3.plugins.windows.strings module
- volatility3.plugins.windows.suspicious_threads module
SuspiciousThreadsSuspiciousThreads.build_configuration()SuspiciousThreads.configSuspiciousThreads.config_pathSuspiciousThreads.contextSuspiciousThreads.get_requirements()SuspiciousThreads.make_subconfig()SuspiciousThreads.openSuspiciousThreads.run()SuspiciousThreads.set_open_method()SuspiciousThreads.unsatisfied()SuspiciousThreads.version
- volatility3.plugins.windows.svcdiff module
SvcDiffSvcDiff.build_configuration()SvcDiff.configSvcDiff.config_pathSvcDiff.contextSvcDiff.enumerate_vista_or_later_header()SvcDiff.get_prereq_info()SvcDiff.get_record_tuple()SvcDiff.get_requirements()SvcDiff.make_subconfig()SvcDiff.openSvcDiff.run()SvcDiff.service_diff()SvcDiff.service_scan()SvcDiff.set_open_method()SvcDiff.unsatisfied()SvcDiff.version
- volatility3.plugins.windows.svclist module
SvcListSvcList.build_configuration()SvcList.configSvcList.config_pathSvcList.contextSvcList.enumerate_vista_or_later_header()SvcList.get_prereq_info()SvcList.get_record_tuple()SvcList.get_requirements()SvcList.make_subconfig()SvcList.openSvcList.run()SvcList.service_list()SvcList.service_scan()SvcList.set_open_method()SvcList.unsatisfied()SvcList.version
- volatility3.plugins.windows.svcscan module
ServiceBinaryInfoSvcScanSvcScan.build_configuration()SvcScan.configSvcScan.config_pathSvcScan.contextSvcScan.enumerate_vista_or_later_header()SvcScan.get_prereq_info()SvcScan.get_record_tuple()SvcScan.get_requirements()SvcScan.make_subconfig()SvcScan.openSvcScan.run()SvcScan.service_scan()SvcScan.set_open_method()SvcScan.unsatisfied()SvcScan.version
- volatility3.plugins.windows.symlinkscan module
SymlinkScanSymlinkScan.build_configuration()SymlinkScan.configSymlinkScan.config_pathSymlinkScan.contextSymlinkScan.generate_timeline()SymlinkScan.get_requirements()SymlinkScan.make_subconfig()SymlinkScan.openSymlinkScan.run()SymlinkScan.scan_symlinks()SymlinkScan.set_open_method()SymlinkScan.unsatisfied()SymlinkScan.version
- volatility3.plugins.windows.thrdscan module
ThrdScanThrdScan.build_configuration()ThrdScan.configThrdScan.config_pathThrdScan.contextThrdScan.filter_func()ThrdScan.gather_thread_info()ThrdScan.generate_timeline()ThrdScan.get_requirements()ThrdScan.make_subconfig()ThrdScan.openThrdScan.run()ThrdScan.scan_threads()ThrdScan.set_open_method()ThrdScan.unsatisfied()ThrdScan.version
- volatility3.plugins.windows.threads module
ThreadsThreads.build_configuration()Threads.configThreads.config_pathThreads.contextThreads.filter_func()Threads.gather_thread_info()Threads.generate_timeline()Threads.get_requirements()Threads.list_process_threads()Threads.list_threads()Threads.make_subconfig()Threads.openThreads.run()Threads.scan_threads()Threads.set_open_method()Threads.unsatisfied()Threads.version
- volatility3.plugins.windows.timers module
- volatility3.plugins.windows.truecrypt module
- volatility3.plugins.windows.unhooked_system_calls module
unhooked_system_callsunhooked_system_calls.build_configuration()unhooked_system_calls.configunhooked_system_calls.config_pathunhooked_system_calls.contextunhooked_system_calls.get_requirements()unhooked_system_calls.make_subconfig()unhooked_system_calls.openunhooked_system_calls.run()unhooked_system_calls.set_open_method()unhooked_system_calls.system_callsunhooked_system_calls.unsatisfied()unhooked_system_calls.version
- volatility3.plugins.windows.unloadedmodules module
UnloadedModulesUnloadedModules.build_configuration()UnloadedModules.configUnloadedModules.config_pathUnloadedModules.contextUnloadedModules.create_unloadedmodules_table()UnloadedModules.generate_timeline()UnloadedModules.get_requirements()UnloadedModules.list_unloadedmodules()UnloadedModules.make_subconfig()UnloadedModules.openUnloadedModules.run()UnloadedModules.set_open_method()UnloadedModules.unsatisfied()UnloadedModules.version
- volatility3.plugins.windows.vadinfo module
VadInfoVadInfo.MAXSIZE_DEFAULTVadInfo.build_configuration()VadInfo.configVadInfo.config_pathVadInfo.contextVadInfo.get_requirements()VadInfo.list_vads()VadInfo.make_subconfig()VadInfo.openVadInfo.protect_values()VadInfo.run()VadInfo.set_open_method()VadInfo.unsatisfied()VadInfo.vad_dump()VadInfo.version
- volatility3.plugins.windows.vadwalk module
- volatility3.plugins.windows.vadyarascan module
- volatility3.plugins.windows.verinfo module
- volatility3.plugins.windows.virtmap module