volatility3
volatility3 copied to clipboard
Windows: add `--verbose` option for `ldrmodules` plugin.
Description
Hello, everyone in the community! :) This PR comes from this issue (#967). It will be meaningful to re-implement the original features of volatility.
Examples
> python3 vol.py -f case.vmem windows.ldrmodules --verbose
Volatility 3 Framework 2.4.2
Progress: 100.00 PDB scanning finished
Pid Process Base InLoad InInit InMem MappedPath LoadPath InitPath MemPath
644 services.exe 0x22ea0970000 False False False \Windows\System32\ko-KR\services.exe.mui N/A N/A N/A
644 services.exe 0x7ff6cee90000 True False True \Windows\System32\services.exe C:\Windows\system32\services.exe : services.exe N/A C:\Windows\system32\services.exe : services.exe
660 lsass.exe 0x7ffd48da0000 True True True \Windows\System32\rsaenh.dll C:\Windows\system32\rsaenh.dll : rsaenh.dll C:\Windows\system32\rsaenh.dll : rsaenh.dll C:\Windows\system32\rsaenh.dll : rsaenh.dll
660 lsass.exe 0x7ffd4a610000 True True True \Windows\System32\rpcrt4.dll C:\Windows\System32\RPCRT4.dll : RPCRT4.dll C:\Windows\System32\RPCRT4.dll : RPCRT4.dll C:\Windows\System32\RPCRT4.dll : RPCRT4.dll
760 svchost.exe 0x7ff760700000 True False True \Windows\System32\svchost.exe C:\Windows\system32\svchost.exe : svchost.exe N/A C:\Windows\system32\svchost.exe : svchost.exe
760 svchost.exe 0x7ffd418e0000 True True True \Windows\System32\AppXDeploymentClient.dll C:\Windows\System32\AppXDeploymentClient.dll : AppXDeploymentClient.dll C:\Windows\System32\AppXDeploymentClient.dll : AppXDeploymentClient.dll C:\Windows\System32\AppXDeploymentClient.dll : AppXDeploymentClient.dll
760 svchost.exe 0x7ffd48da0000 True True True \Windows\System32\rsaenh.dll C:\Windows\system32\rsaenh.dll : rsaenh.dll C:\Windows\system32\rsaenh.dll : rsaenh.dll C:\Windows\system32\rsaenh.dll : rsaenh.dll
Thank you for your review @ikelos. The PR was quick, but I think there are a lot of things to work on while thinking about the contents of the review carefully. The response is a bit late, but this is still on my list of tasks of interest.