The Volatility Framework
volatility.obj.ProfileModification Class Reference

Class for modifying profiles for additional functionality. More...

Inheritance diagram for volatility.obj.ProfileModification:
volatility.plugins.addrspaces.crashbmp.BitmapDmpVTypes volatility.plugins.addrspaces.elfcoredump.VirtualBoxModification volatility.plugins.addrspaces.hpak.HPAKVTypes volatility.plugins.addrspaces.lime.LimeTypes volatility.plugins.addrspaces.vmware.VMwareVTypesModification volatility.plugins.bigpagepools.BigPageTableMagic volatility.plugins.bigpagepools.PoolTrackTypeOverlay volatility.plugins.crashinfo.CrashInfoModification volatility.plugins.dumpcerts.SSLKeyModification volatility.plugins.dumpfiles.ControlAreaModification volatility.plugins.dumpfiles.DumpFilesVTypesx86 volatility.plugins.evtlogs.EVTObjectTypes volatility.plugins.gui.editbox.EditBoxObjectClasses volatility.plugins.gui.editbox.EditBoxVTypes volatility.plugins.gui.vtypes.vista.Vista2008x64GuiVTypes volatility.plugins.gui.vtypes.vista.Vista2008x86GuiVTypes volatility.plugins.gui.vtypes.win2003.Win2003x86GuiVTypes volatility.plugins.gui.vtypes.win7.Win7GuiOverlay volatility.plugins.gui.vtypes.win7.Win7SP0x64GuiVTypes volatility.plugins.gui.vtypes.win7.Win7SP0x86GuiVTypes volatility.plugins.gui.vtypes.win7.Win7SP1x64GuiVTypes volatility.plugins.gui.vtypes.win7.Win7SP1x86GuiVTypes volatility.plugins.gui.vtypes.win7.Win7Vista2008x64Timers volatility.plugins.gui.vtypes.win7.Win7Vista2008x86Timers volatility.plugins.gui.vtypes.win7.Win7Win32KCoreClasses volatility.plugins.gui.vtypes.win8.Win8x64Gui volatility.plugins.gui.vtypes.win8.Win8x86Gui volatility.plugins.gui.vtypes.xp.XP2003x64BaseVTypes volatility.plugins.gui.vtypes.xp.XP2003x86BaseVTypes volatility.plugins.gui.win32k_core.AtomTablex64Overlay volatility.plugins.gui.win32k_core.AtomTablex86Overlay volatility.plugins.gui.win32k_core.Win32KCoreClasses volatility.plugins.gui.win32k_core.Win32KGahtiVType volatility.plugins.gui.win32k_core.Win32Kx64VTypes volatility.plugins.gui.win32k_core.Win32Kx86VTypes volatility.plugins.gui.win32k_core.XP2003x64TimerVType volatility.plugins.gui.win32k_core.XP2003x86TimerVType volatility.plugins.gui.win32k_core.XPx86SessionOverlay volatility.plugins.heaps.HeapModification volatility.plugins.iehistory.IEHistoryVTypes volatility.plugins.linux.bash.BashTypes volatility.plugins.linux.bash_hash.BashHashTypes volatility.plugins.linux.check_idt.LinuxIDTTypes volatility.plugins.linux.linux_truecrypt.LinuxTruecryptModification volatility.plugins.linux.slab_info.LinuxKmemCacheOverlay volatility.plugins.mac.bash.MacBashTypes volatility.plugins.mac.bash_hash.MacBashHashTypes volatility.plugins.mac.threads.MacObjectClasses2 volatility.plugins.mac.threads.MacObjectClasses4 volatility.plugins.malware.apihooks.MalwareWSPVTypes volatility.plugins.malware.callbacks.CallbackMods volatility.plugins.malware.cmdhistory.CmdHistoryObjectClasses volatility.plugins.malware.cmdhistory.CmdHistoryVTypesWin7x64 volatility.plugins.malware.cmdhistory.CmdHistoryVTypesWin7x86 volatility.plugins.malware.cmdhistory.CmdHistoryVTypesx64 volatility.plugins.malware.cmdhistory.CmdHistoryVTypesx86 volatility.plugins.malware.devicetree.MalwareDrivers volatility.plugins.malware.idt.MalwareIDTGDTx86 volatility.plugins.malware.psxview.MalwarePspCid volatility.plugins.malware.svcscan.Service8x64 volatility.plugins.malware.svcscan.Service8x86 volatility.plugins.malware.svcscan.ServiceBase volatility.plugins.malware.svcscan.ServiceBasex64 volatility.plugins.malware.svcscan.ServiceVista volatility.plugins.malware.svcscan.ServiceVistax64 volatility.plugins.malware.svcscan.ServiceVistax86 volatility.plugins.malware.threads.MalwareKthread volatility.plugins.malware.timers.TimerVTypes volatility.plugins.mbrparser.MbrObjectTypes volatility.plugins.mftparser.MFTTYPES volatility.plugins.netscan.NetscanObjectClasses volatility.plugins.notepad.XPHeapModification volatility.plugins.objtypescan.ObjectTypeKeyModification volatility.plugins.overlays.basic.BasicObjectClasses volatility.plugins.overlays.linux.elf.ELF32Modification volatility.plugins.overlays.linux.elf.ELF64Modification volatility.plugins.overlays.linux.elf.ELFModification volatility.plugins.overlays.linux.linux.LinuxGate64Overlay volatility.plugins.overlays.linux.linux.LinuxIntelOverlay volatility.plugins.overlays.linux.linux.LinuxMountOverlay volatility.plugins.overlays.linux.linux.LinuxObjectClasses volatility.plugins.overlays.linux.linux.LinuxOverlay volatility.plugins.overlays.mac.mac.DyldTypes volatility.plugins.overlays.mac.mac.MacObjectClasses volatility.plugins.overlays.mac.mac.MacOverlay volatility.plugins.overlays.mac.mac.MigTypes volatility.plugins.overlays.mac.macho.MachoModification volatility.plugins.overlays.mac.macho.MachoOverlay volatility.plugins.overlays.mac.macho.MachoTypes volatility.plugins.overlays.windows.hibernate_vtypes.HiberVistaSP01x64 volatility.plugins.overlays.windows.hibernate_vtypes.HiberVistaSP01x86 volatility.plugins.overlays.windows.hibernate_vtypes.HiberVistaSP2x64 volatility.plugins.overlays.windows.hibernate_vtypes.HiberVistaSP2x86 volatility.plugins.overlays.windows.hibernate_vtypes.HiberWin2003x64 volatility.plugins.overlays.windows.hibernate_vtypes.HiberWin7SP01x64 volatility.plugins.overlays.windows.hibernate_vtypes.HiberWin7SP01x86 volatility.plugins.overlays.windows.kdbg_vtypes.KDBGObjectClass volatility.plugins.overlays.windows.kdbg_vtypes.UnloadedDriverVTypes volatility.plugins.overlays.windows.kpcr_vtypes.KPCRProfileModification volatility.plugins.overlays.windows.pe_vtypes.WinPEObjectClasses volatility.plugins.overlays.windows.pe_vtypes.WinPEVTypes volatility.plugins.overlays.windows.pe_vtypes.WinPEx64VTypes volatility.plugins.overlays.windows.ssdt_vtypes.AbstractSyscalls volatility.plugins.overlays.windows.ssdt_vtypes.Win2003SyscallVTypes volatility.plugins.overlays.windows.ssdt_vtypes.Win64SyscallVTypes volatility.plugins.overlays.windows.ssdt_vtypes.WinSyscallsAttribute volatility.plugins.overlays.windows.tcpip_vtypes.Vista2008Tcpip volatility.plugins.overlays.windows.tcpip_vtypes.VistaSP12x64Tcpip volatility.plugins.overlays.windows.tcpip_vtypes.Win2003SP12Tcpip volatility.plugins.overlays.windows.tcpip_vtypes.Win7Tcpip volatility.plugins.overlays.windows.tcpip_vtypes.Win7Vista2008x64Tcpip volatility.plugins.overlays.windows.tcpip_vtypes.Win7x64Tcpip volatility.plugins.overlays.windows.tcpip_vtypes.Win81Tcpip volatility.plugins.overlays.windows.tcpip_vtypes.Win81x64Tcpip volatility.plugins.overlays.windows.tcpip_vtypes.Win8Tcpip volatility.plugins.overlays.windows.tcpip_vtypes.Win8x64Tcpip volatility.plugins.overlays.windows.tcpip_vtypes.WinXP2003AddressObject volatility.plugins.overlays.windows.tcpip_vtypes.WinXP2003Tcpipx64 volatility.plugins.overlays.windows.vad_vtypes.VadFlagsModification volatility.plugins.overlays.windows.vad_vtypes.VadTagModification volatility.plugins.overlays.windows.vad_vtypes.VistaVad volatility.plugins.overlays.windows.vad_vtypes.Win2003x86Vad volatility.plugins.overlays.windows.vad_vtypes.Win81Vad volatility.plugins.overlays.windows.vad_vtypes.Win8Vad volatility.plugins.overlays.windows.vad_vtypes.WinXPx86Vad volatility.plugins.overlays.windows.vista.VistaObjectClasses volatility.plugins.overlays.windows.vista.VistaPolicyKey volatility.plugins.overlays.windows.vista.VistaSP0x64Hiber volatility.plugins.overlays.windows.vista.VistaSP0x86Hiber volatility.plugins.overlays.windows.vista.VistaSP1x64Hiber volatility.plugins.overlays.windows.vista.VistaSP1x86Hiber volatility.plugins.overlays.windows.vista.VistaSP2x64Hiber volatility.plugins.overlays.windows.vista.VistaSP2x86Hiber volatility.plugins.overlays.windows.vista.VistaWin7KPCR volatility.plugins.overlays.windows.vista.Vistax64DTB volatility.plugins.overlays.windows.vista.Vistax86DTB volatility.plugins.overlays.windows.win10.Win10Cookie volatility.plugins.overlays.windows.win10.Win10ObjectHeader volatility.plugins.overlays.windows.win10.Win10Registry volatility.plugins.overlays.windows.win10.Win10x64DTB volatility.plugins.overlays.windows.win10.Win10x86DTB volatility.plugins.overlays.windows.win2003.EThreadCreateTime volatility.plugins.overlays.windows.win2003.Win2003SP0x86DTB volatility.plugins.overlays.windows.win2003.Win2003x64DTB volatility.plugins.overlays.windows.win2003.Win2003x64Hiber volatility.plugins.overlays.windows.win2003.Win2003x86DTB volatility.plugins.overlays.windows.win2003.Win2003x86Hiber volatility.plugins.overlays.windows.win7.Win7ObjectClasses volatility.plugins.overlays.windows.win7.Win7Pointer64 volatility.plugins.overlays.windows.win7.Win7x64DTB volatility.plugins.overlays.windows.win7.Win7x64Hiber volatility.plugins.overlays.windows.win7.Win7x86DTB volatility.plugins.overlays.windows.win7.Win7x86Hiber volatility.plugins.overlays.windows.win8.Win8ObjectClasses volatility.plugins.overlays.windows.win8.Win8x64DTB volatility.plugins.overlays.windows.win8.Win8x64MaxCommit volatility.plugins.overlays.windows.win8.Win8x86DTB volatility.plugins.overlays.windows.win8.Win8x86SyscallVTypes volatility.plugins.overlays.windows.win8_kdbg.Win8x64VolatilityKDBG volatility.plugins.overlays.windows.windows64.ExFastRefx64 volatility.plugins.overlays.windows.windows64.Windows64Overlay volatility.plugins.overlays.windows.windows.AbstractKDBGMod volatility.plugins.overlays.windows.windows.HandleTableEntryPreWin8 volatility.plugins.overlays.windows.windows.PoolTagModification volatility.plugins.overlays.windows.windows.WindowsObjectClasses volatility.plugins.overlays.windows.windows.WindowsOverlay volatility.plugins.overlays.windows.windows.WindowsVTypes volatility.plugins.overlays.windows.xp.XPOverlay volatility.plugins.pooltracker.PoolTrackTagOverlay volatility.plugins.privileges.TokenXP2003 volatility.plugins.pstree.ProcessAuditVTypes volatility.plugins.registry.auditpol.AudipolWin7 volatility.plugins.registry.auditpol.AuditpolTypesVista volatility.plugins.registry.auditpol.AuditpolTypesXP volatility.plugins.registry.shellbags.ShellBagsTypesVista volatility.plugins.registry.shellbags.ShellBagsTypesWin7 volatility.plugins.registry.shellbags.ShellBagsTypesXP volatility.plugins.registry.shimcache.ShimCacheTypes2003x64 volatility.plugins.registry.shimcache.ShimCacheTypes2003x86 volatility.plugins.registry.shimcache.ShimCacheTypesVistax64 volatility.plugins.registry.shimcache.ShimCacheTypesVistax86 volatility.plugins.registry.shimcache.ShimCacheTypesWin7x64 volatility.plugins.registry.shimcache.ShimCacheTypesWin7x86 volatility.plugins.registry.shimcache.ShimCacheTypesXPx86 volatility.plugins.registry.userassist.UserAssistVTypes volatility.plugins.registry.userassist.UserAssistWin7VTypes volatility.plugins.timeliner.Win7LdrDataTableEntry volatility.plugins.timeliner.Win7SP1CMHIVE volatility.plugins.timeliner.WinAllTime volatility.plugins.timeliner.WinXPTrim

Public Member Functions

def check (self, profile)
 Returns True or False as to whether the Modification should be applied.
 
def dependencies (self, profile)
 Returns a list of modifications that should go before this, and modifications that need to be after this.
 
def modification (self, profile)
 Abstract function for modifying the profile.
 

Static Public Attributes

list before = []
 
list after = []
 
dictionary conditions = {}
 

Detailed Description

Class for modifying profiles for additional functionality.


The documentation for this class was generated from the following file: