scops1234

volatility win

Sep 18th, 2017
24
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 1.32 KB | None | 0 0
  1. #/bin/bash
  2. memory_file=$1
  3. platform=$2
  4. if [ "$1" == "-h" ]
  5. then
  6.  echo ./volatility [memory_file] [profile]
  7. exit 1
  8. fi
  9.  
  10. if [ -z "$1" ] ;then
  11.   memory_file=Win7SP1x64
  12. fi
  13. echo $memory_file
  14. if [ "$2" == "" ]
  15. then
  16.   python /opt/volatility/vol.py -f $memory_file imageinfo >imageinfo.txt
  17.   platform=`cat imageinfo.txt |grep Profile |awk '{print substr($4,0,length($4)-1)}'`
  18.  
  19. fi
  20.  
  21. echo -e "memory_file=$memory_file \t platform=$platform"
  22. echo volatility running
  23. echo -e -n "filescan running....... \t" &&python /opt/volatility/vol.py  -f $memory_file --profile $platform filescan >filescan.txt 2> /dev/null && echo filescan success
  24. echo -e -n "pslist running....... \t" &&python /opt/volatility/vol.py  -f $memory_file --profile $platform pslist >pslist.txt 2> /dev/null && echo pslist success
  25. echo -e -n "netscan running....... \t" &&python /opt/volatility/vol.py  -f $memory_file --profile $platform netscan >netscan.txt 2> /dev/null && echo netscan success
  26. echo -e -n "cmdscan running....... \t" &&python /opt/volatility/vol.py  -f $memory_file --profile $platform cmdscan >cmdscan.txt 2> /dev/null && echo cmdscan success
  27. #strings $memory_file > strings.txt
  28. echo -e -n "timeliner running....... \t" && python /opt/volatility/vol.py  -f $memory_file --profile $platform timeliner >timeliner.txt 2> /dev/null && echo timeliner success
Add Comment
Please, Sign In to add comment