multivol 0.1.3__py3-none-any.whl → 0.1.4__py3-none-any.whl

multivol/multi_volatility2.py

@@ -25,21 +25,8 @@ class multi_volatility2:
                 rel_path = os.path.relpath(path, os.getcwd())
                 return os.path.join(host_path, rel_path)
         return path
-    
-    def generate_command_volatility2(self, command, dump, dump_dir, profiles_path, docker_image, profile, format):
-        # Generates the Docker command to run a Volatility2 module
-        return [
-            "docker", "run", "--rm", 
-            "-v", f"{dump_dir}:/dumps/{dump}", 
-            "-v", f"{profiles_path}:/home/vol/profiles",  
-            "-t", docker_image, "--plugins=/home/vol/profiles",
-            "-f", f"/dumps/{dump}",
-            f"--profile={profile}",
-            f"--output={format}",
-            f"{command}"
-        ]
 
-    def execute_command_volatility2(self, command, dump, dump_dir, profiles_path, docker_image, profile, output_dir, format, quiet=False, lock=None, host_path=None):
+    def execute_command_volatility2(self, command, dump, dump_dir, profiles_path, docker_image, profile, output_dir, format, quiet=False, lock=None, host_path=None, show_commands=False):
         # Executes a Volatility2 command in Docker and handles output
         if not quiet:
             self.safe_print(f"[+] Starting {command}...", lock)
@@ -59,6 +46,8 @@ class multi_volatility2:
         
         # Construct the command string to run inside the container
         cmd_args = f"--plugins=/home/vol/profiles -f /dumps/{dump} --profile={profile} --output={format} {command}"
+        if show_commands:
+            print(f"[DEBUG] Volatility 2 Command: vol.py {cmd_args}", flush=True)
 
         if format == "json":
             self.output_file = os.path.join(output_dir, f"{command}_output.json")
@@ -76,8 +65,17 @@ class multi_volatility2:
             )
             
             with open(self.output_file, "wb") as file:
-                for chunk in container.logs(stream=True):
-                    file.write(chunk)
+                try:
+                    for chunk in container.logs(stream=True):
+                        file.write(chunk)
+                except Exception as log_err:
+                    # Handle Docker log rotation errors
+                    self.safe_print(f"[!] Log streaming interrupted: {log_err}, fetching remaining logs...", lock)
+                    try:
+                        remaining_logs = container.logs(stream=False)
+                        file.write(remaining_logs)
+                    except:
+                        pass
             
             container.wait()
             container.remove()
@@ -110,160 +108,16 @@ class multi_volatility2:
             rprint(message)
 
     def getCommands(self, opsys):
-        # Returns a list of Volatility2 commands for the specified OS and mode
-        if opsys == "windows.light":
-            return ["cmdline",
-                    "cmdscan",
-                    "connscan",
-                    "consoles",
-                    "dlllist",
-                    "filescan",
-                    "hashdump",
-                    "malfind",
-                    "psscan",
-                    "pslist",
-                    "pstree",
-                    "psxview",
-                ]
-        elif opsys == "windows.full":
-            return ["cmdline",
-                    "cmdscan",
-                    "connscan",
-                    "consoles",
-                    "dlllist",
-                    "filescan",
-                    "hashdump",
-                    "malfind",
-                    "mftparser",
-                    "psscan",
-                    "pslist",
-                    "pstree",
-                    "psxview",
-                    "amcache",
-                    "atoms",
-                    "autoruns",
-                    "bitlocker",
-                    "cachedump",
-                    "chromecookies",
-                    "chromedownloads",
-                    "chromehistory",
-                    "chromevisits",
-                    "clipboard",
-                    "connections",
-                    "devicetree",
-                    "directoryenumerator",
-                    "driverirp",
-                    "drivermodule",
-                    "driverscan",
-                    "envars",
-                    "evtlogs",
-                    "firefoxcookies",
-                    "firefoxdownloads",
-                    "firefoxhistory",
-                    "gahti",
-                    "getservicesids",
-                    "getsids",
-                    "handles",
-                    "hivelist",
-                    "hivescan",
-                    "hpakinfo",
-                    "lsadump",
-                    "mbrparser",
-                    "messagehooks",
-                    "modscan",
-                    "modules",
-                    "multiscan",
-                    "mutantscan",
-                    "networkpackets",
-                    "prefetchparser",
-                    "privs",
-                    "psinfo",
-                    "schtasks",
-                    "screenshot",
-                    "servicediff",
-                    "sessions",
-                    "shellbags",
-                    "shimcache",
-                    "sockets",
-                    "sockscan",
-                    "ssdt",
-                    "svcscan",
-                    "symlinkscan",
-                    "thrdscan",
-                    "threads",
-                    "unloadedmodules",
-                    "userassist",
-                    "userhandles",
-                ]
-        elif opsys == "linux.light":
-            return ["linux_bash",
-                    "linux_ifconfig",
-                    "linux_malfind",
-                    "linux_netscan",
-                    "linux_enumerate_files",
-                    "linux_netstat",
-                    "linux_psaux",
-                    "linux_pslist",
-                    "linux_psscan",
-                    "linux_pstree",
-                    "linux_psxview"
-                ]
-        elif opsys == "linux.full":
-            return ["linux_banner",
-                    "linux_bash",
-                    "linux_ifconfig",
-                    "linux_malfind",
-                    "linux_netscan",
-                    "linux_netstat",
-                    "linux_psaux",
-                    "linux_pslist",
-                    "linux_psscan",
-                    "linux_pstree",
-                    "linux_psxview",
-                    "linux_apihooks",
-                    "linux_arp",
-                    "linux_aslr_shift",
-                    "linux_bash_env",
-                    "linux_bash_hash",
-                    "linux_check_afinfo",
-                    "linux_check_creds",
-                    "linux_check_fop",
-                    "linux_check_idt",
-                    "linux_check_inline_kernel",
-                    "linux_check_modules",
-                    "linux_check_syscall",
-                    "linux_check_syscall_arm",
-                    "linux_check_tty",
-                    "linux_cpuinfo",
-                    "linux_dentry_cache",
-                    "linux_dmesg",
-                    "linux_dynamic_env",
-                    "linux_elfs",
-                    "linux_getcwd",
-                    "linux_hidden_modules",
-                    "linux_info_regs",
-                    "linux_iomem",
-                    "linux_kernel_opened_files",
-                    "linux_keyboard_notifiers",
-                    "linux_ldrmodules",
-                    "linux_library_list",
-                    "linux_list_raw",
-                    "linux_lsmod",
-                    "linux_lsof",
-                    "linux_memmap",
-                    "linux_mount",
-                    "linux_mount_cache",
-                    "linux_netfilter",
-                    "linux_pidhashtable",
-                    "linux_pkt_queues",
-                    "linux_plthook",
-                    "linux_proc_maps",
-                    "linux_proc_maps_rb",
-                    "linux_process_hollow",
-                    "linux_psenv",
-                    "linux_pslist_cache",
-                    "linux_route_cache",
-                    "linux_sk_buff_cache",
-                    "linux_threads",
-                    "linux_truecrypt_passphrase"
-                ]
+
+        base_dir = os.path.dirname(os.path.abspath(__file__))
+
+        yaml_path = os.path.join(base_dir, "plugins_list", f"vol2_{opsys}.yaml")
+        if not os.path.exists(yaml_path):
+            raise FileNotFoundError(f"File not found : {yaml_path}")
+
+        with open(yaml_path, "r", encoding="utf-8") as f:
+            data = yaml.safe_load(f)
+
+            modules_list = data["modules"]
+
+            return modules_list

multivol/multi_volatility3.py

@@ -3,10 +3,12 @@
 import time
 import os
 import json
+import re
+import uuid
 from rich import print as rprint
+import yaml
 import docker
 
-
 class multi_volatility3:
     def __init__(self):
         # Constructor for multi_volatility3 class
@@ -26,7 +28,7 @@ class multi_volatility3:
                 return os.path.join(host_path, rel_path)
         return path
 
-    def execute_command_volatility3(self, command, dump, dump_dir, symbols_path, docker_image, cache_dir, plugin_dir, output_dir, format, quiet=False, lock=None, host_path=None, fetch_symbols=False):
+    def execute_command_volatility3(self, command, dump, dump_dir, symbols_path, docker_image, cache_dir, plugin_dir, output_dir, format, quiet=False, lock=None, host_path=None, fetch_symbols=False, show_commands=False, custom_symbol=None, scan_id=None):
         # Executes a Volatility3 command in Docker and handles output
         if not quiet:
             self.safe_print(f"[+] Starting {command}...", lock)
@@ -42,6 +44,10 @@ class multi_volatility3:
         host_dump_path = self.resolve_path(os.path.abspath(dump_dir), host_path)
         host_dump_dir = os.path.dirname(host_dump_path)
         
+        # Debug logging for path resolution
+        print(f"[DEBUG] dump={dump}, dump_dir={dump_dir}", flush=True)
+        print(f"[DEBUG] host_dump_path={host_dump_path}, host_dump_dir={host_dump_dir}", flush=True)
+        
         volumes = {
              host_dump_dir: {'bind': '/dump_dir', 'mode': 'ro'},
              host_symbols_path: {'bind': '/symbols', 'mode': 'rw'},
@@ -60,8 +66,13 @@ class multi_volatility3:
         # NOTE: -f expects the file path. Volume maps dump_dir to /dump_dir. 
         # So dump file is at /dump_dir/basename(dump)
         dump_filename = os.path.basename(dump)
+        print(f"[DEBUG] dump_filename={dump_filename}, full path in container=/dump_dir/{dump_filename}", flush=True)
         base_args = f"vol -q -f /dump_dir/{dump_filename} -s /symbols -p /plugins"
 
+        if custom_symbol:
+            if show_commands:
+                print(f"[DEBUG] Custom Symbol Selected: {custom_symbol}", flush=True)
+
         if fetch_symbols:
             base_args = f"{base_args} --remote-isf-url https://github.com/Abyss-W4tcher/volatility3-symbols/raw/master/banners/banners.json"
 
@@ -71,10 +82,26 @@ class multi_volatility3:
         else:
             self.output_file = os.path.join(output_dir, f"{command}_output.txt")
             cmd_args = f"{base_args} {command}"
+        
+        # Debug: verify output path
+        print(f"[DEBUG] output_dir={output_dir}, output_file={self.output_file}", flush=True)
+        print(f"[DEBUG] output_dir exists: {os.path.exists(output_dir)}", flush=True)
+        if show_commands:
+            print(f"[DEBUG] Volatility 3 Command: {cmd_args}", flush=True)
+            print(f"[DEBUG] Docker Volumes: {json.dumps(volumes, indent=2)}", flush=True)
 
         try:
+            # Sanitize command name for Docker container name
+            # Use scan_id for predictable naming so API can track container status
+            sanitized_name = re.sub(r'[^a-zA-Z0-9_.-]', '', command)
+            if scan_id:
+                container_name = f"vol3_{scan_id[:8]}_{sanitized_name}"
+            else:
+                container_name = f"vol3_{sanitized_name}_{str(uuid.uuid4())[:8]}"
+
             container = client.containers.run(
                 image=docker_image,
+                name=container_name, # Name the container
                 command=cmd_args,
                 volumes=volumes,
                 tty=True, 
@@ -83,14 +110,27 @@ class multi_volatility3:
             )
             
             with open(self.output_file, "wb") as file:
-                for chunk in container.logs(stream=True):
-                    file.write(chunk)
+                try:
+                    for chunk in container.logs(stream=True):
+                        file.write(chunk)
+                except Exception as log_err:
+                    # Handle Docker log rotation errors (common with long-running modules)
+                    self.safe_print(f"[!] Log streaming interrupted: {log_err}, fetching remaining logs...", lock)
+                    try:
+                        # Fallback: fetch all logs at once instead of streaming
+                        remaining_logs = container.logs(stream=False)
+                        file.write(remaining_logs)
+                    except:
+                        pass  # Best effort - container may have finished
             
-            container.wait()
-            container.remove()
+            wait_result = container.wait()
+            exit_code = wait_result.get('StatusCode', 0)
+            # Don't remove container - API will check status and clean up
+            # container.remove()
 
         except Exception as e:
              self.safe_print(f"[!] Error running {command}: {e}", lock)
+             return (command, False)
         
         time.sleep(0.5)
         if format == "json":
@@ -121,32 +161,40 @@ class multi_volatility3:
             
         # Validation
         success = False
-        try:
-            with open(self.output_file, "r") as f:
-                content = f.read()
-            
-            # Check for known error string regardless of format
-            if "Volatility experienced" in content:
-                success = False
-            elif format == "json":
-                # Simple validation check matching API logic
-                start_index = content.find('[')
-                if start_index == -1:
-                    start_index = content.find('{')
+        
+        # Check Exit Code first
+        if exit_code != 0:
+            success = False
+        else:
+            try:
+                with open(self.output_file, "r") as f:
+                    content = f.read()
                 
-                if start_index != -1:
-                    json.loads(content[start_index:])
-                    success = True
+                # Check for known error strings
+                # "Volatility experienced": General runtime error
+                # "vol.py: error:": Command line argument error
+                # "usage: vol": Often printed on argument error
+                if "Volatility experienced" in content or "vol.py: error:" in content or "vol: error:" in content:
+                    success = False
+                elif format == "json":
+                    # Simple validation check matching API logic
+                    start_index = content.find('[')
+                    if start_index == -1:
+                        start_index = content.find('{')
+                    
+                    if start_index != -1:
+                        json.loads(content[start_index:])
+                        success = True
+                    else:
+                        # Fallback check
+                         lines = content.splitlines()
+                         if len(lines) > 1:
+                             json.loads('\n'.join(lines[1:]))
+                             success = True
                 else:
-                    # Fallback check
-                     lines = content.splitlines()
-                     if len(lines) > 1:
-                         json.loads('\n'.join(lines[1:]))
-                         success = True
-            else:
-                success = True # Assume text output is successful if no crash and no error string
-        except:
-            success = False
+                    success = True # Assume text output is successful if no crash and no error string
+            except:
+                success = False
 
         return (command, success)
 
@@ -158,77 +206,16 @@ class multi_volatility3:
             rprint(message)
 
     def getCommands(self, opsys):
-        # Returns a list of Volatility3 commands for the specified OS and mode
-        if opsys == "windows.full":
-            return ["windows.cmdline.CmdLine", 
-                    "windows.cachedump.Cachedump", 
-                    "windows.dlllist.DllList", 
-                    "windows.driverirp.DriverIrp", 
-                    "windows.drivermodule.DriverModule", 
-                    "windows.driverscan.DriverScan", 
-                    "windows.envars.Envars", 
-                    "windows.filescan.FileScan", 
-                    "windows.getservicesids.GetServiceSIDs", 
-                    "windows.getsids.GetSIDs", 
-                    "windows.handles.Handles", 
-                    "windows.hashdump.Hashdump", 
-                    "windows.lsadump.Lsadump", 
-                    "windows.info.Info", 
-                    "windows.malfind.Malfind", 
-                    "windows.mftscan.MFTScan", 
-                    "windows.modules.Modules", 
-                    "windows.netscan.NetScan", 
-                    "windows.netstat.NetStat", 
-                    "windows.privileges.Privs", 
-                    "windows.pslist.PsList", 
-                    "windows.psscan.PsScan", 
-                    "windows.pstree.PsTree", 
-                    "windows.registry.hivelist.HiveList", 
-                    "windows.registry.certificates.Certificates", 
-                    "windows.registry.hivescan.HiveScan", 
-                    "windows.registry.userassist.UserAssist", 
-                    "windows.sessions.Sessions"
-                ]
-        elif opsys == "windows.light":
-            return ["windows.cmdline.CmdLine",
-                    "windows.info.Info",
-                    "windows.filescan.FileScan",
-                    "windows.netscan.NetScan",
-                    "windows.netstat.NetStat",
-                    "windows.pslist.PsList",
-                    "windows.psscan.PsScan",
-                    "windows.pstree.PsTree",
-                    "windows.dlllist.DllList",
-                    "windows.hashdump.Hashdump"
-                ]
-        elif opsys == "linux":
-            return ["linux.bash.Bash", 
-                    "linux.capabilities.Capabilities", 
-                    "linux.check_syscall.Check_syscall", 
-                    "linux.elfs.Elfs", 
-                    "linux.envars.Envars", 
-                    "linux.library_list.LibraryList", 
-                    "linux.lsmod.Lsmod", 
-                    "linux.lsof.Lsof", 
-                    "linux.malfind.Malfind", 
-                    "linux.mountinfo.MountInfo", 
-                    "linux.psaux.PsAux", 
-                    "linux.pslist.PsList", 
-                    "linux.psscan.PsScan", 
-                    "linux.pstree.PsTree", 
-                    "linux.sockstat.Sockstat",
-                    "linux.boottime.Boottime",
-                    "linux.check_creds.Check_creds",
-                    "linux.hidden_modules.Hidden_modules",
-                    "linux.ip.Addr",
-                    "linux.ip.Link",
-                    "linux.keyboard_notifiers.Keyboard_notifiers",
-                    "linux.modxview.Modxview",
-                    "linux.netfilter.Netfilter",
-                    "linux.pagecache.Files",
-                    "linux.pidhashtable.PIDHashTable",
-                    "linux.tracing.ftrace.CheckFtrace",
-                    "linux.tracing.perf_events.PerfEvents",
-                    "linux.tracing.tracepoints.CheckTracepoints",
-                    "linux.tty_check.tty_check"
-                ]
+
+        base_dir = os.path.dirname(os.path.abspath(__file__))
+
+        yaml_path = os.path.join(base_dir, "plugins_list", f"vol3_{opsys}.yaml")
+        if not os.path.exists(yaml_path):
+            raise FileNotFoundError(f"File not found : {yaml_path}")
+
+        with open(yaml_path, "r", encoding="utf-8") as f:
+            data = yaml.safe_load(f)
+
+            modules_list = data["modules"]
+
+            return modules_list