1

I'm trying to use a plugin (not built-in) with volatility 2.4 but am having trouble with the syntax. I know that at least for the native python (vol.py) the plugins option must be specified directly after vol.py. I've tried specifying the plugins directory as an absolute path and a relative path.

Command example:

volatility.exe --plugins=C:\volatility\plugins -f=memImage.mem --profile=Win7SP1x86 usnparser > usnparser.txt

Inside the plugins directory is:

usnparser.py

The error message I get is:

ERROR   : volatility.debug    : You must specify something to do (try -h)

This is the error I get anytime I specify a plugin that doesn't exist. I've tried this with a few plugins that don't come with volatility. I get the same results every time. Will probably move to using the default python version, but I'm curious why I can't get this working with the Windows executable.

2
  • 1
    I'm not sure this is on-topic here. This is a program-specific config question.
    – schroeder
    Oct 11, 2015 at 19:04
  • True, when I searched the stackexchange sites for "volatility" questions, most of them showed up here. Suggestion for best site for this? Thx.
    – Matt
    Oct 11, 2015 at 21:13

1 Answer 1

1

As mentioned, this may be off topic, but I will go ahead and describe the solution I found. My issue was that the plugin I was using was corrupted. Nothing else was wrong. However, it is important with Volatility that when an external plugin directory is used, the --plugins option must be the first option specified after the executable or it will not work and no error indicating why will be given.

1
  • I'm working on a final year project to develop a prototype plugin for Volatility, so this information will be quite helpful when I eventually come to development. Thanks :)
    – James
    Nov 14, 2015 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.