1

I'm trying to use a plugin (not built-in) with volatility 2.4 but am having trouble with the syntax. I know that at least for the native python (vol.py) the plugins option must be specified directly after vol.py. I've tried specifying the plugins directory as an absolute path and a relative path.

Command example:

volatility.exe --plugins=C:\volatility\plugins -f=memImage.mem --profile=Win7SP1x86 usnparser > usnparser.txt

Inside the plugins directory is:

usnparser.py

The error message I get is:

ERROR   : volatility.debug    : You must specify something to do (try -h)

This is the error I get anytime I specify a plugin that doesn't exist. I've tried this with a few plugins that don't come with volatility. I get the same results every time. Will probably move to using the default python version, but I'm curious why I can't get this working with the Windows executable.

2
  • 1
    I'm not sure this is on-topic here. This is a program-specific config question.
    – schroeder
    Oct 11, 2015 at 19:04
  • True, when I searched the stackexchange sites for "volatility" questions, most of them showed up here. Suggestion for best site for this? Thx. Oct 11, 2015 at 21:13

1 Answer 1

1

As mentioned, this may be off topic, but I will go ahead and describe the solution I found. My issue was that the plugin I was using was corrupted. Nothing else was wrong. However, it is important with Volatility that when an external plugin directory is used, the --plugins option must be the first option specified after the executable or it will not work and no error indicating why will be given.

1
  • I'm working on a final year project to develop a prototype plugin for Volatility, so this information will be quite helpful when I eventually come to development. Thanks :)
    – James
    Nov 14, 2015 at 11:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .