Volatility - objects

Open

#64 opened on Jan 3, 2018 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 3/5
Estimated time: 1-2 days
Newbie friendliness: 35/100

Issue type: Feature
Clarity: Mostly clear
Activity status: Stale
Domain: data

Research direction

Review the linked MISP netflow object definition and compare it with the Volatility mutantscan, SSDT, modules, and connscan samples in the issue. Add corresponding object definitions for the listed output fields, with completion shown by valid definitions that represent those samples.

Written by the indexing model from the issue text.

Description

enhancement

mutantscan

JSON export field name

"columns": [
    "Offset(P)",
    "Pointers",
    "Handles",
    "Signal",
    "Thread",
    "CID",
    "Name"
  ]
[33379968, 1, 1, "1", 0, "", ""], [33382448, 2, 1, "1", 0, "", "746bbf3569adEncrypt"], [33387864, 1, 1, "1", 0, "", ""], [33394584, 1, 1, "1", 0, "", ""], [33427592, 2, 1, "1", 0, "", "_SHuassist.mtx"]

SSDT

  "columns": [
    "Table",
    "TableOffset",
    "NumEntries",
    "Entry",
    "Addr",
    "Function",
    "Owner"
  ]
[
      "SSDT[1]",
      3214515072,
      667,
      4761,
      3214226858,
      "NtGdiUMPDEngFreeUserMem",
      "win32k.sys"
    ],
    [
      "SSDT[1]",
      3214515072,
      667,
      4762,
      3212932649,
      "NtGdiDrawStream",
      "win32k.sys"
    ]

modules

 "columns": [
    "Offset(V)",
    "Name",
    "Base",
    "Size",
    "File"
  ]
   [
      2182709560,
      "ParVdm.SYS",
      4173201408,
      8192,
      "\\SystemRoot\\System32\\Drivers\\ParVdm.SYS"
    ],
    [
      2183500848,
      "srv.sys",
      4152414208,
      335872,
      "\\SystemRoot\\system32\\DRIVERS\\srv.sys"
    ],
    [
      2182893856,
      "HTTP.sys",
      4150018048,
      266240,
      "\\SystemRoot\\System32\\Drivers\\HTTP.sys"
    ]

connscan

{
  "rows": [
    [
      34108960,
      "172.16.112.128:1038",
      "41.168.5.140:8080",
      1484
    ],
    [
      37388296,
      "172.16.112.128:1037",
      "125.19.103.198:8080",
      1484
    ]
  ],
  "columns": [
    "Offset(P)",
    "LocalAddress",
    "RemoteAddress",
    "PID"
  ]
}

This one can be easily mapped to netflow object.

Dominant language: Python
Stars: 110
Forks: 139
Avg merge: 12h 28m
Merged PRs (30d): 3

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

[Bug]: repeated memory selections consume the distinct-file retrieval budget Open

triage/confirmed

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

agentscope-ai/agentscope#2775 · Opened Sep 22, 2026
Bug: Opening a session restores old scroll position instead of showing the latest messages Open

comp/desktop P3 type/bug

Difficulty 1/5 Under an hour Newbie friendliness 92/100

NousResearch/hermes-agent#118866 · Opened Sep 22, 2026
Resize volume API validation errors are not displayed in the UI Open

bug

Difficulty 1/5 Under an hour Newbie friendliness 90/100

apache/cloudstack#14222 · Opened Sep 22, 2026
PSBT inputs finalized by Bitcoin Core are not considered complete Open

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

spesmilo/electrum#10986 · Opened Sep 22, 2026
`rfdetr.export.benchmark` always crashes unless `--disable_eval` is passed Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

roboflow/rf-detr#1501 · Opened Sep 22, 2026

More Python issues