evolve

KO | EN

gitlite — search

#javascript #python #react #ai #typescript #golang #deep-learning #docker #nodejs #awesome #vue #pytorch #ios #openai

(★ 258)

Web interface for the Volatility Memory Forensics Framework

File Explorer

Download Latest Version (.zip)

- Dockerfile
- evolve-cmd.png
- evolve-connections copy.png
- evolve-connections.png
- evolve-logo.png
- evolve-wsock32.png
- __init__.py
- BaseMorph.py
- CountryCodedIp.py
- IntVsExtIp.py
- nsrl-filename-morph.py
- sampleconfigmorph.py
- samplemorph.py
- - dataTables.colReorder.css
  - dataTables.colVis.css
  - evolve.css
  - jquery.dataTables.min.css
  - jqueryFileTree.css
- - evolve-logo-sml.png
  - sort_asc.png
  - sort_asc_disabled.png
  - sort_both.png
  - sort_desc.png
  - sort_desc_disabled.png
  - twitter.png
- - dataTables.colReorder.js
  - dataTables.colVis.js
  - evolve.js
  - jquery-2.1.3.min.js
  - jquery.dataTables.min.js
  - jqueryFileTree.js
- apilist.htm
- evolve-logo-lrg.png
- evolve.htm
.gitignore
evolve.py
Plugins with SQLite output
query list.txt
README.md
setup.py

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<img src="https://github.com/JamesHabben/evolve/blob/master/images/evolve-logo.png" /> 
Web interface for the Volatility Memory Forensics Framework
https://github.com/volatilityfoundation/volatility

Current Version: 1.6 (2017-11-16) 
See what people are saying: [#EvolveTool](https://twitter.com/search?q=%23evolvetool) 
Short video demo:
https://youtu.be/55G2oGPQHF8 
Pre-Scan video:
https://youtu.be/mqMuQQowqMI

## Installation
This requires volatility to be a library, not just an EXE file sitting somewhere. Run these commands at python shell:

Download Volatility source zip from https://github.com/volatilityfoundation/volatility 
Inside the extracted folder run: 
`setup.py install`

Then install these dependencies: 
`pip install bottle` 
`pip install yara` 
`pip install distorm3` 
`pip install maxminddb` 
* Note: you may need to prefix `sudo` on the above commands depending on your OS.
* Note: You may also need to prefix `python` if it is not in your run path.
* Note: Windows may require distorm3 download: https://pypi.python.org/pypi/distorm3/3.3.0.
* Note: Windows pip seems to install Yara based on OS bitness, not python. Download installer: http://plusvic.github.io/yara/
* Note: Microsoft Visual C++ Compiler for Python 2.7 will help pip install distorm3 and pycrypto: http://www.microsoft.com/en-us/download/details.aspx?id=44266

## Usage
-f File containing the RAM dump to analyze 
-p Volatility profile to use during analysis (--profile may not work even though it shows as an option) 
-d Optional path for output file. Default is beside memory image 
-l Restrict web server from serving content outside of the local machine 
-r comma separated list of plugins to run at the start

!!! WARNING: Avoid writing sqlite to NFS shares. They can lock or get corrupt. If you must, try mounting share with 'nolock' option.

## Features
- Works with any Volatility module that provides a SQLite render method (some don't)
- Automatically detects plugins - If volatility sees the plugin, so will eVOLve
- All results stored in a single SQLite db stored beside the RAM dump
- Web interface is fully AJAX using jQuery & JSON to pass requests and responses
- Uses Bottle module in Python to provide a standalone web server
- Option to edit SQL query to provide enhanced data views with data from multiple tables
- Run plugins and view data from any browser - even a tablet!
- Allow multiple people to review results of single RAM dump
- Multiprocessing for full CPU usage
- Pre-Scan runs a list of plugins at the start

## Coming Features
- Save custom queries for future use
- Import/Export queries to share with others
- ~~Threading for more responsive interface while modules are running~~
- Export/save of table data to JSON, CSV, etc
- Review mode which requires only the generated SQLite file for better portability

Please send your ideas for features!

Release notes: 
v1.0 - Initial release 
v1.1 - Threading, Output folder option, removed unused imports 
v1.2 - Pre-Scan option to run list of plugins at the start 
v1.3 - Added Morph function and sample Morphs. Also fixed multiprocess bug in Windows. 
v1.4 - Added Morph config builder and more sample Morphs. Added searchable and sortable table. 
v1.5 - Added dynamic memory profile chooser. 
v1.6 - Added plugin search and other optimizations.

evolve

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

evolve

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

Download README