reverseame/winesap

Volatility plugin to search for all Autostart Extensibility Points (AESPs)

winesap's Issues

Add JSON render

This plugin doesn't have json output.
Plesase, add the functionality.

This function works for me.

def render_json(self, outfd, data):
        for gen in data:
            for key in gen:
                root = key['root']
                filtered_keys = self.filter_key(key['key'], key['value'])
                for filtered_key in filtered_keys:
                    if not self._config.MATCH or (self._config.MATCH and filtered_key['reason']):
                        #if filtered_key['reason']:
                        #    outfd.write('\nWARNING: {0}'.format(warning_message(', '.join(filtered_key['reason']))))
                        #outfd.write('\n{0}{1}\n'.format(root, self.regapi.reg_get_key_path(filtered_key['key'])))

                        tp, dt = rawreg.value_data(filtered_key['value'])
                        if tp == 'REG_BINARY' or tp == 'REG_NONE':
                            dt = "\n" + "\n".join(["{0:#010x}  {1:<48}  {2}".format(o, h, ''.join(c)) for o, h, c in
                                                   utils.Hexdump(dt[:0x40])])
                        dic = {'key': '{0}{1}'.format(root, self.regapi.reg_get_key_path(filtered_key['key'])),
                               'name': self.get_value_name(filtered_key['value']),
                               'type': tp,
                               'value': dt,
                               'warning': ', '.join(filtered_key['reason']) if filtered_key['reason'] else None
                               }

                        #outfd.write('{0}: {1}: {2}\n'.format(self.get_value_name(filtered_key['value']), tp, dt))
                        outfd.write('{0}\n'.format(json.dumps(dic)))