基于Volatility的图形化用户界面的实现和应用  

Implementation and Application of GUI Based on Volatility

作　　者：李嘉鑫 张国荣 梁成辉 唐远新[1] 翟继强[1] LI Jiaxin;ZHANG Guorong;LIANG Chenghui;TANG Yuanxin;ZHAI Jiqiang(School of Computer Science and Technology,Harbin University of Science and Technology,Harbin 150080,China)

机构地区：[1]哈尔滨理工大学计算机科学与技术学院,黑龙江哈尔滨150080

出　　处：《计算机与网络》2021年第1期60-63,共4页Computer & Network

基　　金：国家级大学生创新创业训练项目(201910214012)。

摘　　要：Volatility是一个基于Python语言的开源内存取证框架,因功能强大而广泛应用在计算机内存取证和分析领域。针对Volatility基于命令行用户界面(CLI)参数繁多和使用不便的问题,使用Visual Studio 2016 C++集成开发环境,在详细分析Volatility命令数据结构的基础上,利用匿名管道和进程执行技术设计,实现了一个通用的Windows图形用户界面的Volatility操作程序,中文界面、交互性强,方便用户对内存转储文件进行解析和研究。Volatility is an open source memory forensics framework based on Python,which is widely used in the field of computer memory forensics and analysis because of its powerful function.The volatility is based on Command Line Interface(CLI),which has such problems as various parameters and inconvenient use.In view of these problems,a general Volatility operation program of windows graphical user interface is designed and implemented by using anonymous pipeline and process execution technology based on Visual Studio 2016 C++integrated development environment and the detailed analysis of the volatility command data structure.The Chinese interface has strong interaction,which is convenient for users to analyze and study the memory dump file.

关 键 词：取证 VOLATILITY 命令行用户界面 图形用户界面 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]