[ { "path": ".gitattributes", "content": "* text=auto\n" }, { "path": ".gitignore", "content": "*.py[cod]\n\n# Pycharm ide library\n.idea\n\n*.swp\n\n# C extensions\n*.so\n\n# Packages\n*.egg\n*.egg-info\ndist\nbuild\neggs\nparts\nbin\nvar\nsdist\ndevelop-eggs\n.installed.cfg\nlib\nlib64\n\n# Installer logs\npip-log.txt\n\n# Unit test / coverage reports\n.coverage\n.tox\nnosetests.xml\n\n# Translations\n*.mo\n\n# Mr Developer\n.mr.developer.cfg\n.project\n.pydevproject\n\n.svn/\n.DS_Store\n\n# compressed files\n*.zip\n*.7z\n*.rar\n*.tar.gz\n*.gz\n\n# common memory extensions:\n*.vmem\n*.mem\n*.img\n*.dmp\n*.sys\n*.bin\n*.001\n*.raw\n" }, { "path": "AUTHORS.txt", "content": "===============================================\nThis file identifies core Volatility authors. \n\nAll lists are alphabetical. \n===============================================\n\nVolatility 2.6:\n------------\n\nMike Auty\nAndrew Case\nMichael Hale Ligh\nJamie Levy\nAAron Walters\nNick L. Petroni, Jr.\n\n\nVolatility 2.4, 2.5:\n------------\n\nMike Auty\nAndrew Case\nMichael Hale Ligh\nJamie Levy\nAAron Walters\n\nVolatility 2.0, 2.1, 2.2, 2.3:\n------------\n\nMike Auty\nAndrew Case\nMichael Cohen\nBrendan Dolan-Gavitt\nMichael Hale Ligh\nJamie Levy\nAAron Walters\n\nVolatility 1.3:\n------------\n\nAAron Walters \nVolatile Systems LLC\n\nBrendan Dolan-Gavitt \n\nVolatools Basic authors:\n------------\n\nAAron Walters \nKomoku, Inc.\n\nNick L. Petroni, Jr.\nKomoku, Inc.\n" }, { "path": "CHANGELOG.txt", "content": "Changelog\n\nAs of Volatility 2.4, all changes are now tracked on the GitHub site:\n\nhttps://github.com/volatilityfoundation/volatility\n\nVolatility 2.0-2.3: all changes were tracked on the Google Code site: \n\nhttp://code.google.com/p/volatility/source/list\n\n04.8.2009 Volatility-1.3.1 moyix\n * Update: Introduce BufferAddressSpace and refactor\n * Files:\n forensics/addrspace.py\n forensics/object.py\n Description:\n Added a new BufferAddressSpace class that acts like a regular\n FileAddressSpace, but can be instantiated from a string buffer.\n This allows any function that expects an address space to work on\n a buffer instead. Also refactored the *_buf functions in object.py\n to use this class instead (reduces code duplication). Thanks to\n Michael Cohen for the idea.\n\n04.8.2009 Volatility-1.3.1 moyix\n * Update: Add support for inactive hiberfiles to hibinfo\n * Files:\n forensics/win32/hiber_addrspace.py\n Description:\n Added the ability to convert hibernation files that are in the\n \"inactive\" state (their first page is zeroed) to dd format. It is\n still not possible to run Volatility directly on such files, but\n they can now be converted for analysis. Thanks to Jon Evans for\n the suggestion.\n\n04.8.2009 Volatility-1.3.1 moyix\n * Update: Pool scanning enhancements\n * Files:\n forensics/win32/scan2.py\n forensics/object.py\n Description:\n Incorporated new functions written by Andreas Schuster to allow\n more fine-grained checks in pool scanners, and modularize some of\n the accessors (get_poolsize, get_poolsize, etc.). The patch also\n adds read_unicode_string_buf and read_string_buf, which operate on\n string buffers. Thanks to Andreas Schuster for the patch.\n\n04.7.2009 Volatility-1.3 awalters\n * Update: Handle table parsing\n * Files:\n forensics/win32/handles.py\n Description:\n Updated handle parsing code to fix typo. It was not\n adding the correct offset for Level 3 tables. It was also\n not traversing all the entries. Thanks to Brendan Dolan-Gavitt.\n\n04.7.2009 Volatility-1.3 awalters\n * Update: Network Offsets\n * Files:\n forensics/win32/network.py\n Description:\n Added new offset updates. Thanks to Jun Koi.\n\n03.17.2009 Volatility-1.3 awalters\n * Update: x86.py robustness\n * Files:\n forensics/x86.py\n Description:\n Added more robustness to the x86 address space. This time\n it focused on PAE. Certain samples were reading outside of \n the physical address space. Thanks to Brendan Dolan-Gavitt for patch.\n\n03.17.2009 Volatility-1.3.1 awalters\n * Bug: Hiberfil Address space w\n * Files:\n forensics\\win32\\hiber_addrspace.py\n Description:\n Needed to import the PAE address space. This only meant\n that hibinfo was having some issue. It would still process\n hiberfil's just fine. Thanks to Andreas Schuster for the bug report.\n\n03.17.2009 Volatility-1.3.1 awalters\n * Update: New version of tcp driver needed new offsets in SP3\n * Files:\n forensics/win32/network.py\n\tforensics/win32/scan2.py\n\tforensics/win32/scan.py\n Description:\n Added new offsets to network to handle new driver. Updated scan2\n and scan as well to support new pool allocation size. Thanks to Brendan \n Dolan-Gavitt.\n\n02.22.2009 Volatility-1.3.1 awalters\n * Update: procdump check peb\n * Files:\n vmodules.py\n Description:\n Added a check to make sure that the PEB is memory resident.\n\n02.05.2009 Volatility-1.3.1 awalters\n * Update: Handle parsing\n * Files: \n forensics/win32/handles.py\n\tvmodules.py\n Description:\n Updated handle parsing code to correctly handle middle\n and upper layer handles in multi-level schemes. Also\n changed files to now use the common parsing code.\n\n12.11.2008 Volatility-1.3.1 awalters\n * Update: Plugin Generators\n * Files:\n forensics/commands.py\n\tmemory_plugins/example4.py\n\tvutils.py\n Description:\n Added the ability to use generators in your plugins. This\n is extremely powerful and allows us to support arbitrary\n output formats. Thanks to Michael Cohen for the patch.\n\n\n12.11.2008 Volatility-1.3.1 awalters\n * Update: Object Inheritance\n * Files:\n forensics/object2.py\n forensics/registry.py\n memory_plugins/example3.py\n Description:\n Plugins creators are now able to express an inheritance order\n associated with an object. The default is the Profile objects.\n This fixes a problem associated with collisions. Thanks to \n Cameron C Caffee for the bug report and thanks to Brendan \n Dolan-Gavitt and Michael Cohen for insightful discussions.\n\n12.10.2008 Volatility-1.3.1 awalters\n * Update: lists.py\n * Files:\n forensics/win32/lists.py\n Description:\n Added Brendan Dolan-Gavitt lists.py file for traversing kernel\n\tlinked lists. Thanks Brendan.\n\n12.06.2008 Volatility-1.3.1 awalters\n * Bug: Crashdump base address space\n * Files:\n forensics/win32/tasks.py\n Description:\n Changed find_csdversion so that it does not pass in the filename.\n\tMade fname an optional parameter to process_addr_space since it is\n\tno longer being used and only maintained for backward compatibility.\n\tThanks to Richard Austin for the bug report.\n\n11.25.2008 Volatility-1.3.1 awalters\n * Bug: modules_list\n * Files:\n forensics/win32/modules.py\n Description:\n Added a check to make sure both PsLoadedModuleList and this\n\tmodule were defined.\n\n11.25.2008 Volatility-1.3.1 awalters\n * Update: Tabs and spaces\n * Files:\n Too Many\n Description:\n Spent some quality time with the tab nanny.\n\n11.25.2008 Volatility-1.3.1 awalters\n * Bug: Added more checks for registry objects\n * Files:\n forensics/win32/registry.py\n Description:\n Added more checks in print_entry_keys for invalid pages.\n\tSome of the key path was crossing page boundaries so more\n\tchecks needed to be added. Thanks to Christian Herndler \n\tfor the bug report.\n\n11.22.2008 Volatility-1.3.1 awalters\n * Update: get_obj_offset no longer modifies passed in list\n * Files:\n forensics/object.py\n Description:\n get_obj_offset previously modified the passed-in list used\n\tto represent type information. Now it works on a copy to\n\tprevent unexpected behavior. Thanks to Brendan Dolan-Gavitt\n\tfor the update.\n\n11.17.2008 Volatility-1.3.1 awalters\n * Bug: Checks to make sure KeyControlBlock is a valid address\n * Files:\n forensics/win32/registry.py\n Description:\n print_entry_keys has been updated to check that KeyControlBlock \n\tis a valid address. Thanks to Christian Herndler for the bug\n\treport and Brendan Dolan-Gavitt for the bug fix.\n\n11.15.2008 Volatility-1.3.1 awalters\n * Update: removed sha module from crashdump\n * Files:\n forensics/win32/crashdump.py\n Description:\n Removed the attempt to import the sha module since it generates\n\ta warning with Python 2.6. Thanks to STC for reporting the issue.\n\n11.14.2008 Volatility-1.3.1 awalters\n * Bug: added more checks in object parsing for invalid pages\n * Files:\n forensics/win32/handles.py\n\tforensics/win32/registry.py\n\tvmodules.py\n Description:\n Added more checks for invalid pages while processing the \n\t object directory. Thanks to Christian Herndler for the bug \n\t report.\n\n11.03.2008 Volatility-1.3.1 awalters\n * Bug: Python 2.5 finally\n * Files:\n vmodules.py\n Description:\n Removed the finally clause that is only available in Python 2.5.\n\tThanks to Cameron Caffee for the bug report and Brendan Dolan-Gavitt\n\tfor the bug fix.\n\n10.17.2008 Volatility-1.3.1 awalters\n * Bug: Checking for invalid pages\n * Files:\n forensics/object2.py\n Description:\n Added more checks to object2 to makes sure the addresses\n\t being accessed are valid. If not, then they now return a None.\n\t Thanks to Jesse Kornblum for submitting a patch.\n\n9.27.2008 Volatility-1.3.1 awalters\n * Update: plugin directory now relative to registry\n * Files:\n forensics/registry.py\n Description:\n The plugin search is now performed relative to registry.py. Thanks\n\tto Michael Cohen for the patch.\n\n9.4.2008 Volatility-1.3.1 awalters\n * Bug: length bug in hiberaddrspace\n * Files:\n forensics\\win32\\hiber_addrspace.py\n Description:\n We were referencing an undefined length variable. Thanks\n\tto Andreas Schuster for sending the patch.\n\n9.4.2008 Volatility-1.3.1 awalters\n * Update: Find the plugin modules\n * Files:\n forensics/registry.py\n Description:\n Added the absolute path to search for dynamic plugins. This allows\n\tvolatility to be called from anywhere on the system. Thanks\n\tto Andreas Schuster for sending the patch.\n\n8.14.2008 Volatility-1.3 awalters\n * Update: x86.py robustness\n * Files:\n forensics/x86.py\n Description:\n Added more robustness to the x86 address space. Thanks to Brendan\n\tDolan-Gavitt for sending in a bug report.\n\n8.14.2008 Volatility-1.3 awalters\n * Update: Standardized _LDR_MODULE -> _LDR_DATA_TABLE_ENTRY\n * Files:\n forensics/win32/modules.py\n\tforensics/win32/scan.py\n\tforensics/win32/scan2.py\n Description:\n Changed the data type names to make them more standardized across\n operating system versions. Thanks Brendan Dolan-Gavitt for\n sending in update request.\n\n6.26.2008 Volatility-1.3 awalters\n * Bug: regobjkey initialize list\n * Files:\n vmodules.py\n Description:\n When specifying a offset for regobjkey the list\n\thad not been initialized yet. Thanks to Brendan Dolan-Gavitt\n\tfor sending in a bug report.\n\n6.24.2008 Volatility-1.3 awalters\n * Update: 64-bit hosts\n * Files:\n forensics/object.py\n\tforensics/win32/crashdump.py\n\tforensics/win32/scan2.py\n\tforensics/win32/network.py\n\tforensics/win32/executable.py\n Description:\n Updated so that modules will work correctly\n\twhen run from 64-bit hosts using python 2.5.\n\tThanks to sham for sending in the bug report.\n\n6.23.2008 Volatility-1.3 awalters\n * Bug: Non-resident Vad address\n * Files:\n forensics/win32/vad.py\n\tvmodules.py\n Description:\n Updated the vad modules to handle\n\tinvalid addresses in low memory situations.\n\tThanks to Bryan D. Payne for sending in \n\ta bug report.\n\n6.23.2008 Volatility-1.3 awalters\n * Bug: Handle count paged\n * Files:\n forensics/win32/tasks.py\n Description:\n Received a sample where the ObjectTable\n\twas not a valid address. Added a check to make\n\tsure it is valid. Thanks to Bryan D. Payne\n\tfor sending in a bug report.\n\n6.22.2008 Volatility-1.3 awalters\n * Update: Ident info\n * Files:\n forensics/win32/tasks.py\n\tvutils.py \n Description:\n Updated ident command so that it correctly\n\tfinds the version of XP, now that we have\n\tsupport for SP3. Thanks to jeremie0 for noticing\n\tand to Brendan Dolan-Gavitt for helping with\n\tthe fix.\n\n6.11.2008 Volatility-1.3 awalters\n * Update: Array Types\n * Files:\n forensics/object2.py\n Description:\n Changed arrays so that they now return objects\n\tin cases where they are not native types. Thanks\n\tto Brendan Dolan-Gavitt for the update!\n\n6.8.2008 Volatility-1.3 awalters\n * Bug: Invalid page directories\n * Files:\n vmodules.py\n Description:\n Added code to catch the cases when we encounter\n\tinvalid page directories. Thanks to both Angelo Cavallini\n\tand Brendan Dolan-Gavitt for reporting this bug.\n \n6.8.2008 Volatility-1.3 awalters\n * Update: potential bad string characters (unicode escaping)\n * Files:\n forensics/win32/scan2.py\n\tforensics/object.py\n Description:\n Attempting to standardize error handling related to unicode\n\tconversions. Thus we are now passing an explicit error\n\tstring argument. Thanks to Brendan Dolan-Gavitt.\n\n6.8.2008 Volatility-1.3 awalters\n * Update: psscan2 check_dtb\n * Files: \n forensics/win32/scan2.py \n Description:\n Added a check from psscan to psscan2 in the \n\tcheck_dtb constraint to make sure the DTB\n\thad a value. Thanks Andreas Schuster!\n\n6.7.2008 Volatility-1.3 awalters\n * Update: SP3 support\n * Files:\n forensics/win32/network.py\n Description:\n Made changes to support SP3.\n\n5.21.2008 Volatility-1.3 awalters\n * Update: Changed create_addr_space api\n * Files:\n forensics/win32/tasks.py\n memory_objects/Windows/xp_sp2.py\n memory_plugins/example2.py\n memory_plugins/example3.py\n vmodules.py\n Description:\n Changed the create_addr_space API so that it does\n\tnot require types or filname. This was an\n\tartifact of the way the function used to work.\n\n5.17.2008 Volatility-1.3 awalters\n * Feature: New Object Model\n * Files:\n forensics/registry.py\n\tmemory_objects/Windows/xp_sp2.py\n\tmemory_plugins/example3.py\n\tforensics/object2.py\n\tforensics/win32/meta_info.py\n\tvutils.py\n Description:\n Added a new object model to make navigating the data\n\tstructures more intuitive. All future modules will be \n\ttransition to use this new model. Thanks to Brendan \n\tDolan-Gavitt for all his help!\n\n5.14.2008 Volatility-1.3 awalters\n * Feature: Plugin Architecture\n * Files:\n forensics/commands.py\n forensics/registry.py\n volatility\n memory_plugins/example1.py\n memory_plugins/example2.py\n Description:\n Added an entirely new plugin infrastructure. Now it is \n possible to load the commands dynamically just by adding\n them to the correct directory. This will allow people\n to support their own modules. This work is based on a \n similar registry implementation found in PyFlag. \n Thanks to Michael Cohen and David Collett for the great \n work they have done and help getting this code integrated.\n\n5.13.2008 Volatility-1.3 awalters\n * Feature: Hiberfil support\n * Files:\n vmodules.py\n volatility\n forensics/win32/hiber_addrspace.py\n forensics/win32/xpress.py\n forensics/win32/scan.py\n forensics/win32/network.py\n forensics/win32/datetime.py\n Description:\n Added native hiberfil support. Also added the ability\n to convert from hiberfil to linear format. Now all the\n commands can be run against hiberfils natively. This\n is accomplished through the new hiberfil address space.\n Thanks to Matthieu Suiche and Brendan Dolan-Gavitt for\n all the great work they have done with hiberfil parsing\n and the xpress compression algorithm.\n\n5.13.2008 Volatility-1.3 awalters\n * Feature: New scanning infrastructure\n * Files:\n vmodules.py\n volatility\n forensics/win32/scan2.py\n forensics/win32/globals.py\n forensics/win32/crash_addrspace.py\n forensics/win32/datetime.py\n Description:\n Added an entirely new OO scanning infrastructure. This allows\n for extremely fast scanning and easier scanning across the\n logical address spaces. As part of this we also ported the \n scanning modules over to the new infrastructure. Thanks to\n Michael Cohen and Andreas Schuster for the help and ideas \n to get this working!\n\n5.7.2008 Volatility-1.3 awalters\n * Bug: get_available_addresses\n * Files:\n forensics/x86.py\n\tvmodules.py\n\tvolatility\n Description:\n Fixed an off by 1 error in get_available_address for\n\t non-pae machines that seemed to have crept back in. Also\n\t changed the name of usrdmp to memdmp since it is really\n\t dumping a processes addressable memory. Thanks Eoghan Casey!\n\n4.30.2008 Volatility-1.3 awalters\n * New Module: procdump\n * Files:\n forensics/win32/executable.py\n\t vtypes.py\n\t vmodules.py\n Description:\n Added a new module that will allow the analyst to extract\n\t the executable from memory for further analysis. Thanks to\n\t Brendan Dolan-Gavitt for all your hard work!\n\n4.28.2008 Volatility-1.3 awalters\n * Bug: open registry keys\n * Files:\n forensics/win32/handles.py\n Description:\n During testing Brendan found a bug when processing object types.\n\t It would have been possible to enumerate KeyedEvents. Thanks \n\t Brendan Dolan-Gavitt!\n\n4.28.2008 Volatility-1.3 awalters\n * New Module: regobjkey\n * Files:\n vmodules.py\n forensics/win32/registry.py\n forensics/win32/handles.py\n vtypes.py\n Description:\n Added a new module that will allow an analyst to dump the open\n registry keys found in the object table. Thanks to \n Brendan Dolan-Gavitt for his contributions!\n\n4.27.2008 Volatility-1.3 awalters\n * Feature: psscan dot format\n * Files:\n vmodules.py\n\t forensics/win32/scan.py\n Description:\n Added the ability to print the output of psscan in dot format.\n\t Similar to that available by ptfinder by Andreas Schuster. This\n\t was requested by Eoghan Casey.\n\n4.23.2008 Volatility-1.3 awalters\n * Useability: Pass pid or EPROCESS offset\n Files:\n vmodules.py\n\t forensics/win32/handles.py\n Description:\n Added the ability to dump files and dlllist by pid or EPROCESS\n\t offset. One reason this was asked for was to deal with data\n\t only attacks which may remove the process from process list.\n\t Thanks to Eoghan Casey for the feedback!\n\n4.23.2008 Volatility-1.3 awalters\n * New Modules: dmp2raw, raw2dmp\n Files:\n vtypes.py\n vmodules.py\n forensics/win32/crashdump.py\n\t forensics/win32/info.py\n forensics/win32/tasks.py\n Description:\n Added modules to convert from raw dumps to crash dumps and vice\n\t versa. Thanks to Andreas Schuster for helping to get this started\n\t and thanks to Brendan Dolan-Gavitt for helping get it perfected!\n\n4.23.2008 Volatility-1.3 awalters\n * Optimization: KUSER_SHARED_DATA\n Files:\n vmodules.py\n Description:\n Changed KUSER_SHARED_DATA in get_image_info and get_datetime to\n\t point to 0xFFDF0000 instead of 0x7ffe0000. Thanks Brendan\n\t Dolan-Gavitt!\n\n4.1.2008 Volatility-1.2.3pre awalters\n * Bug: socket crash\n Files:\n forensics/win32/network.py\n Description:\n In get_open_sockets, we needed to make sure that the AddrObjAddr\n\t and AddrTableSize were not none and if they were fail gracefully.\n\t Thanks to Eoghan Casey for the bug report.\n\n3.3.2008 Volatility-1.2.3pre awalters\n * Bug: get_obj_offset() non-builtin\n Files:\n forensics/object.py\n Description:\n Modified get_obj_offset to support arrays of non-builtin types. \n\tThanks Brendan Dolan-Gavitt!\n\n2.27.2008 Volatility-1.2.3pre awalters\n * Bug: Not traversing complete module list\n Files:\n forensics/win32/modules.py\n Description:\n Traversing the module list should not stop when it reaches a None but \n\tcontinue to the next module\n\n2.27.2008 Volatility-1.2.3pre awalters\n * Bug: is_valid_address(addr)\n Files:\n forensics/addrspace.py\n\tforensics/x86.py\n Description:\n is_valid_address was failing to check if addr was None. This was found\n\tby analyzing hiberfile images. Thanks to Brendan Dolan-Gavitt and\n\tAndreas Schuster for helping me find the problem! \n\n2.25.2008 Volatility-1.2.3pre awalters\n\n * Bug: hidden processes\n Files:\n vmodules.py\n Description:\n Both usrdmp and memmap were unable to handle hidden processes. They\n\tcan now be passed the offset to an EPROCESS object. Thanks to Eoghan\n\tCasey for the bug report.\n\n12.28.2007 Volatility-1.2.3pre awalters\n * Bug: 64 bit\n Files:\n forensics/addrspace.py\n\tforensics/object.py\n\tforensics/win32/scan.py\n\tforensics/x86.py\n\tforensics/win32/crash_addrspace.py\n Description:\n Fixed a bug that occurs when people are running Python 2.5 on\n\ta 64 bit OS. Python 2.5 changed the way that Python native types\n\tare stored and thus changed the unpack usage. Thanks to Jamie Levy\n\tand students!\n\n11.28.2007 Volatility-1.2.2pre awalters\n * Bug: memmap\n Files:\n vmodules.py\n Description:\n mem_map fixed so that you can specifiy a particular process.\n\n11.28.2007 Volatility-1.2.2pre awalters\n * Bug: dtb_aligned\n Files:\n forensics/win32/scan.py\n Description:\n On systems using PAE, EPROCESS.DirectoryTableBase actually\n\tpoints to the base of the page directory pointer array.\n\tThanks Andreas Schuster.\n\n11.27.2007 Volatility-1.2.2pre awalters\n \n * Optimization: find_dtb\n Files:\n forensics/win32/tasks.py\n Description:\n Dramatically reduced the time for find_dtb. Thanks Michael Cohen.\n\n09.21.2007 Volatility-1.2.1pre awalters\n\n * New Module: usrdmp\n Files:\n vmodules.py\n Description:\n Dumps a processes address space. Thanks Eoghan Casey. \n\n09.20.2007 Volatility-1.2pre awalters\n\n * New Module: modscan\n Files:\n vmodules.py\n forensics/win32/scan.py\n forensics/win32/globals.py\n Description:\n Performs a linear scan for memory resident Windows modules. Contributed by Andreas Schuster. \n * New Module: memmap\n Files:\n vmodules.py\n forensics/x86.py\n Description:\n Provides a map of the virtual to physical address translations within \n a particular address space. Based on similar tools by Andreas \n Schuster (memdump.pl) and Brendan Dolan-Gavitt (memdump.py).\n * New Module: dmpchk \n Files:\n vmodules.py\n forensics/win32/crash_addrspace.py\n Description:\n Prints auxiliary information about the crash dump file.\n * New Module: WindowsCrashDumpSpace32\n Files:\n forensics/x86.py\n forensics/win32/crash_addrspace.py\n Description:\n Provides the ability to use crash dumps as input to Volatility. This is \n\taccomplished through the use of stackable address spaces. Contributions \n\tfrom Andreas Schuster.\n * New Feature: get_available_pages()\n Files:\n forensics/x86.py \n Description:\n This functions allows an investigator to find all available pages within a particular address space. Thanks Brendan Dolan-Gavitt.\n * New Feature: zread()\n Files:\n forensics/x86.py\n\tforensics/addrspace.py\n\tforensics/win32/crash_addrspace.py\n Description:\n Added the ability to continuing reading even if pages are unavailable.\n\tInvalid pages are replaced with zeros. Thanks Brendan Dolan-Gavitt.\n\n07.31.2007 Volatility-1.1.1 awalters\n\n * Virtual Address Descriptor modules: vadinfo, vaddump, vadwalk. Based on the research of Brendan Dolan-Gavitt to be presented at DFRWS 2007\n * Constraint based linear scanning framework. New modules include psscan, thrdscan, sockscan, connscan. Inspired by the work of Andreas Schuster.\n * Completely open source. No third-party closed source dependencies.\n * Auto-identification speed enhancements\n * Bug fixes in network and socket modules\n * Removed symbol dependencies\n * Multiprocessor support\n\n" }, { "path": "CREDITS.txt", "content": "===============================================\nWe would like to acknowledge individuals that \nhave made significant contributions, code, or \nideas toward the respective volatility releases. \n\nAll lists are alphabetical. \n\nThese lists exclude the core Volatility authors, \nwho are identified in AUTHORS.txt. \n\nIf you believe you've been left off, it is not \nintentional. Please bring it to our attention!\n===============================================\n\nVolatility 2.6:\n\njie-lin for fixing a pyinstaller NameError issue \ngcmoreira for fixing a recursive property issue in Linux plugins\nAdam Bridge for updating the EditBox plugin \njie-lin for preventing a backtrace in the MBR parser plugin\nhaco20292 for fixing a bug in linux_dmesg \nwilliamshowalter for updating mac_get_profile and convert.py for El Capitan support \nrobbyFux for fixing a bug in the svcscan plugin \nf-s-p for adding unified output to the threads plugin \nBinary_Raider for adding the powershell empire plugins\nozylol for updating create_all_profiles.py for Mac 10.11 \nJamesHabben for adjusting sqlite inserts to allow for more columns to exist in table\n\nVolatility 2.5: \n\nAdam Bridge for adding a --count option (humanly readable byte stats) to imagecopy/raw2dmp\nSebastien Bourdon-Richard for various patches and bug fixes\nBruno Constanzo for various patches to enhance performance/optimization \nGlenn P. Edwards, Jr for adding combined user/kernel scans, --case, and ascii/unicode options to yarascan\n@f-s-p for converting some plugins to unfied output format\nCem Gurkok for submitting the mac_threads plugin\nTakahiro Haruyama for noticing and fixing a bug in impscan\n@masdif for contributing a fix for kernel 3.7+ in linux/module.c\nWyatt Roersma for converting a large number of plugins to the unified output format\nKarl Vogel for pointing out an issue with IPv4 addresses on big endian systems\n\nVolatility 2.4:\n\nSteven Adair for assistance identifying a large memory PAE bug\nSebastien Bourdon-Richard for his work on the VMware vmem/vmss split (with meta) AS \nJustin Capella and Espen Olsen for their work on the Qemu ELF core dumps\nCem Gurkok for help updating Mac OS X support for 10.9\nMatt McCormack for supplying a patch to rebase dumped PE files\nStewart McIntyre for extending apihooks for detecting JMP FAR instructions\nKevin Marker for contributing over 160 standard build Linux profiles \nsynack33 for creating various Mac OS X profiles, including initial ones for 10.10\nRaphaƫl Vinot for his patch to fix IPython within volshell\n\nVolatility 2.3:\n\nCem Gurkok for his work on the privileges plugin for Windows\nNir Izraeli for his work on the VMware snapshot address space (see also the vmsnparser project)\n@osxmem of the volafox project (Mac OS X & BSD Memory Analysis Toolkit)\n@osxreverser of reverse.put.as for his help with OSX memory analysis\nCarl Pulley for numerous bug reports, example patches, and plugin testing\nAndreas Schuster for his work on poison ivy plugins for Windows\nJoe Sylve for his work on the ARM address space and significant contributions to linux and mac capabilities\nPhilippe Teuwen for his work on the virtual box address space\nSantiago Vicente for his work on the citadel plugins for Windows\n\nVolatility 2.2:\n------------\n\nJoe Sylve\n\nVolatility 2.1:\n------------\n\n--- \n\nVolatility 2.0:\n------------\n\nFrank Boldewin \nCarl Pulley\nAndreas Schuster\nBradley Schatz\n\nVolatility 1.3:\n------------\n\nHarlan Carvey\nMichael Cohen\nDavid Collett\nBrendan Dolan-Gavitt \nAndreas Schuster\nMatthieu Suiche\n\nWe would also like to acknowledge those who have provided valuable\nfeedback, bug reports, and testing:\n\nJide Abu\nJoseph Ayo Akinyele\nTommaso Assandri\nRichard Austin\nCameron C Caffee\nEoghan Casey\nAngelo Cavallini\nAndre' DiMino\nJon Evans\nRobert Guess\nChristian Herndler\njeremie0\nJamie Levy\nEugene Libster\nErik Ligda\nRobert Lowe\nTony Martin\nTimothy Morgan\nBryan D. Payne\nGolden G. Richard III\nWyatt Roersma\nRB\nSam F. Stover\nMarko Thure\n" }, { "path": "LEGAL.txt", "content": "Volatility\n===============\n\nLicense\n-------\n\nCopyright (C) 2007-2013 Volatility Foundation\n\nVolatility is free software; you can redistribute it and/or modify\nit under the terms of the GNU General Public License as published by\nthe Free Software Foundation; either version 2 of the License, or\n(at your option) any later version.\n\nVolatility is distributed in the hope that it will be useful,\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\nGNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License\nalong with Volatility. If not, see .\n" }, { "path": "LICENSE.txt", "content": "\t\t GNU GENERAL PUBLIC LICENSE\n\t\t Version 2, June 1991\n\n Copyright (C) 1989, 1991 Free Software Foundation, Inc.\n 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA\n Everyone is permitted to copy and distribute verbatim copies\n of this license document, but changing it is not allowed.\n\n\t\t\t Preamble\n\n The licenses for most software are designed to take away your\nfreedom to share and change it. By contrast, the GNU General Public\nLicense is intended to guarantee your freedom to share and change free\nsoftware--to make sure the software is free for all its users. This\nGeneral Public License applies to most of the Free Software\nFoundation's software and to any other program whose authors commit to\nusing it. (Some other Free Software Foundation software is covered by\nthe GNU Library General Public License instead.) You can apply it to\nyour programs, too.\n\n When we speak of free software, we are referring to freedom, not\nprice. Our General Public Licenses are designed to make sure that you\nhave the freedom to distribute copies of free software (and charge for\nthis service if you wish), that you receive source code or can get it\nif you want it, that you can change the software or use pieces of it\nin new free programs; and that you know you can do these things.\n\n To protect your rights, we need to make restrictions that forbid\nanyone to deny you these rights or to ask you to surrender the rights.\nThese restrictions translate to certain responsibilities for you if you\ndistribute copies of the software, or if you modify it.\n\n For example, if you distribute copies of such a program, whether\ngratis or for a fee, you must give the recipients all the rights that\nyou have. You must make sure that they, too, receive or can get the\nsource code. And you must show them these terms so they know their\nrights.\n\n We protect your rights with two steps: (1) copyright the software, and\n(2) offer you this license which gives you legal permission to copy,\ndistribute and/or modify the software.\n\n Also, for each author's protection and ours, we want to make certain\nthat everyone understands that there is no warranty for this free\nsoftware. If the software is modified by someone else and passed on, we\nwant its recipients to know that what they have is not the original, so\nthat any problems introduced by others will not reflect on the original\nauthors' reputations.\n\n Finally, any free program is threatened constantly by software\npatents. We wish to avoid the danger that redistributors of a free\nprogram will individually obtain patent licenses, in effect making the\nprogram proprietary. To prevent this, we have made it clear that any\npatent must be licensed for everyone's free use or not licensed at all.\n\n The precise terms and conditions for copying, distribution and\nmodification follow.\n\f\n\t\t GNU GENERAL PUBLIC LICENSE\n TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION\n\n 0. This License applies to any program or other work which contains\na notice placed by the copyright holder saying it may be distributed\nunder the terms of this General Public License. The \"Program\", below,\nrefers to any such program or work, and a \"work based on the Program\"\nmeans either the Program or any derivative work under copyright law:\nthat is to say, a work containing the Program or a portion of it,\neither verbatim or with modifications and/or translated into another\nlanguage. (Hereinafter, translation is included without limitation in\nthe term \"modification\".) Each licensee is addressed as \"you\".\n\nActivities other than copying, distribution and modification are not\ncovered by this License; they are outside its scope. The act of\nrunning the Program is not restricted, and the output from the Program\nis covered only if its contents constitute a work based on the\nProgram (independent of having been made by running the Program).\nWhether that is true depends on what the Program does.\n\n 1. You may copy and distribute verbatim copies of the Program's\nsource code as you receive it, in any medium, provided that you\nconspicuously and appropriately publish on each copy an appropriate\ncopyright notice and disclaimer of warranty; keep intact all the\nnotices that refer to this License and to the absence of any warranty;\nand give any other recipients of the Program a copy of this License\nalong with the Program.\n\nYou may charge a fee for the physical act of transferring a copy, and\nyou may at your option offer warranty protection in exchange for a fee.\n\n 2. You may modify your copy or copies of the Program or any portion\nof it, thus forming a work based on the Program, and copy and\ndistribute such modifications or work under the terms of Section 1\nabove, provided that you also meet all of these conditions:\n\n a) You must cause the modified files to carry prominent notices\n stating that you changed the files and the date of any change.\n\n b) You must cause any work that you distribute or publish, that in\n whole or in part contains or is derived from the Program or any\n part thereof, to be licensed as a whole at no charge to all third\n parties under the terms of this License.\n\n c) If the modified program normally reads commands interactively\n when run, you must cause it, when started running for such\n interactive use in the most ordinary way, to print or display an\n announcement including an appropriate copyright notice and a\n notice that there is no warranty (or else, saying that you provide\n a warranty) and that users may redistribute the program under\n these conditions, and telling the user how to view a copy of this\n License. (Exception: if the Program itself is interactive but\n does not normally print such an announcement, your work based on\n the Program is not required to print an announcement.)\n\f\nThese requirements apply to the modified work as a whole. If\nidentifiable sections of that work are not derived from the Program,\nand can be reasonably considered independent and separate works in\nthemselves, then this License, and its terms, do not apply to those\nsections when you distribute them as separate works. But when you\ndistribute the same sections as part of a whole which is a work based\non the Program, the distribution of the whole must be on the terms of\nthis License, whose permissions for other licensees extend to the\nentire whole, and thus to each and every part regardless of who wrote it.\n\nThus, it is not the intent of this section to claim rights or contest\nyour rights to work written entirely by you; rather, the intent is to\nexercise the right to control the distribution of derivative or\ncollective works based on the Program.\n\nIn addition, mere aggregation of another work not based on the Program\nwith the Program (or with a work based on the Program) on a volume of\na storage or distribution medium does not bring the other work under\nthe scope of this License.\n\n 3. You may copy and distribute the Program (or a work based on it,\nunder Section 2) in object code or executable form under the terms of\nSections 1 and 2 above provided that you also do one of the following:\n\n a) Accompany it with the complete corresponding machine-readable\n source code, which must be distributed under the terms of Sections\n 1 and 2 above on a medium customarily used for software interchange; or,\n\n b) Accompany it with a written offer, valid for at least three\n years, to give any third party, for a charge no more than your\n cost of physically performing source distribution, a complete\n machine-readable copy of the corresponding source code, to be\n distributed under the terms of Sections 1 and 2 above on a medium\n customarily used for software interchange; or,\n\n c) Accompany it with the information you received as to the offer\n to distribute corresponding source code. (This alternative is\n allowed only for noncommercial distribution and only if you\n received the program in object code or executable form with such\n an offer, in accord with Subsection b above.)\n\nThe source code for a work means the preferred form of the work for\nmaking modifications to it. For an executable work, complete source\ncode means all the source code for all modules it contains, plus any\nassociated interface definition files, plus the scripts used to\ncontrol compilation and installation of the executable. However, as a\nspecial exception, the source code distributed need not include\nanything that is normally distributed (in either source or binary\nform) with the major components (compiler, kernel, and so on) of the\noperating system on which the executable runs, unless that component\nitself accompanies the executable.\n\nIf distribution of executable or object code is made by offering\naccess to copy from a designated place, then offering equivalent\naccess to copy the source code from the same place counts as\ndistribution of the source code, even though third parties are not\ncompelled to copy the source along with the object code.\n\f\n 4. You may not copy, modify, sublicense, or distribute the Program\nexcept as expressly provided under this License. Any attempt\notherwise to copy, modify, sublicense or distribute the Program is\nvoid, and will automatically terminate your rights under this License.\nHowever, parties who have received copies, or rights, from you under\nthis License will not have their licenses terminated so long as such\nparties remain in full compliance.\n\n 5. You are not required to accept this License, since you have not\nsigned it. However, nothing else grants you permission to modify or\ndistribute the Program or its derivative works. These actions are\nprohibited by law if you do not accept this License. Therefore, by\nmodifying or distributing the Program (or any work based on the\nProgram), you indicate your acceptance of this License to do so, and\nall its terms and conditions for copying, distributing or modifying\nthe Program or works based on it.\n\n 6. Each time you redistribute the Program (or any work based on the\nProgram), the recipient automatically receives a license from the\noriginal licensor to copy, distribute or modify the Program subject to\nthese terms and conditions. You may not impose any further\nrestrictions on the recipients' exercise of the rights granted herein.\nYou are not responsible for enforcing compliance by third parties to\nthis License.\n\n 7. If, as a consequence of a court judgment or allegation of patent\ninfringement or for any other reason (not limited to patent issues),\nconditions are imposed on you (whether by court order, agreement or\notherwise) that contradict the conditions of this License, they do not\nexcuse you from the conditions of this License. If you cannot\ndistribute so as to satisfy simultaneously your obligations under this\nLicense and any other pertinent obligations, then as a consequence you\nmay not distribute the Program at all. For example, if a patent\nlicense would not permit royalty-free redistribution of the Program by\nall those who receive copies directly or indirectly through you, then\nthe only way you could satisfy both it and this License would be to\nrefrain entirely from distribution of the Program.\n\nIf any portion of this section is held invalid or unenforceable under\nany particular circumstance, the balance of the section is intended to\napply and the section as a whole is intended to apply in other\ncircumstances.\n\nIt is not the purpose of this section to induce you to infringe any\npatents or other property right claims or to contest validity of any\nsuch claims; this section has the sole purpose of protecting the\nintegrity of the free software distribution system, which is\nimplemented by public license practices. Many people have made\ngenerous contributions to the wide range of software distributed\nthrough that system in reliance on consistent application of that\nsystem; it is up to the author/donor to decide if he or she is willing\nto distribute software through any other system and a licensee cannot\nimpose that choice.\n\nThis section is intended to make thoroughly clear what is believed to\nbe a consequence of the rest of this License.\n\f\n 8. If the distribution and/or use of the Program is restricted in\ncertain countries either by patents or by copyrighted interfaces, the\noriginal copyright holder who places the Program under this License\nmay add an explicit geographical distribution limitation excluding\nthose countries, so that distribution is permitted only in or among\ncountries not thus excluded. In such case, this License incorporates\nthe limitation as if written in the body of this License.\n\n 9. The Free Software Foundation may publish revised and/or new versions\nof the General Public License from time to time. Such new versions will\nbe similar in spirit to the present version, but may differ in detail to\naddress new problems or concerns.\n\nEach version is given a distinguishing version number. If the Program\nspecifies a version number of this License which applies to it and \"any\nlater version\", you have the option of following the terms and conditions\neither of that version or of any later version published by the Free\nSoftware Foundation. If the Program does not specify a version number of\nthis License, you may choose any version ever published by the Free Software\nFoundation.\n\n 10. If you wish to incorporate parts of the Program into other free\nprograms whose distribution conditions are different, write to the author\nto ask for permission. For software which is copyrighted by the Free\nSoftware Foundation, write to the Free Software Foundation; we sometimes\nmake exceptions for this. Our decision will be guided by the two goals\nof preserving the free status of all derivatives of our free software and\nof promoting the sharing and reuse of software generally.\n\n\t\t\t NO WARRANTY\n\n 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY\nFOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN\nOTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES\nPROVIDE THE PROGRAM \"AS IS\" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED\nOR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF\nMERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS\nTO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE\nPROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,\nREPAIR OR CORRECTION.\n\n 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING\nWILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR\nREDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,\nINCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING\nOUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED\nTO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY\nYOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER\nPROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE\nPOSSIBILITY OF SUCH DAMAGES.\n\n\t\t END OF TERMS AND CONDITIONS\n\n" }, { "path": "MANIFEST.in", "content": "include *.txt\ninclude *.win\ninclude MANIFEST.in\ninclude setup.py\ninclude resources/*\ninclude pyinstaller/*.py\ninclude volatility/*.py\ninclude contrib/plugins/*.py\ninclude contrib/plugins/aspaces/*.py\ninclude tools/*.py\ninclude tools/linux/*\ninclude tools/linux/pmem/*\ninclude tools/mac/*.py\ninclude vol.py\ninclude Makefile\ninclude pyinstaller.spec\n" }, { "path": "Makefile", "content": "all: build\n\nbuild:\n\tpython setup.py build\n\ninstall:\n\tpython setup.py install\n\ndist:\n\tpython setup.py sdist\n\nclean:\n\trm -f `find . -name \"*.pyc\" -o -name \"*~\"`\n\trm -rf dist build\n" }, { "path": "PKG-INFO", "content": "Metadata-Version: 1.0\nName: Volatility\nVersion: GC1\nSummary: Volatility -- Volatile memory framwork\nHome-page: http://www.volatilityfoundation.org\nAuthor: AAron Walters\nAuthor-email: awalters@4tphi.net\nLicense: GPL\nDescription: UNKNOWN\nPlatform: UNKNOWN\n" }, { "path": "README.txt", "content": "This project is archived. See Volatility 3 for modern investigations: https://github.com/volatilityfoundation/volatility3\n\n============================================================================\nVolatility Framework - Volatile memory extraction utility framework\n============================================================================\n\nThe Volatility Framework is a completely open collection of tools,\nimplemented in Python under the GNU General Public License, for the\nextraction of digital artifacts from volatile memory (RAM) samples.\nThe extraction techniques are performed completely independent of the\nsystem being investigated but offer visibilty into the runtime state\nof the system. The framework is intended to introduce people to the\ntechniques and complexities associated with extracting digital artifacts\nfrom volatile memory samples and provide a platform for further work into\nthis exciting area of research.\n\nThe Volatility distribution is available from: \nhttp://www.volatilityfoundation.org/#!releases/component_71401\n\nVolatility should run on any platform that supports \nPython (http://www.python.org)\n\nVolatility supports investigations of the following memory images:\n\nWindows:\n* 32-bit Windows XP Service Pack 2 and 3\n* 32-bit Windows 2003 Server Service Pack 0, 1, 2\n* 32-bit Windows Vista Service Pack 0, 1, 2\n* 32-bit Windows 2008 Server Service Pack 1, 2 (there is no SP0)\n* 32-bit Windows 7 Service Pack 0, 1\n* 32-bit Windows 8, 8.1, and 8.1 Update 1\n* 32-bit Windows 10 (initial support)\n* 64-bit Windows XP Service Pack 1 and 2 (there is no SP0)\n* 64-bit Windows 2003 Server Service Pack 1 and 2 (there is no SP0)\n* 64-bit Windows Vista Service Pack 0, 1, 2\n* 64-bit Windows 2008 Server Service Pack 1 and 2 (there is no SP0)\n* 64-bit Windows 2008 R2 Server Service Pack 0 and 1\n* 64-bit Windows 7 Service Pack 0 and 1\n* 64-bit Windows 8, 8.1, and 8.1 Update 1\n* 64-bit Windows Server 2012 and 2012 R2 \n* 64-bit Windows 10 (including at least 10.0.19041)\n* 64-bit Windows Server 2016 (including at least 10.0.19041)\n\nNote: Please see the guidelines at the following link for notes on \ncompatibility with recently patched Windows 7 (or later) memory samples:\n\n https://github.com/volatilityfoundation/volatility/wiki/2.6-Win-Profiles\n\nLinux: \n* 32-bit Linux kernels 2.6.11 to 5.5\n* 64-bit Linux kernels 2.6.11 to 5.5\n* OpenSuSE, Ubuntu, Debian, CentOS, Fedora, Mandriva, etc\n\nMac OSX:\n* 32-bit 10.5.x Leopard (the only 64-bit 10.5 is Server, which isn't supported)\n* 32-bit 10.6.x Snow Leopard\n* 64-bit 10.6.x Snow Leopard\n* 32-bit 10.7.x Lion\n* 64-bit 10.7.x Lion\n* 64-bit 10.8.x Mountain Lion (there is no 32-bit version)\n* 64-bit 10.9.x Mavericks (there is no 32-bit version)\n* 64-bit 10.10.x Yosemite (there is no 32-bit version)\n* 64-bit 10.11.x El Capitan (there is no 32-bit version)\n* 64-bit 10.12.x Sierra (there is no 32-bit version)\n* 64-bit 10.13.x High Sierra (there is no 32-bit version))\n* 64-bit 10.14.x Mojave (there is no 32-bit version)\n* 64-bit 10.15.x Catalina (there is no 32-bit version)\n\nVolatility does not provide memory sample acquisition\ncapabilities. For acquisition, there are both free and commercial\nsolutions available. If you would like suggestions about suitable \nacquisition solutions, please contact us at:\n\nvolatility (at) volatilityfoundation (dot) org\n\nVolatility supports a variety of sample file formats and the\nability to convert between these formats:\n\n - Raw linear sample (dd)\n - Hibernation file (from Windows 7 and earlier)\n - Crash dump file\n - VirtualBox ELF64 core dump\n - VMware saved state and snapshot files\n - EWF format (E01) \n - LiME format\n - Mach-O file format\n - QEMU virtual machine dumps\n - Firewire \n - HPAK (FDPro)\n\nFor a more detailed list of capabilities, see the following:\n\n https://github.com/volatilityfoundation/volatility/wiki\n \nAlso see the community plugins repository:\n\n https://github.com/volatilityfoundation/community\n\nExample Data\n============\n\nIf you want to give Volatility a try, you can download exemplar\nmemory images from the following url:\n\n https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples\n\nMailing Lists\n=============\n\nMailing lists to support the users and developers of Volatility\ncan be found at the following address:\n\n http://lists.volatilesystems.com/mailman/listinfo\n\nContact\n=======\nFor information or requests, contact:\n\nVolatility Foundation\n\nWeb: http://www.volatilityfoundation.org\n http://volatility-labs.blogspot.com\n http://volatility.tumblr.com\n \nEmail: volatility (at) volatilityfoundation (dot) org\n\nIRC: #volatility on freenode\n\nTwitter: @volatility \n\nRequirements\n============\n- Python 2.6 or later, but not 3.0. http://www.python.org\n\nSome plugins may have other requirements which can be found at: \n https://github.com/volatilityfoundation/volatility/wiki/Installation\n\nQuick Start\n===========\n1. Unpack the latest version of Volatility from\n volatilityfoundation.org\n \n2. To see available options, run \"python vol.py -h\" or \"python vol.py --info\"\n\n Example:\n\n$ python vol.py --info\nVolatility Foundation Volatility Framework 2.6\n\nAddress Spaces\n--------------\nAMD64PagedMemory - Standard AMD 64-bit address space.\nArmAddressSpace - Address space for ARM processors\nFileAddressSpace - This is a direct file AS.\nHPAKAddressSpace - This AS supports the HPAK format\nIA32PagedMemory - Standard IA-32 paging address space.\nIA32PagedMemoryPae - This class implements the IA-32 PAE paging address space. It is responsible\nLimeAddressSpace - Address space for Lime\nLinuxAMD64PagedMemory - Linux-specific AMD 64-bit address space.\nMachOAddressSpace - Address space for mach-o files to support atc-ny memory reader\nOSXPmemELF - This AS supports VirtualBox ELF64 coredump format\nQemuCoreDumpElf - This AS supports Qemu ELF32 and ELF64 coredump format\nVMWareAddressSpace - This AS supports VMware snapshot (VMSS) and saved state (VMSS) files\nVMWareMetaAddressSpace - This AS supports the VMEM format with VMSN/VMSS metadata\nVirtualBoxCoreDumpElf64 - This AS supports VirtualBox ELF64 coredump format\nWin10AMD64PagedMemory - Windows 10-specific AMD 64-bit address space.\nWindowsAMD64PagedMemory - Windows-specific AMD 64-bit address space.\nWindowsCrashDumpSpace32 - This AS supports windows Crash Dump format\nWindowsCrashDumpSpace64 - This AS supports windows Crash Dump format\nWindowsCrashDumpSpace64BitMap - This AS supports Windows BitMap Crash Dump format\nWindowsHiberFileSpace32 - This is a hibernate address space for windows hibernation files.\n\nProfiles\n--------\nVistaSP0x64 - A Profile for Windows Vista SP0 x64\nVistaSP0x86 - A Profile for Windows Vista SP0 x86\nVistaSP1x64 - A Profile for Windows Vista SP1 x64\nVistaSP1x86 - A Profile for Windows Vista SP1 x86\nVistaSP2x64 - A Profile for Windows Vista SP2 x64\nVistaSP2x86 - A Profile for Windows Vista SP2 x86\nWin10x64 - A Profile for Windows 10 x64\nWin10x64_10586 - A Profile for Windows 10 x64 (10.0.10586.306 / 2016-04-23)\nWin10x64_14393 - A Profile for Windows 10 x64 (10.0.14393.0 / 2016-07-16)\nWin10x86 - A Profile for Windows 10 x86\nWin10x86_10586 - A Profile for Windows 10 x86 (10.0.10586.420 / 2016-05-28)\nWin10x86_14393 - A Profile for Windows 10 x86 (10.0.14393.0 / 2016-07-16)\nWin2003SP0x86 - A Profile for Windows 2003 SP0 x86\nWin2003SP1x64 - A Profile for Windows 2003 SP1 x64\nWin2003SP1x86 - A Profile for Windows 2003 SP1 x86\nWin2003SP2x64 - A Profile for Windows 2003 SP2 x64\nWin2003SP2x86 - A Profile for Windows 2003 SP2 x86\nWin2008R2SP0x64 - A Profile for Windows 2008 R2 SP0 x64\nWin2008R2SP1x64 - A Profile for Windows 2008 R2 SP1 x64\nWin2008R2SP1x64_23418 - A Profile for Windows 2008 R2 SP1 x64 (6.1.7601.23418 / 2016-04-09)\nWin2008SP1x64 - A Profile for Windows 2008 SP1 x64\nWin2008SP1x86 - A Profile for Windows 2008 SP1 x86\nWin2008SP2x64 - A Profile for Windows 2008 SP2 x64\nWin2008SP2x86 - A Profile for Windows 2008 SP2 x86\nWin2012R2x64 - A Profile for Windows Server 2012 R2 x64\nWin2012R2x64_18340 - A Profile for Windows Server 2012 R2 x64 (6.3.9600.18340 / 2016-05-13)\nWin2012x64 - A Profile for Windows Server 2012 x64\nWin2016x64_14393 - A Profile for Windows Server 2016 x64 (10.0.14393.0 / 2016-07-16)\nWin7SP0x64 - A Profile for Windows 7 SP0 x64\nWin7SP0x86 - A Profile for Windows 7 SP0 x86\nWin7SP1x64 - A Profile for Windows 7 SP1 x64\nWin7SP1x64_23418 - A Profile for Windows 7 SP1 x64 (6.1.7601.23418 / 2016-04-09)\nWin7SP1x86 - A Profile for Windows 7 SP1 x86\nWin7SP1x86_23418 - A Profile for Windows 7 SP1 x86 (6.1.7601.23418 / 2016-04-09)\nWin81U1x64 - A Profile for Windows 8.1 Update 1 x64\nWin81U1x86 - A Profile for Windows 8.1 Update 1 x86\nWin8SP0x64 - A Profile for Windows 8 x64\nWin8SP0x86 - A Profile for Windows 8 x86\nWin8SP1x64 - A Profile for Windows 8.1 x64\nWin8SP1x64_18340 - A Profile for Windows 8.1 x64 (6.3.9600.18340 / 2016-05-13)\nWin8SP1x86 - A Profile for Windows 8.1 x86\nWinXPSP1x64 - A Profile for Windows XP SP1 x64\nWinXPSP2x64 - A Profile for Windows XP SP2 x64\nWinXPSP2x86 - A Profile for Windows XP SP2 x86\nWinXPSP3x86 - A Profile for Windows XP SP3 x86\n\nPlugins\n-------\namcache - Print AmCache information\napihooks - Detect API hooks in process and kernel memory\natoms - Print session and window station atom tables\natomscan - Pool scanner for atom tables\nauditpol - Prints out the Audit Policies from HKLM\\SECURITY\\Policy\\PolAdtEv\nbigpools - Dump the big page pools using BigPagePoolScanner\nbioskbd - Reads the keyboard buffer from Real Mode memory\ncachedump - Dumps cached domain hashes from memory\ncallbacks - Print system-wide notification routines\nclipboard - Extract the contents of the windows clipboard\ncmdline - Display process command-line arguments\ncmdscan - Extract command history by scanning for _COMMAND_HISTORY\nconnections - Print list of open connections [Windows XP and 2003 Only]\nconnscan - Pool scanner for tcp connections\nconsoles - Extract command history by scanning for _CONSOLE_INFORMATION\ncrashinfo - Dump crash-dump information\ndeskscan - Poolscaner for tagDESKTOP (desktops)\ndevicetree - Show device tree\ndlldump - Dump DLLs from a process address space\ndlllist - Print list of loaded dlls for each process\ndriverirp - Driver IRP hook detection\ndrivermodule - Associate driver objects to kernel modules\ndriverscan - Pool scanner for driver objects\ndumpcerts - Dump RSA private and public SSL keys\ndumpfiles - Extract memory mapped and cached files\ndumpregistry - Dumps registry files out to disk\neditbox - Displays information about Edit controls. (Listbox experimental.)\nenvars - Display process environment variables\neventhooks - Print details on windows event hooks\nevtlogs - Extract Windows Event Logs (XP/2003 only)\nfilescan - Pool scanner for file objects\ngahti - Dump the USER handle type information\ngditimers - Print installed GDI timers and callbacks\ngdt - Display Global Descriptor Table\ngetservicesids - Get the names of services in the Registry and return Calculated SID\ngetsids - Print the SIDs owning each process\nhandles - Print list of open handles for each process\nhashdump - Dumps passwords hashes (LM/NTLM) from memory\nhibinfo - Dump hibernation file information\nhivedump - Prints out a hive\nhivelist - Print list of registry hives.\nhivescan - Pool scanner for registry hives\nhpakextract - Extract physical memory from an HPAK file\nhpakinfo - Info on an HPAK file\nidt - Display Interrupt Descriptor Table\niehistory - Reconstruct Internet Explorer cache / history\nimagecopy - Copies a physical address space out as a raw DD image\nimageinfo - Identify information for the image\nimpscan - Scan for calls to imported functions\njoblinks - Print process job link information\nkdbgscan - Search for and dump potential KDBG values\nkpcrscan - Search for and dump potential KPCR values\nldrmodules - Detect unlinked DLLs\nlimeinfo - Dump Lime file format information\nlinux_apihooks - Checks for userland apihooks\nlinux_arp - Print the ARP table\nlinux_aslr_shift - Automatically detect the Linux ASLR shift\nlinux_banner - Prints the Linux banner information\nlinux_bash - Recover bash history from bash process memory\nlinux_bash_env - Recover a process' dynamic environment variables\nlinux_bash_hash - Recover bash hash table from bash process memory\nlinux_check_afinfo - Verifies the operation function pointers of network protocols\nlinux_check_creds - Checks if any processes are sharing credential structures\nlinux_check_evt_arm - Checks the Exception Vector Table to look for syscall table hooking\nlinux_check_fop - Check file operation structures for rootkit modifications\nlinux_check_idt - Checks if the IDT has been altered\nlinux_check_inline_kernel - Check for inline kernel hooks\nlinux_check_modules - Compares module list to sysfs info, if available\nlinux_check_syscall - Checks if the system call table has been altered\nlinux_check_syscall_arm - Checks if the system call table has been altered\nlinux_check_tty - Checks tty devices for hooks\nlinux_cpuinfo - Prints info about each active processor\nlinux_dentry_cache - Gather files from the dentry cache\nlinux_dmesg - Gather dmesg buffer\nlinux_dump_map - Writes selected memory mappings to disk\nlinux_dynamic_env - Recover a process' dynamic environment variables\nlinux_elfs - Find ELF binaries in process mappings\nlinux_enumerate_files - Lists files referenced by the filesystem cache\nlinux_find_file - Lists and recovers files from memory\nlinux_getcwd - Lists current working directory of each process\nlinux_hidden_modules - Carves memory to find hidden kernel modules\nlinux_ifconfig - Gathers active interfaces\nlinux_info_regs - It's like 'info registers' in GDB. It prints out all the\nlinux_iomem - Provides output similar to /proc/iomem\nlinux_kernel_opened_files - Lists files that are opened from within the kernel\nlinux_keyboard_notifiers - Parses the keyboard notifier call chain\nlinux_ldrmodules - Compares the output of proc maps with the list of libraries from libdl\nlinux_library_list - Lists libraries loaded into a process\nlinux_librarydump - Dumps shared libraries in process memory to disk\nlinux_list_raw - List applications with promiscuous sockets\nlinux_lsmod - Gather loaded kernel modules\nlinux_lsof - Lists file descriptors and their path\nlinux_malfind - Looks for suspicious process mappings\nlinux_memmap - Dumps the memory map for linux tasks\nlinux_moddump - Extract loaded kernel modules\nlinux_mount - Gather mounted fs/devices\nlinux_mount_cache - Gather mounted fs/devices from kmem_cache\nlinux_netfilter - Lists Netfilter hooks\nlinux_netscan - Carves for network connection structures\nlinux_netstat - Lists open sockets\nlinux_pidhashtable - Enumerates processes through the PID hash table\nlinux_pkt_queues - Writes per-process packet queues out to disk\nlinux_plthook - Scan ELF binaries' PLT for hooks to non-NEEDED images\nlinux_proc_maps - Gathers process memory maps\nlinux_proc_maps_rb - Gathers process maps for linux through the mappings red-black tree\nlinux_procdump - Dumps a process's executable image to disk\nlinux_process_hollow - Checks for signs of process hollowing\nlinux_psaux - Gathers processes along with full command line and start time\nlinux_psenv - Gathers processes along with their static environment variables\nlinux_pslist - Gather active tasks by walking the task_struct->task list\nlinux_pslist_cache - Gather tasks from the kmem_cache\nlinux_psscan - Scan physical memory for processes\nlinux_pstree - Shows the parent/child relationship between processes\nlinux_psxview - Find hidden processes with various process listings\nlinux_recover_filesystem - Recovers the entire cached file system from memory\nlinux_route_cache - Recovers the routing cache from memory\nlinux_sk_buff_cache - Recovers packets from the sk_buff kmem_cache\nlinux_slabinfo - Mimics /proc/slabinfo on a running machine\nlinux_strings - Match physical offsets to virtual addresses (may take a while, VERY verbose)\nlinux_threads - Prints threads of processes\nlinux_tmpfs - Recovers tmpfs filesystems from memory\nlinux_truecrypt_passphrase - Recovers cached Truecrypt passphrases\nlinux_vma_cache - Gather VMAs from the vm_area_struct cache\nlinux_volshell - Shell in the memory image\nlinux_yarascan - A shell in the Linux memory image\nlsadump - Dump (decrypted) LSA secrets from the registry\nmac_adium - Lists Adium messages\nmac_apihooks - Checks for API hooks in processes\nmac_apihooks_kernel - Checks to see if system call and kernel functions are hooked\nmac_arp - Prints the arp table\nmac_bash - Recover bash history from bash process memory\nmac_bash_env - Recover bash's environment variables\nmac_bash_hash - Recover bash hash table from bash process memory\nmac_calendar - Gets calendar events from Calendar.app\nmac_check_fop - Validate File Operation Pointers\nmac_check_mig_table - Lists entires in the kernel's MIG table\nmac_check_syscall_shadow - Looks for shadow system call tables\nmac_check_syscalls - Checks to see if system call table entries are hooked\nmac_check_sysctl - Checks for unknown sysctl handlers\nmac_check_trap_table - Checks to see if mach trap table entries are hooked\nmac_compressed_swap - Prints Mac OS X VM compressor stats and dumps all compressed pages\nmac_contacts - Gets contact names from Contacts.app\nmac_dead_procs - Prints terminated/de-allocated processes\nmac_dead_sockets - Prints terminated/de-allocated network sockets\nmac_dead_vnodes - Lists freed vnode structures\nmac_devfs - Lists files in the file cache\nmac_dmesg - Prints the kernel debug buffer\nmac_dump_file - Dumps a specified file\nmac_dump_maps - Dumps memory ranges of process(es), optionally including pages in compressed swap\nmac_dyld_maps - Gets memory maps of processes from dyld data structures\nmac_find_aslr_shift - Find the ASLR shift value for 10.8+ images\nmac_get_profile - Automatically detect Mac profiles\nmac_ifconfig - Lists network interface information for all devices\nmac_interest_handlers - Lists IOKit Interest Handlers\nmac_ip_filters - Reports any hooked IP filters\nmac_kernel_classes - Lists loaded c++ classes in the kernel\nmac_kevents - Show parent/child relationship of processes\nmac_keychaindump - Recovers possbile keychain keys. Use chainbreaker to open related keychain files\nmac_ldrmodules - Compares the output of proc maps with the list of libraries from libdl\nmac_librarydump - Dumps the executable of a process\nmac_list_files - Lists files in the file cache\nmac_list_kauth_listeners - Lists Kauth Scope listeners\nmac_list_kauth_scopes - Lists Kauth Scopes and their status\nmac_list_raw - List applications with promiscuous sockets\nmac_list_sessions - Enumerates sessions\nmac_list_zones - Prints active zones\nmac_lsmod - Lists loaded kernel modules\nmac_lsmod_iokit - Lists loaded kernel modules through IOkit\nmac_lsmod_kext_map - Lists loaded kernel modules\nmac_lsof - Lists per-process opened files\nmac_machine_info - Prints machine information about the sample\nmac_malfind - Looks for suspicious process mappings\nmac_memdump - Dump addressable memory pages to a file\nmac_moddump - Writes the specified kernel extension to disk\nmac_mount - Prints mounted device information\nmac_netstat - Lists active per-process network connections\nmac_network_conns - Lists network connections from kernel network structures\nmac_notesapp - Finds contents of Notes messages\nmac_notifiers - Detects rootkits that add hooks into I/O Kit (e.g. LogKext)\nmac_orphan_threads - Lists threads that don't map back to known modules/processes\nmac_pgrp_hash_table - Walks the process group hash table\nmac_pid_hash_table - Walks the pid hash table\nmac_print_boot_cmdline - Prints kernel boot arguments\nmac_proc_maps - Gets memory maps of processes\nmac_procdump - Dumps the executable of a process\nmac_psaux - Prints processes with arguments in user land (**argv)\nmac_psenv - Prints processes with environment in user land (**envp)\nmac_pslist - List Running Processes\nmac_pstree - Show parent/child relationship of processes\nmac_psxview - Find hidden processes with various process listings\nmac_recover_filesystem - Recover the cached filesystem\nmac_route - Prints the routing table\nmac_socket_filters - Reports socket filters\nmac_strings - Match physical offsets to virtual addresses (may take a while, VERY verbose)\nmac_tasks - List Active Tasks\nmac_threads - List Process Threads\nmac_threads_simple - Lists threads along with their start time and priority\nmac_timers - Reports timers set by kernel drivers\nmac_trustedbsd - Lists malicious trustedbsd policies\nmac_version - Prints the Mac version\nmac_vfsevents - Lists processes filtering file system events\nmac_volshell - Shell in the memory image\nmac_yarascan - Scan memory for yara signatures\nmachoinfo - Dump Mach-O file format information\nmalfind - Find hidden and injected code\nmbrparser - Scans for and parses potential Master Boot Records (MBRs)\nmemdump - Dump the addressable memory for a process\nmemmap - Print the memory map\nmessagehooks - List desktop and thread window message hooks\nmftparser - Scans for and parses potential MFT entries\nmoddump - Dump a kernel driver to an executable file sample\nmodscan - Pool scanner for kernel modules\nmodules - Print list of loaded modules\nmultiscan - Scan for various objects at once\nmutantscan - Pool scanner for mutex objects\nnetscan - Scan a Vista (or later) image for connections and sockets\nnotepad - List currently displayed notepad text\nobjtypescan - Scan for Windows object type objects\npatcher - Patches memory based on page scans\npoolpeek - Configurable pool scanner plugin\npooltracker - Show a summary of pool tag usage\nprintkey - Print a registry key, and its subkeys and values\nprivs - Display process privileges\nprocdump - Dump a process to an executable file sample\npslist - Print all running processes by following the EPROCESS lists\npsscan - Pool scanner for process objects\npstree - Print process list as a tree\npsxview - Find hidden processes with various process listings\nqemuinfo - Dump Qemu information\nraw2dmp - Converts a physical memory sample to a windbg crash dump\nscreenshot - Save a pseudo-screenshot based on GDI windows\nservicediff - List Windows services (ala Plugx)\nsessions - List details on _MM_SESSION_SPACE (user logon sessions)\nshellbags - Prints ShellBags info\nshimcache - Parses the Application Compatibility Shim Cache registry key\nshutdowntime - Print ShutdownTime of machine from registry\nsockets - Print list of open sockets\nsockscan - Pool scanner for tcp socket objects\nssdt - Display SSDT entries\nstrings - Match physical offsets to virtual addresses (may take a while, VERY verbose)\nsvcscan - Scan for Windows services\nsymlinkscan - Pool scanner for symlink objects\nthrdscan - Pool scanner for thread objects\nthreads - Investigate _ETHREAD and _KTHREADs\ntimeliner - Creates a timeline from various artifacts in memory\ntimers - Print kernel timers and associated module DPCs\ntruecryptmaster - Recover TrueCrypt 7.1a Master Keys\ntruecryptpassphrase - TrueCrypt Cached Passphrase Finder\ntruecryptsummary - TrueCrypt Summary\nunloadedmodules - Print list of unloaded modules\nuserassist - Print userassist registry keys and information\nuserhandles - Dump the USER handle tables\nvaddump - Dumps out the vad sections to a file\nvadinfo - Dump the VAD info\nvadtree - Walk the VAD tree and display in tree format\nvadwalk - Walk the VAD tree\nvboxinfo - Dump virtualbox information\nverinfo - Prints out the version information from PE images\nvmwareinfo - Dump VMware VMSS/VMSN information\nvolshell - Shell in the memory image\nwin10cookie - Find the ObHeaderCookie value for Windows 10\nwindows - Print Desktop Windows (verbose details)\nwintree - Print Z-Order Desktop Windows Tree\nwndscan - Pool scanner for window stations\nyarascan - Scan process or kernel memory with Yara signatures\n\n3. To get more information on a Windows memory sample and to make sure Volatility\n supports that sample type, run 'python vol.py imageinfo -f ' or 'python vol.py kdbgscan -f '\n\n Example:\n \n $ python vol.py imageinfo -f WIN-II7VOJTUNGL-20120324-193051.raw \n Volatility Foundation Volatility Framework 2.6\n Determining profile based on KDBG search...\n \n Suggested Profile(s) : Win2008R2SP0x64, Win7SP1x64, Win7SP0x64, Win2008R2SP1x64 (Instantiated with Win7SP0x64)\n AS Layer1 : AMD64PagedMemory (Kernel AS)\n AS Layer2 : FileAddressSpace (/Path/to/WIN-II7VOJTUNGL-20120324-193051.raw)\n PAE type : PAE\n DTB : 0x187000L\n KDBG : 0xf800016460a0\n Number of Processors : 1\n Image Type (Service Pack) : 1\n KPCR for CPU 0 : 0xfffff80001647d00L\n KUSER_SHARED_DATA : 0xfffff78000000000L\n Image date and time : 2012-03-24 19:30:53 UTC+0000\n Image local date and time : 2012-03-25 03:30:53 +0800\n\n If multiple profiles are suggested by imageinfo or kdbgscan, or if you're having trouble analyzing \n Windows 7 or later memory samples, please see the guidelines here:\n\n https://github.com/volatilityfoundation/volatility/wiki/2.6-Win-Profiles\n\n4. Run some other plugins. -f is a required option for all plugins. Some\n also require/accept other options. Run \"python vol.py -h\" for\n more information on a particular command. A Command Reference wiki\n is also available on the GitHub site:\n\n https://github.com/volatilityfoundation/volatility/wiki\n\n as well as Basic Usage:\n\n https://github.com/volatilityfoundation/volatility/wiki/Volatility-Usage\n\nLicensing and Copyright\n=======================\n\nCopyright (C) 2007-2016 Volatility Foundation\n\nAll Rights Reserved\n\nVolatility is free software; you can redistribute it and/or modify\nit under the terms of the GNU General Public License as published by\nthe Free Software Foundation; either version 2 of the License, or\n(at your option) any later version.\n\nVolatility is distributed in the hope that it will be useful,\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\nGNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License\nalong with Volatility. If not, see .\n\nBugs and Support\n================\nThere is no support provided with Volatility. There is NO\nwarranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR\nPURPOSE. \n\nIf you think you've found a bug, please report it at:\n\n https://github.com/volatilityfoundation/volatility/issues\n\nIn order to help us solve your issues as quickly as possible,\nplease include the following information when filing a bug:\n\n* The version of volatility you're using\n* The operating system used to run volatility\n* The version of python used to run volatility\n* The suspected operating system of the memory image\n* The complete command line you used to run volatility\n\nDepending on the operating system of the memory image, you may need to provide\nadditional information, such as:\n\nFor Windows:\n* The suspected Service Pack of the memory image\n\nFor Linux:\n* The suspected kernel version of the memory image\n\nOther options for communication can be found at:\n https://github.com/volatilityfoundation/volatility/wiki\n\nMissing or Truncated Information\n================================\nVolatility Foundation makes no claims about the validity or correctness of the\noutput of Volatility. Many factors may contribute to the\nincorrectness of output from Volatility including, but not\nlimited to, malicious modifications to the operating system,\nincomplete information due to swapping, and information corruption on\nimage acquisition. \n\nCommand Reference \n====================\nThe following url contains a reference of all commands supported by \nVolatility.\n\n https://github.com/volatilityfoundation/volatility/wiki\n\n" }, { "path": "contrib/__init__.py", "content": "" }, { "path": "contrib/library_example/libapi.py", "content": "# Volatility\n# Copyright (c) 2015 Michael Ligh (michael.ligh@mnin.org)\n#\n# This file is part of Volatility.\n#\n# Volatility is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# Volatility is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with Volatility. If not, see .\n#\n\nimport copy, StringIO, json\nimport volatility.conf as conf\nimport volatility.registry as registry\nimport volatility.commands as commands\nimport volatility.addrspace as addrspace\n\nregistry.PluginImporter()\n\ndef get_json(config, plugin_class):\n strio = StringIO.StringIO()\n plugin = plugin_class(copy.deepcopy(config))\n plugin.render_json(strio, plugin.calculate())\n return json.loads(strio.getvalue())\n\ndef get_config(profile, target_path):\n config = conf.ConfObject()\n registry.register_global_options(config, commands.Command)\n registry.register_global_options(config, addrspace.BaseAddressSpace)\n config.parse_options()\n config.PROFILE = profile\n config.LOCATION = \"file://{0}\".format(target_path)\n return config " }, { "path": "contrib/library_example/pslist_json.py", "content": "# Volatility\n# Copyright (c) 2015 Michael Ligh (michael.ligh@mnin.org)\n#\n# This file is part of Volatility.\n#\n# Volatility is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# Volatility is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with Volatility. If not, see .\n#\n\nimport sys \nimport volatility.plugins.taskmods as taskmods \nimport libapi \n\ndef main():\n\n ## sys.argv[1] = volatility profile \n ## sys.argv[2] = full path on disk to your memory sample\n\n config = libapi.get_config(sys.argv[1], sys.argv[2])\n data = libapi.get_json(config, taskmods.PSList)\n\n ## `data` now contains json with two keys: `columns` and `rows`, where `columns`\n ## contains a list of column headings (matching the corresponding volatility \n ## plugin output) and `rows` contains a list of the values for each object found.\n\n ## you can either print/save all columns, or you can drill down to a particular \n ## column by getting the desired column's index as shown below and then accessing\n ## the index in each row. the following example prints each process' name. \n \n name_index = data['columns'].index('Name')\n\n for row in data['rows']:\n print row[name_index]\n\nif __name__ == \"__main__\":\n main()" }, { "path": "contrib/plugins/README.md", "content": "Plugins in this directory have moved. Please see the github.com/volatilityfoundation/community repository.\n" }, { "path": "contrib/plugins/__init__.py", "content": "" }, { "path": "contrib/plugins/aspaces/README.md", "content": "Plugins in this directory have moved. Please see the github.com/volatilityfoundation/community repository.\n" }, { "path": "contrib/plugins/disablewarnings.py", "content": "# Volatility\n#\n# Authors:\n# Mike Auty \n#\n# This file is part of Volatility.\n#\n# Volatility is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# Volatility is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with Volatility. If not, see .\n#\n\nimport volatility.conf as conf\nimport logging\n\nconfig = conf.ConfObject()\n\ndef disable_warnings(_option, _opt_str, _value, _parser):\n \"\"\"Sets the location variable in the parser to the filename in question\"\"\"\n rootlogger = logging.getLogger('')\n rootlogger.setLevel(logging.WARNING + 1)\n\nconfig.add_option(\"WARNINGS\", default = False, action = \"callback\",\n callback = disable_warnings,\n short_option = 'W', nargs = 0,\n help = \"Disable warning messages\")\n" }, { "path": "contrib/plugins/example.py", "content": "# Volatility\n#\n# Authors:\n# Mike Auty \n#\n# This file is part of Volatility.\n#\n# Volatility is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# Volatility is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with Volatility. If not, see .\n#\n\nimport volatility.timefmt as timefmt\nimport volatility.obj as obj\nimport volatility.utils as utils\nimport volatility.commands as commands\n\n#pylint: disable-msg=C0111\n\nclass DateTime(commands.Command):\n \"\"\"A simple example plugin that gets the date/time information from a Windows image\"\"\"\n def calculate(self):\n \"\"\"Calculate and carry out any processing that may take time upon the image\"\"\"\n # Load the address space\n addr_space = utils.load_as(self._config)\n\n # Call a subfunction so that it can be used by other plugins\n return self.get_image_time(addr_space)\n\n def get_image_time(self, addr_space):\n \"\"\"Extracts the time and date from the KUSER_SHARED_DATA area\"\"\"\n # Get the Image Datetime\n result = {}\n\n # Create a VOLATILITY_MAGIC object to look up the location of certain constants\n # Get the KUSER_SHARED_DATA location\n KUSER_SHARED_DATA = obj.VolMagic(addr_space).KUSER_SHARED_DATA.v()\n # Create the _KUSER_SHARED_DATA object at the appropriate offset\n k = obj.Object(\"_KUSER_SHARED_DATA\",\n offset = KUSER_SHARED_DATA,\n vm = addr_space)\n\n # Start reading members from it\n result['ImageDatetime'] = k.SystemTime\n result['ImageTz'] = timefmt.OffsetTzInfo(-k.TimeZoneBias.as_windows_timestamp() / 10000000)\n\n # Return any results we got\n return result\n\n def render_text(self, outfd, data):\n \"\"\"Renders the calculated data as text to outfd\"\"\"\n # Convert the result into a datetime object for display in local and non local format\n dt = data['ImageDatetime'].as_datetime()\n\n # Display the datetime in UTC as taken from the image\n outfd.write(\"Image date and time : {0}\\n\".format(data['ImageDatetime']))\n # Display the datetime taking into account the timezone of the image itself\n outfd.write(\"Image local date and time : {0}\\n\".format(timefmt.display_datetime(dt, data['ImageTz'])))\n" }, { "path": "contrib/plugins/malware/README.md", "content": "Plugins in this directory have moved. Please see the github.com/volatilityfoundation/community repository.\n" }, { "path": "pyinstaller/hook-distorm3.py", "content": "# Distorm3 hook\n#\n# This currently contains the hardcoded location for the standard distorm3.dll install\n# It could be improved by carrying out a search, or using sys.path\n#\n# This also requires the distorm3 module to be modified with the following patch:\n\n# import sys\n# if hasattr(sys, '_MEIPASS'):\n# _distorm_path = sys._MEIPASS\n\nimport os\nimport sys\n\ndatas = []\n\nfor path in sys.path:\n if os.path.exists(os.path.join(path, \"distorm3\", \"distorm3.dll\")):\n datas.append((os.path.join(path, \"distorm3\", \"distorm3.dll\"), \".\"))\n if os.path.exists(os.path.join(path, \"distorm3\", \"libdistorm3.so\")):\n datas.append((os.path.join(path, \"distorm3\", \"libdistorm3.so\"), \".\"))\n\n" }, { "path": "pyinstaller/hook-openpyxl.py", "content": "# Openpyxl hook\n#\n# This currently contains the hardcoded location for the .constants.json file\n# It could be improved by carrying out a search, or using sys.path\n#\n# This also requires the openpyxl module to be modified with the following patch:\n\n# import sys\n# if hasattr(sys, '_MEIPASS'):\n# here = sys._MEIPASS\n\nimport os\nimport sys\n\ndatas = []\n\nfor path in sys.path:\n if os.path.exists(os.path.join(path, \"openpyxl\", \".constants.json\")):\n datas.append((os.path.join(path, \"openpyxl\", \".constants.json\"), \".\"))\n" }, { "path": "pyinstaller/hook-volatility.py", "content": "\nimport os\n\nprojpath = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))\n\nmodules = set(['volatility.plugins'])\n\nfor dirpath, _dirnames, filenames in os.walk(os.path.join(projpath, 'volatility', 'plugins')):\n dirpath = dirpath[len(os.path.join(projpath, 'volatility', 'plugins')):]\n if dirpath and dirpath[0] == os.path.sep:\n dirpath = dirpath[1:]\n for filename in filenames:\n path = os.path.join(dirpath, os.path.splitext(filename)[0])\n if \"/.\" in path:\n continue\n if \"__\" in path:\n continue\n\n path = path.replace(\"-\", \"_\")\n path = path.replace(os.path.sep, \".\")\n\n modules.add(\"volatility.plugins.\" + path)\n\nhiddenimports = list(modules)\n" }, { "path": "pyinstaller/hook-yara.py", "content": "import os\nimport sys\n\ndatas = []\n\nfor path in sys.path:\n if os.path.exists(os.path.join(path, \"yara.pyd\")):\n datas.append((os.path.join(path, \"yara.pyd\"), \".\"))\n if os.path.exists(os.path.join(path, \"yara.so\")):\n datas.append((os.path.join(path, \"yara.so\"), \".\"))\n" }, { "path": "pyinstaller.spec", "content": "# -*- mode: python -*-\nimport sys\n\nprojpath = os.path.dirname(os.path.abspath(SPEC))\n\ndef get_plugins(list):\n for item in list:\n if item[0].startswith('volatility.plugins') and not (item[0] == 'volatility.plugins' and '__init__.py' in item[1]):\n yield item\n\nexeext = \".exe\" if sys.platform.startswith(\"win\") else \"\"\n\na = Analysis([os.path.join(projpath, 'vol.py')],\n pathex = [HOMEPATH],\n hookspath = [os.path.join(projpath, 'pyinstaller')])\npyz = PYZ(a.pure)\nplugins = Tree(os.path.join(projpath, 'volatility', 'plugins'),\n os.path.join('plugins'))\nexe = EXE(pyz,\n a.scripts + [('u', '', 'OPTION')],\n a.binaries,\n a.zipfiles,\n a.datas,\n plugins,\n name = os.path.join(projpath, 'dist', 'pyinstaller', 'volatility' + exeext),\n debug = False,\n strip = False,\n upx = True,\n icon = os.path.join(projpath, 'resources', 'volatility.ico'),\n console = 1)\n" }, { "path": "setup.py", "content": "#!/usr/bin/env python\n\n# Volatility\n# \n# Authors:\n# AAron Walters \n# Mike Auty \n#\n# This file is part of Volatility.\n#\n# Volatility is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# Volatility is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with Volatility. If not, see .\n#\n\ntry:\n from setuptools import setup\nexcept ImportError:\n from distutils.core import setup\nimport volatility.constants\nimport sys\nimport os\n\npy2exe_available = True\ntry:\n import py2exe #pylint: disable-msg=W0611,F0401\nexcept ImportError:\n py2exe_available = False\n\ndef find_files(topdirs, py = False):\n \"\"\"Lists all python files under any topdir from the topdirs lists.\n \n Returns an appropriate list for data_files,\n with source and destination directories the same\"\"\"\n ret = []\n for topdir in topdirs:\n for r, _ds, fs in os.walk(topdir):\n ret.append((r, [ os.path.join(r, f) for f in fs if (f.endswith('.py') or not py)]))\n return ret\n\nopts = {}\n\nopts['name'] = \"volatility\"\nopts['version'] = volatility.constants.VERSION\nopts['description'] = \"Volatility -- Volatile memory framework\"\nopts['author'] = \"AAron Walters\"\nopts['author_email'] = \"awalters@4tphi.net\"\nopts['url'] = \"http://www.volatilityfoundation.org\"\nopts['license'] = \"GPL\"\nopts['scripts'] = [\"vol.py\"]\nopts['packages'] = [\"volatility\",\n \"volatility.win32\",\n \"volatility.renderers\",\n \"volatility.plugins\",\n \"volatility.plugins.addrspaces\",\n \"volatility.plugins.overlays\",\n \"volatility.plugins.overlays.windows\",\n \"volatility.plugins.overlays.linux\",\n \"volatility.plugins.overlays.mac\",\n \"volatility.plugins.gui\",\n \"volatility.plugins.gui.vtypes\",\n \"volatility.plugins.linux\",\n \"volatility.plugins.registry\",\n \"volatility.plugins.malware\", \n \"volatility.plugins.mac\"]\nopts['data_files'] = find_files(['contrib'], py = True) + find_files(['tools'])\n\nif py2exe_available:\n py2exe_distdir = 'dist/py2exe'\n opts['console'] = [{ 'script': 'vol.py',\n 'icon_resources': [(1, 'resources/volatility.ico')]\n }]\n # Optimize must be 1 for plugins that use docstring for the help value,\n # otherwise the help gets optimized out\n opts['options'] = {'py2exe':{'optimize': 1,\n 'dist_dir': py2exe_distdir,\n 'packages': opts['packages'] + ['socket', 'ctypes', 'Crypto.Cipher', 'urllib', 'distorm3', 'yara', 'xml.etree.ElementTree'],\n # This, along with zipfile = None, ensures a single binary\n 'bundle_files': 1,\n }\n }\n opts['zipfile'] = None\n\ndistrib = setup(**opts) #pylint: disable-msg=W0142\n\nif 'py2exe' in sys.argv:\n # Any py2exe specific files or things that need doing can go in here\n pass\n" }, { "path": "tools/doxygen/config", "content": "# Doxyfile 1.8.7\n\n# This file describes the settings to be used by the documentation system\n# doxygen (www.doxygen.org) for a project.\n#\n# All text after a double hash (##) is considered a comment and is placed in\n# front of the TAG it is preceding.\n#\n# All text after a single hash (#) is considered a comment and will be ignored.\n# The format is:\n# TAG = value [value, ...]\n# For lists, items can also be appended using:\n# TAG += value [value, ...]\n# Values that contain spaces should be placed between quotes (\\\" \\\").\n\n#---------------------------------------------------------------------------\n# Project related configuration options\n#---------------------------------------------------------------------------\n\n# This tag specifies the encoding used for all characters in the config file\n# that follow. The default is UTF-8 which is also the encoding used for all text\n# before the first occurrence of this tag. Doxygen uses libiconv (or the iconv\n# built into libc) for the transcoding. See http://www.gnu.org/software/libiconv\n# for the list of possible encodings.\n# The default value is: UTF-8.\n\nDOXYFILE_ENCODING = UTF-8\n\n# The PROJECT_NAME tag is a single word (or a sequence of words surrounded by\n# double-quotes, unless you are using Doxywizard) that should identify the\n# project for which the documentation is generated. This name is used in the\n# title of most generated pages and in a few other places.\n# The default value is: My Project.\n\nPROJECT_NAME = \"The Volatility Framework\"\n\n# The PROJECT_NUMBER tag can be used to enter a project or revision number. This\n# could be handy for archiving the generated documentation or if some version\n# control system is used.\n\nPROJECT_NUMBER =\n\n# Using the PROJECT_BRIEF tag one can provide an optional one line description\n# for a project that appears at the top of each page and should give viewer a\n# quick idea about the purpose of the project. Keep the description short.\n\nPROJECT_BRIEF =\n\n# With the PROJECT_LOGO tag one can specify an logo or icon that is included in\n# the documentation. The maximum height of the logo should not exceed 55 pixels\n# and the maximum width should not exceed 200 pixels. Doxygen will copy the logo\n# to the output directory.\n\nPROJECT_LOGO = ./tools/doxygen/vol.png\n\n# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) path\n# into which the generated documentation will be written. If a relative path is\n# entered, it will be relative to the location where doxygen was started. If\n# left blank the current directory will be used.\n\nOUTPUT_DIRECTORY = ./tools/doxygen/output\n\n# If the CREATE_SUBDIRS tag is set to YES, then doxygen will create 4096 sub-\n# directories (in 2 levels) under the output directory of each output format and\n# will distribute the generated files over these directories. Enabling this\n# option can be useful when feeding doxygen a huge amount of source files, where\n# putting all generated files in the same directory would otherwise causes\n# performance problems for the file system.\n# The default value is: NO.\n\nCREATE_SUBDIRS = YES\n\n# If the ALLOW_UNICODE_NAMES tag is set to YES, doxygen will allow non-ASCII\n# characters to appear in the names of generated files. If set to NO, non-ASCII\n# characters will be escaped, for example _xE3_x81_x84 will be used for Unicode\n# U+3044.\n# The default value is: NO.\n\nALLOW_UNICODE_NAMES = NO\n\n# The OUTPUT_LANGUAGE tag is used to specify the language in which all\n# documentation generated by doxygen is written. Doxygen will use this\n# information to generate all constant output in the proper language.\n# Possible values are: Afrikaans, Arabic, Armenian, Brazilian, Catalan, Chinese,\n# Chinese-Traditional, Croatian, Czech, Danish, Dutch, English (United States),\n# Esperanto, Farsi (Persian), Finnish, French, German, Greek, Hungarian,\n# Indonesian, Italian, Japanese, Japanese-en (Japanese with English messages),\n# Korean, Korean-en (Korean with English messages), Latvian, Lithuanian,\n# Macedonian, Norwegian, Persian (Farsi), Polish, Portuguese, Romanian, Russian,\n# Serbian, Serbian-Cyrillic, Slovak, Slovene, Spanish, Swedish, Turkish,\n# Ukrainian and Vietnamese.\n# The default value is: English.\n\nOUTPUT_LANGUAGE = English\n\n# If the BRIEF_MEMBER_DESC tag is set to YES doxygen will include brief member\n# descriptions after the members that are listed in the file and class\n# documentation (similar to Javadoc). Set to NO to disable this.\n# The default value is: YES.\n\nBRIEF_MEMBER_DESC = YES\n\n# If the REPEAT_BRIEF tag is set to YES doxygen will prepend the brief\n# description of a member or function before the detailed description\n#\n# Note: If both HIDE_UNDOC_MEMBERS and BRIEF_MEMBER_DESC are set to NO, the\n# brief descriptions will be completely suppressed.\n# The default value is: YES.\n\nREPEAT_BRIEF = YES\n\n# This tag implements a quasi-intelligent brief description abbreviator that is\n# used to form the text in various listings. Each string in this list, if found\n# as the leading text of the brief description, will be stripped from the text\n# and the result, after processing the whole list, is used as the annotated\n# text. Otherwise, the brief description is used as-is. If left blank, the\n# following values are used ($name is automatically replaced with the name of\n# the entity):The $name class, The $name widget, The $name file, is, provides,\n# specifies, contains, represents, a, an and the.\n\nABBREVIATE_BRIEF =\n\n# If the ALWAYS_DETAILED_SEC and REPEAT_BRIEF tags are both set to YES then\n# doxygen will generate a detailed section even if there is only a brief\n# description.\n# The default value is: NO.\n\nALWAYS_DETAILED_SEC = NO\n\n# If the INLINE_INHERITED_MEMB tag is set to YES, doxygen will show all\n# inherited members of a class in the documentation of that class as if those\n# members were ordinary class members. Constructors, destructors and assignment\n# operators of the base classes will not be shown.\n# The default value is: NO.\n\nINLINE_INHERITED_MEMB = NO\n\n# If the FULL_PATH_NAMES tag is set to YES doxygen will prepend the full path\n# before files name in the file list and in the header files. If set to NO the\n# shortest path that makes the file name unique will be used\n# The default value is: YES.\n\nFULL_PATH_NAMES = YES\n\n# The STRIP_FROM_PATH tag can be used to strip a user-defined part of the path.\n# Stripping is only done if one of the specified strings matches the left-hand\n# part of the path. The tag can be used to show relative paths in the file list.\n# If left blank the directory from which doxygen is run is used as the path to\n# strip.\n#\n# Note that you can specify absolute paths here, but also relative paths, which\n# will be relative from the directory where doxygen is started.\n# This tag requires that the tag FULL_PATH_NAMES is set to YES.\n\nSTRIP_FROM_PATH =\n\n# The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of the\n# path mentioned in the documentation of a class, which tells the reader which\n# header file to include in order to use a class. If left blank only the name of\n# the header file containing the class definition is used. Otherwise one should\n# specify the list of include paths that are normally passed to the compiler\n# using the -I flag.\n\nSTRIP_FROM_INC_PATH =\n\n# If the SHORT_NAMES tag is set to YES, doxygen will generate much shorter (but\n# less readable) file names. This can be useful is your file systems doesn't\n# support long names like on DOS, Mac, or CD-ROM.\n# The default value is: NO.\n\nSHORT_NAMES = NO\n\n# If the JAVADOC_AUTOBRIEF tag is set to YES then doxygen will interpret the\n# first line (until the first dot) of a Javadoc-style comment as the brief\n# description. If set to NO, the Javadoc-style will behave just like regular Qt-\n# style comments (thus requiring an explicit @brief command for a brief\n# description.)\n# The default value is: NO.\n\nJAVADOC_AUTOBRIEF = NO\n\n# If the QT_AUTOBRIEF tag is set to YES then doxygen will interpret the first\n# line (until the first dot) of a Qt-style comment as the brief description. If\n# set to NO, the Qt-style will behave just like regular Qt-style comments (thus\n# requiring an explicit \\brief command for a brief description.)\n# The default value is: NO.\n\nQT_AUTOBRIEF = NO\n\n# The MULTILINE_CPP_IS_BRIEF tag can be set to YES to make doxygen treat a\n# multi-line C++ special comment block (i.e. a block of //! or /// comments) as\n# a brief description. This used to be the default behavior. The new default is\n# to treat a multi-line C++ comment block as a detailed description. Set this\n# tag to YES if you prefer the old behavior instead.\n#\n# Note that setting this tag to YES also means that rational rose comments are\n# not recognized any more.\n# The default value is: NO.\n\nMULTILINE_CPP_IS_BRIEF = NO\n\n# If the INHERIT_DOCS tag is set to YES then an undocumented member inherits the\n# documentation from any documented member that it re-implements.\n# The default value is: YES.\n\nINHERIT_DOCS = YES\n\n# If the SEPARATE_MEMBER_PAGES tag is set to YES, then doxygen will produce a\n# new page for each member. If set to NO, the documentation of a member will be\n# part of the file/class/namespace that contains it.\n# The default value is: NO.\n\nSEPARATE_MEMBER_PAGES = NO\n\n# The TAB_SIZE tag can be used to set the number of spaces in a tab. Doxygen\n# uses this value to replace tabs by spaces in code fragments.\n# Minimum value: 1, maximum value: 16, default value: 4.\n\nTAB_SIZE = 4\n\n# This tag can be used to specify a number of aliases that act as commands in\n# the documentation. An alias has the form:\n# name=value\n# For example adding\n# \"sideeffect=@par Side Effects:\\n\"\n# will allow you to put the command \\sideeffect (or @sideeffect) in the\n# documentation, which will result in a user-defined paragraph with heading\n# \"Side Effects:\". You can put \\n's in the value part of an alias to insert\n# newlines.\n\nALIASES =\n\n# This tag can be used to specify a number of word-keyword mappings (TCL only).\n# A mapping has the form \"name=value\". For example adding \"class=itcl::class\"\n# will allow you to use the command class in the itcl::class meaning.\n\nTCL_SUBST =\n\n# Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C sources\n# only. Doxygen will then generate output that is more tailored for C. For\n# instance, some of the names that are used will be different. The list of all\n# members will be omitted, etc.\n# The default value is: NO.\n\nOPTIMIZE_OUTPUT_FOR_C = NO\n\n# Set the OPTIMIZE_OUTPUT_JAVA tag to YES if your project consists of Java or\n# Python sources only. Doxygen will then generate output that is more tailored\n# for that language. For instance, namespaces will be presented as packages,\n# qualified scopes will look different, etc.\n# The default value is: NO.\n\nOPTIMIZE_OUTPUT_JAVA = NO\n\n# Set the OPTIMIZE_FOR_FORTRAN tag to YES if your project consists of Fortran\n# sources. Doxygen will then generate output that is tailored for Fortran.\n# The default value is: NO.\n\nOPTIMIZE_FOR_FORTRAN = NO\n\n# Set the OPTIMIZE_OUTPUT_VHDL tag to YES if your project consists of VHDL\n# sources. Doxygen will then generate output that is tailored for VHDL.\n# The default value is: NO.\n\nOPTIMIZE_OUTPUT_VHDL = NO\n\n# Doxygen selects the parser to use depending on the extension of the files it\n# parses. With this tag you can assign which parser to use for a given\n# extension. Doxygen has a built-in mapping, but you can override or extend it\n# using this tag. The format is ext=language, where ext is a file extension, and\n# language is one of the parsers supported by doxygen: IDL, Java, Javascript,\n# C#, C, C++, D, PHP, Objective-C, Python, Fortran (fixed format Fortran:\n# FortranFixed, free formatted Fortran: FortranFree, unknown formatted Fortran:\n# Fortran. In the later case the parser tries to guess whether the code is fixed\n# or free formatted code, this is the default for Fortran type files), VHDL. For\n# instance to make doxygen treat .inc files as Fortran files (default is PHP),\n# and .f files as C (default is Fortran), use: inc=Fortran f=C.\n#\n# Note For files without extension you can use no_extension as a placeholder.\n#\n# Note that for custom extensions you also need to set FILE_PATTERNS otherwise\n# the files are not read by doxygen.\n\nEXTENSION_MAPPING =\n\n# If the MARKDOWN_SUPPORT tag is enabled then doxygen pre-processes all comments\n# according to the Markdown format, which allows for more readable\n# documentation. See http://daringfireball.net/projects/markdown/ for details.\n# The output of markdown processing is further processed by doxygen, so you can\n# mix doxygen, HTML, and XML commands with Markdown formatting. Disable only in\n# case of backward compatibilities issues.\n# The default value is: YES.\n\nMARKDOWN_SUPPORT = YES\n\n# When enabled doxygen tries to link words that correspond to documented\n# classes, or namespaces to their corresponding documentation. Such a link can\n# be prevented in individual cases by by putting a % sign in front of the word\n# or globally by setting AUTOLINK_SUPPORT to NO.\n# The default value is: YES.\n\nAUTOLINK_SUPPORT = YES\n\n# If you use STL classes (i.e. std::string, std::vector, etc.) but do not want\n# to include (a tag file for) the STL sources as input, then you should set this\n# tag to YES in order to let doxygen match functions declarations and\n# definitions whose arguments contain STL classes (e.g. func(std::string);\n# versus func(std::string) {}). This also make the inheritance and collaboration\n# diagrams that involve STL classes more complete and accurate.\n# The default value is: NO.\n\nBUILTIN_STL_SUPPORT = NO\n\n# If you use Microsoft's C++/CLI language, you should set this option to YES to\n# enable parsing support.\n# The default value is: NO.\n\nCPP_CLI_SUPPORT = NO\n\n# Set the SIP_SUPPORT tag to YES if your project consists of sip (see:\n# http://www.riverbankcomputing.co.uk/software/sip/intro) sources only. Doxygen\n# will parse them like normal C++ but will assume all classes use public instead\n# of private inheritance when no explicit protection keyword is present.\n# The default value is: NO.\n\nSIP_SUPPORT = NO\n\n# For Microsoft's IDL there are propget and propput attributes to indicate\n# getter and setter methods for a property. Setting this option to YES will make\n# doxygen to replace the get and set methods by a property in the documentation.\n# This will only work if the methods are indeed getting or setting a simple\n# type. If this is not the case, or you want to show the methods anyway, you\n# should set this option to NO.\n# The default value is: YES.\n\nIDL_PROPERTY_SUPPORT = YES\n\n# If member grouping is used in the documentation and the DISTRIBUTE_GROUP_DOC\n# tag is set to YES, then doxygen will reuse the documentation of the first\n# member in the group (if any) for the other members of the group. By default\n# all members of a group must be documented explicitly.\n# The default value is: NO.\n\nDISTRIBUTE_GROUP_DOC = NO\n\n# Set the SUBGROUPING tag to YES to allow class member groups of the same type\n# (for instance a group of public functions) to be put as a subgroup of that\n# type (e.g. under the Public Functions section). Set it to NO to prevent\n# subgrouping. Alternatively, this can be done per class using the\n# \\nosubgrouping command.\n# The default value is: YES.\n\nSUBGROUPING = YES\n\n# When the INLINE_GROUPED_CLASSES tag is set to YES, classes, structs and unions\n# are shown inside the group in which they are included (e.g. using \\ingroup)\n# instead of on a separate page (for HTML and Man pages) or section (for LaTeX\n# and RTF).\n#\n# Note that this feature does not work in combination with\n# SEPARATE_MEMBER_PAGES.\n# The default value is: NO.\n\nINLINE_GROUPED_CLASSES = NO\n\n# When the INLINE_SIMPLE_STRUCTS tag is set to YES, structs, classes, and unions\n# with only public data fields or simple typedef fields will be shown inline in\n# the documentation of the scope in which they are defined (i.e. file,\n# namespace, or group documentation), provided this scope is documented. If set\n# to NO, structs, classes, and unions are shown on a separate page (for HTML and\n# Man pages) or section (for LaTeX and RTF).\n# The default value is: NO.\n\nINLINE_SIMPLE_STRUCTS = NO\n\n# When TYPEDEF_HIDES_STRUCT tag is enabled, a typedef of a struct, union, or\n# enum is documented as struct, union, or enum with the name of the typedef. So\n# typedef struct TypeS {} TypeT, will appear in the documentation as a struct\n# with name TypeT. When disabled the typedef will appear as a member of a file,\n# namespace, or class. And the struct will be named TypeS. This can typically be\n# useful for C code in case the coding convention dictates that all compound\n# types are typedef'ed and only the typedef is referenced, never the tag name.\n# The default value is: NO.\n\nTYPEDEF_HIDES_STRUCT = NO\n\n# The size of the symbol lookup cache can be set using LOOKUP_CACHE_SIZE. This\n# cache is used to resolve symbols given their name and scope. Since this can be\n# an expensive process and often the same symbol appears multiple times in the\n# code, doxygen keeps a cache of pre-resolved symbols. If the cache is too small\n# doxygen will become slower. If the cache is too large, memory is wasted. The\n# cache size is given by this formula: 2^(16+LOOKUP_CACHE_SIZE). The valid range\n# is 0..9, the default is 0, corresponding to a cache size of 2^16=65536\n# symbols. At the end of a run doxygen will report the cache usage and suggest\n# the optimal cache size from a speed point of view.\n# Minimum value: 0, maximum value: 9, default value: 0.\n\nLOOKUP_CACHE_SIZE = 0\n\n#---------------------------------------------------------------------------\n# Build related configuration options\n#---------------------------------------------------------------------------\n\n# If the EXTRACT_ALL tag is set to YES doxygen will assume all entities in\n# documentation are documented, even if no documentation was available. Private\n# class members and static file members will be hidden unless the\n# EXTRACT_PRIVATE respectively EXTRACT_STATIC tags are set to YES.\n# Note: This will also disable the warnings about undocumented members that are\n# normally produced when WARNINGS is set to YES.\n# The default value is: NO.\n\nEXTRACT_ALL = NO\n\n# If the EXTRACT_PRIVATE tag is set to YES all private members of a class will\n# be included in the documentation.\n# The default value is: NO.\n\nEXTRACT_PRIVATE = NO\n\n# If the EXTRACT_PACKAGE tag is set to YES all members with package or internal\n# scope will be included in the documentation.\n# The default value is: NO.\n\nEXTRACT_PACKAGE = NO\n\n# If the EXTRACT_STATIC tag is set to YES all static members of a file will be\n# included in the documentation.\n# The default value is: NO.\n\nEXTRACT_STATIC = NO\n\n# If the EXTRACT_LOCAL_CLASSES tag is set to YES classes (and structs) defined\n# locally in source files will be included in the documentation. If set to NO\n# only classes defined in header files are included. Does not have any effect\n# for Java sources.\n# The default value is: YES.\n\nEXTRACT_LOCAL_CLASSES = YES\n\n# This flag is only useful for Objective-C code. When set to YES local methods,\n# which are defined in the implementation section but not in the interface are\n# included in the documentation. If set to NO only methods in the interface are\n# included.\n# The default value is: NO.\n\nEXTRACT_LOCAL_METHODS = NO\n\n# If this flag is set to YES, the members of anonymous namespaces will be\n# extracted and appear in the documentation as a namespace called\n# 'anonymous_namespace{file}', where file will be replaced with the base name of\n# the file that contains the anonymous namespace. By default anonymous namespace\n# are hidden.\n# The default value is: NO.\n\nEXTRACT_ANON_NSPACES = NO\n\n# If the HIDE_UNDOC_MEMBERS tag is set to YES, doxygen will hide all\n# undocumented members inside documented classes or files. If set to NO these\n# members will be included in the various overviews, but no documentation\n# section is generated. This option has no effect if EXTRACT_ALL is enabled.\n# The default value is: NO.\n\nHIDE_UNDOC_MEMBERS = NO\n\n# If the HIDE_UNDOC_CLASSES tag is set to YES, doxygen will hide all\n# undocumented classes that are normally visible in the class hierarchy. If set\n# to NO these classes will be included in the various overviews. This option has\n# no effect if EXTRACT_ALL is enabled.\n# The default value is: NO.\n\nHIDE_UNDOC_CLASSES = NO\n\n# If the HIDE_FRIEND_COMPOUNDS tag is set to YES, doxygen will hide all friend\n# (class|struct|union) declarations. If set to NO these declarations will be\n# included in the documentation.\n# The default value is: NO.\n\nHIDE_FRIEND_COMPOUNDS = NO\n\n# If the HIDE_IN_BODY_DOCS tag is set to YES, doxygen will hide any\n# documentation blocks found inside the body of a function. If set to NO these\n# blocks will be appended to the function's detailed documentation block.\n# The default value is: NO.\n\nHIDE_IN_BODY_DOCS = NO\n\n# The INTERNAL_DOCS tag determines if documentation that is typed after a\n# \\internal command is included. If the tag is set to NO then the documentation\n# will be excluded. Set it to YES to include the internal documentation.\n# The default value is: NO.\n\nINTERNAL_DOCS = NO\n\n# If the CASE_SENSE_NAMES tag is set to NO then doxygen will only generate file\n# names in lower-case letters. If set to YES upper-case letters are also\n# allowed. This is useful if you have classes or files whose names only differ\n# in case and if your file system supports case sensitive file names. Windows\n# and Mac users are advised to set this option to NO.\n# The default value is: system dependent.\n\nCASE_SENSE_NAMES = NO\n\n# If the HIDE_SCOPE_NAMES tag is set to NO then doxygen will show members with\n# their full class and namespace scopes in the documentation. If set to YES the\n# scope will be hidden.\n# The default value is: NO.\n\nHIDE_SCOPE_NAMES = NO\n\n# If the SHOW_INCLUDE_FILES tag is set to YES then doxygen will put a list of\n# the files that are included by a file in the documentation of that file.\n# The default value is: YES.\n\nSHOW_INCLUDE_FILES = YES\n\n# If the SHOW_GROUPED_MEMB_INC tag is set to YES then Doxygen will add for each\n# grouped member an include statement to the documentation, telling the reader\n# which file to include in order to use the member.\n# The default value is: NO.\n\nSHOW_GROUPED_MEMB_INC = NO\n\n# If the FORCE_LOCAL_INCLUDES tag is set to YES then doxygen will list include\n# files with double quotes in the documentation rather than with sharp brackets.\n# The default value is: NO.\n\nFORCE_LOCAL_INCLUDES = NO\n\n# If the INLINE_INFO tag is set to YES then a tag [inline] is inserted in the\n# documentation for inline members.\n# The default value is: YES.\n\nINLINE_INFO = YES\n\n# If the SORT_MEMBER_DOCS tag is set to YES then doxygen will sort the\n# (detailed) documentation of file and class members alphabetically by member\n# name. If set to NO the members will appear in declaration order.\n# The default value is: YES.\n\nSORT_MEMBER_DOCS = YES\n\n# If the SORT_BRIEF_DOCS tag is set to YES then doxygen will sort the brief\n# descriptions of file, namespace and class members alphabetically by member\n# name. If set to NO the members will appear in declaration order. Note that\n# this will also influence the order of the classes in the class list.\n# The default value is: NO.\n\nSORT_BRIEF_DOCS = NO\n\n# If the SORT_MEMBERS_CTORS_1ST tag is set to YES then doxygen will sort the\n# (brief and detailed) documentation of class members so that constructors and\n# destructors are listed first. If set to NO the constructors will appear in the\n# respective orders defined by SORT_BRIEF_DOCS and SORT_MEMBER_DOCS.\n# Note: If SORT_BRIEF_DOCS is set to NO this option is ignored for sorting brief\n# member documentation.\n# Note: If SORT_MEMBER_DOCS is set to NO this option is ignored for sorting\n# detailed member documentation.\n# The default value is: NO.\n\nSORT_MEMBERS_CTORS_1ST = NO\n\n# If the SORT_GROUP_NAMES tag is set to YES then doxygen will sort the hierarchy\n# of group names into alphabetical order. If set to NO the group names will\n# appear in their defined order.\n# The default value is: NO.\n\nSORT_GROUP_NAMES = NO\n\n# If the SORT_BY_SCOPE_NAME tag is set to YES, the class list will be sorted by\n# fully-qualified names, including namespaces. If set to NO, the class list will\n# be sorted only by class name, not including the namespace part.\n# Note: This option is not very useful if HIDE_SCOPE_NAMES is set to YES.\n# Note: This option applies only to the class list, not to the alphabetical\n# list.\n# The default value is: NO.\n\nSORT_BY_SCOPE_NAME = NO\n\n# If the STRICT_PROTO_MATCHING option is enabled and doxygen fails to do proper\n# type resolution of all parameters of a function it will reject a match between\n# the prototype and the implementation of a member function even if there is\n# only one candidate or it is obvious which candidate to choose by doing a\n# simple string match. By disabling STRICT_PROTO_MATCHING doxygen will still\n# accept a match between prototype and implementation in such cases.\n# The default value is: NO.\n\nSTRICT_PROTO_MATCHING = NO\n\n# The GENERATE_TODOLIST tag can be used to enable ( YES) or disable ( NO) the\n# todo list. This list is created by putting \\todo commands in the\n# documentation.\n# The default value is: YES.\n\nGENERATE_TODOLIST = YES\n\n# The GENERATE_TESTLIST tag can be used to enable ( YES) or disable ( NO) the\n# test list. This list is created by putting \\test commands in the\n# documentation.\n# The default value is: YES.\n\nGENERATE_TESTLIST = YES\n\n# The GENERATE_BUGLIST tag can be used to enable ( YES) or disable ( NO) the bug\n# list. This list is created by putting \\bug commands in the documentation.\n# The default value is: YES.\n\nGENERATE_BUGLIST = YES\n\n# The GENERATE_DEPRECATEDLIST tag can be used to enable ( YES) or disable ( NO)\n# the deprecated list. This list is created by putting \\deprecated commands in\n# the documentation.\n# The default value is: YES.\n\nGENERATE_DEPRECATEDLIST= YES\n\n# The ENABLED_SECTIONS tag can be used to enable conditional documentation\n# sections, marked by \\if ... \\endif and \\cond \n# ... \\endcond blocks.\n\nENABLED_SECTIONS =\n\n# The MAX_INITIALIZER_LINES tag determines the maximum number of lines that the\n# initial value of a variable or macro / define can have for it to appear in the\n# documentation. If the initializer consists of more lines than specified here\n# it will be hidden. Use a value of 0 to hide initializers completely. The\n# appearance of the value of individual variables and macros / defines can be\n# controlled using \\showinitializer or \\hideinitializer command in the\n# documentation regardless of this setting.\n# Minimum value: 0, maximum value: 10000, default value: 30.\n\nMAX_INITIALIZER_LINES = 30\n\n# Set the SHOW_USED_FILES tag to NO to disable the list of files generated at\n# the bottom of the documentation of classes and structs. If set to YES the list\n# will mention the files that were used to generate the documentation.\n# The default value is: YES.\n\nSHOW_USED_FILES = YES\n\n# Set the SHOW_FILES tag to NO to disable the generation of the Files page. This\n# will remove the Files entry from the Quick Index and from the Folder Tree View\n# (if specified).\n# The default value is: YES.\n\nSHOW_FILES = YES\n\n# Set the SHOW_NAMESPACES tag to NO to disable the generation of the Namespaces\n# page. This will remove the Namespaces entry from the Quick Index and from the\n# Folder Tree View (if specified).\n# The default value is: YES.\n\nSHOW_NAMESPACES = YES\n\n# The FILE_VERSION_FILTER tag can be used to specify a program or script that\n# doxygen should invoke to get the current version for each file (typically from\n# the version control system). Doxygen will invoke the program by executing (via\n# popen()) the command command input-file, where command is the value of the\n# FILE_VERSION_FILTER tag, and input-file is the name of an input file provided\n# by doxygen. Whatever the program writes to standard output is used as the file\n# version. For an example see the documentation.\n\nFILE_VERSION_FILTER =\n\n# The LAYOUT_FILE tag can be used to specify a layout file which will be parsed\n# by doxygen. The layout file controls the global structure of the generated\n# output files in an output format independent way. To create the layout file\n# that represents doxygen's defaults, run doxygen with the -l option. You can\n# optionally specify a file name after the option, if omitted DoxygenLayout.xml\n# will be used as the name of the layout file.\n#\n# Note that if you run doxygen from a directory containing a file called\n# DoxygenLayout.xml, doxygen will parse it automatically even if the LAYOUT_FILE\n# tag is left empty.\n\nLAYOUT_FILE =\n\n# The CITE_BIB_FILES tag can be used to specify one or more bib files containing\n# the reference definitions. This must be a list of .bib files. The .bib\n# extension is automatically appended if omitted. This requires the bibtex tool\n# to be installed. See also http://en.wikipedia.org/wiki/BibTeX for more info.\n# For LaTeX the style of the bibliography can be controlled using\n# LATEX_BIB_STYLE. To use this feature you need bibtex and perl available in the\n# search path. Do not use file names with spaces, bibtex cannot handle them. See\n# also \\cite for info how to create references.\n\nCITE_BIB_FILES =\n\n#---------------------------------------------------------------------------\n# Configuration options related to warning and progress messages\n#---------------------------------------------------------------------------\n\n# The QUIET tag can be used to turn on/off the messages that are generated to\n# standard output by doxygen. If QUIET is set to YES this implies that the\n# messages are off.\n# The default value is: NO.\n\nQUIET = NO\n\n# The WARNINGS tag can be used to turn on/off the warning messages that are\n# generated to standard error ( stderr) by doxygen. If WARNINGS is set to YES\n# this implies that the warnings are on.\n#\n# Tip: Turn warnings on while writing the documentation.\n# The default value is: YES.\n\nWARNINGS = YES\n\n# If the WARN_IF_UNDOCUMENTED tag is set to YES, then doxygen will generate\n# warnings for undocumented members. If EXTRACT_ALL is set to YES then this flag\n# will automatically be disabled.\n# The default value is: YES.\n\nWARN_IF_UNDOCUMENTED = YES\n\n# If the WARN_IF_DOC_ERROR tag is set to YES, doxygen will generate warnings for\n# potential errors in the documentation, such as not documenting some parameters\n# in a documented function, or documenting parameters that don't exist or using\n# markup commands wrongly.\n# The default value is: YES.\n\nWARN_IF_DOC_ERROR = YES\n\n# This WARN_NO_PARAMDOC option can be enabled to get warnings for functions that\n# are documented, but have no documentation for their parameters or return\n# value. If set to NO doxygen will only warn about wrong or incomplete parameter\n# documentation, but not about the absence of documentation.\n# The default value is: NO.\n\nWARN_NO_PARAMDOC = NO\n\n# The WARN_FORMAT tag determines the format of the warning messages that doxygen\n# can produce. The string should contain the $file, $line, and $text tags, which\n# will be replaced by the file and line number from which the warning originated\n# and the warning text. Optionally the format may contain $version, which will\n# be replaced by the version of the file (if it could be obtained via\n# FILE_VERSION_FILTER)\n# The default value is: $file:$line: $text.\n\nWARN_FORMAT = \"$file:$line: $text\"\n\n# The WARN_LOGFILE tag can be used to specify a file to which warning and error\n# messages should be written. If left blank the output is written to standard\n# error (stderr).\n\nWARN_LOGFILE =\n\n#---------------------------------------------------------------------------\n# Configuration options related to the input files\n#---------------------------------------------------------------------------\n\n# The INPUT tag is used to specify the files and/or directories that contain\n# documented source files. You may enter file names like myfile.cpp or\n# directories like /usr/src/myproject. Separate the files or directories with\n# spaces.\n# Note: If this tag is empty the current directory is searched.\n\nINPUT = .\n\n# This tag can be used to specify the character encoding of the source files\n# that doxygen parses. Internally doxygen uses the UTF-8 encoding. Doxygen uses\n# libiconv (or the iconv built into libc) for the transcoding. See the libiconv\n# documentation (see: http://www.gnu.org/software/libiconv) for the list of\n# possible encodings.\n# The default value is: UTF-8.\n\nINPUT_ENCODING = UTF-8\n\n# If the value of the INPUT tag contains directories, you can use the\n# FILE_PATTERNS tag to specify one or more wildcard patterns (like *.cpp and\n# *.h) to filter out the source-files in the directories. If left blank the\n# following patterns are tested:*.c, *.cc, *.cxx, *.cpp, *.c++, *.java, *.ii,\n# *.ixx, *.ipp, *.i++, *.inl, *.idl, *.ddl, *.odl, *.h, *.hh, *.hxx, *.hpp,\n# *.h++, *.cs, *.d, *.php, *.php4, *.php5, *.phtml, *.inc, *.m, *.markdown,\n# *.md, *.mm, *.dox, *.py, *.f90, *.f, *.for, *.tcl, *.vhd, *.vhdl, *.ucf,\n# *.qsf, *.as and *.js.\n\nFILE_PATTERNS = *.py\n\n# The RECURSIVE tag can be used to specify whether or not subdirectories should\n# be searched for input files as well.\n# The default value is: NO.\n\nRECURSIVE = YES\n\n# The EXCLUDE tag can be used to specify files and/or directories that should be\n# excluded from the INPUT source files. This way you can easily exclude a\n# subdirectory from a directory tree whose root is specified with the INPUT tag.\n#\n# Note that relative paths are relative to the directory from which doxygen is\n# run.\n\nEXCLUDE =\n\n# The EXCLUDE_SYMLINKS tag can be used to select whether or not files or\n# directories that are symbolic links (a Unix file system feature) are excluded\n# from the input.\n# The default value is: NO.\n\nEXCLUDE_SYMLINKS = NO\n\n# If the value of the INPUT tag contains directories, you can use the\n# EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude\n# certain files from those directories.\n#\n# Note that the wildcards are matched against the file with absolute path, so to\n# exclude all test directories for example use the pattern */test/*\n\nEXCLUDE_PATTERNS =\n\n# The EXCLUDE_SYMBOLS tag can be used to specify one or more symbol names\n# (namespaces, classes, functions, etc.) that should be excluded from the\n# output. The symbol name can be a fully qualified name, a word, or if the\n# wildcard * is used, a substring. Examples: ANamespace, AClass,\n# AClass::ANamespace, ANamespace::*Test\n#\n# Note that the wildcards are matched against the file with absolute path, so to\n# exclude all test directories use the pattern */test/*\n\nEXCLUDE_SYMBOLS =\n\n# The EXAMPLE_PATH tag can be used to specify one or more files or directories\n# that contain example code fragments that are included (see the \\include\n# command).\n\nEXAMPLE_PATH =\n\n# If the value of the EXAMPLE_PATH tag contains directories, you can use the\n# EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp and\n# *.h) to filter out the source-files in the directories. If left blank all\n# files are included.\n\nEXAMPLE_PATTERNS =\n\n# If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be\n# searched for input files to be used with the \\include or \\dontinclude commands\n# irrespective of the value of the RECURSIVE tag.\n# The default value is: NO.\n\nEXAMPLE_RECURSIVE = NO\n\n# The IMAGE_PATH tag can be used to specify one or more files or directories\n# that contain images that are to be included in the documentation (see the\n# \\image command).\n\nIMAGE_PATH =\n\n# The INPUT_FILTER tag can be used to specify a program that doxygen should\n# invoke to filter for each input file. Doxygen will invoke the filter program\n# by executing (via popen()) the command:\n#\n# \n#\n# where is the value of the INPUT_FILTER tag, and is the\n# name of an input file. Doxygen will then use the output that the filter\n# program writes to standard output. If FILTER_PATTERNS is specified, this tag\n# will be ignored.\n#\n# Note that the filter must not add or remove lines; it is applied before the\n# code is scanned, but not when the output code is generated. If lines are added\n# or removed, the anchors will not be placed correctly.\n\nINPUT_FILTER = /usr/local/bin/doxypy.py\n\n# The FILTER_PATTERNS tag can be used to specify filters on a per file pattern\n# basis. Doxygen will compare the file name with each pattern and apply the\n# filter if there is a match. The filters are a list of the form: pattern=filter\n# (like *.cpp=my_cpp_filter). See INPUT_FILTER for further information on how\n# filters are used. If the FILTER_PATTERNS tag is empty or if none of the\n# patterns match the file name, INPUT_FILTER is applied.\n\nFILTER_PATTERNS =\n\n# If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using\n# INPUT_FILTER ) will also be used to filter the input files that are used for\n# producing the source files to browse (i.e. when SOURCE_BROWSER is set to YES).\n# The default value is: NO.\n\nFILTER_SOURCE_FILES = YES\n\n# The FILTER_SOURCE_PATTERNS tag can be used to specify source filters per file\n# pattern. A pattern will override the setting for FILTER_PATTERN (if any) and\n# it is also possible to disable source filtering for a specific pattern using\n# *.ext= (so without naming a filter).\n# This tag requires that the tag FILTER_SOURCE_FILES is set to YES.\n\nFILTER_SOURCE_PATTERNS =\n\n# If the USE_MDFILE_AS_MAINPAGE tag refers to the name of a markdown file that\n# is part of the input, its contents will be placed on the main page\n# (index.html). This can be useful if you have a project on for instance GitHub\n# and want to reuse the introduction page also for the doxygen output.\n\nUSE_MDFILE_AS_MAINPAGE =\n\n#---------------------------------------------------------------------------\n# Configuration options related to source browsing\n#---------------------------------------------------------------------------\n\n# If the SOURCE_BROWSER tag is set to YES then a list of source files will be\n# generated. Documented entities will be cross-referenced with these sources.\n#\n# Note: To get rid of all source code in the generated output, make sure that\n# also VERBATIM_HEADERS is set to NO.\n# The default value is: NO.\n\nSOURCE_BROWSER = NO\n\n# Setting the INLINE_SOURCES tag to YES will include the body of functions,\n# classes and enums directly into the documentation.\n# The default value is: NO.\n\nINLINE_SOURCES = NO\n\n# Setting the STRIP_CODE_COMMENTS tag to YES will instruct doxygen to hide any\n# special comment blocks from generated source code fragments. Normal C, C++ and\n# Fortran comments will always remain visible.\n# The default value is: YES.\n\nSTRIP_CODE_COMMENTS = YES\n\n# If the REFERENCED_BY_RELATION tag is set to YES then for each documented\n# function all documented functions referencing it will be listed.\n# The default value is: NO.\n\nREFERENCED_BY_RELATION = NO\n\n# If the REFERENCES_RELATION tag is set to YES then for each documented function\n# all documented entities called/used by that function will be listed.\n# The default value is: NO.\n\nREFERENCES_RELATION = NO\n\n# If the REFERENCES_LINK_SOURCE tag is set to YES and SOURCE_BROWSER tag is set\n# to YES, then the hyperlinks from functions in REFERENCES_RELATION and\n# REFERENCED_BY_RELATION lists will link to the source code. Otherwise they will\n# link to the documentation.\n# The default value is: YES.\n\nREFERENCES_LINK_SOURCE = YES\n\n# If SOURCE_TOOLTIPS is enabled (the default) then hovering a hyperlink in the\n# source code will show a tooltip with additional information such as prototype,\n# brief description and links to the definition and documentation. Since this\n# will make the HTML file larger and loading of large files a bit slower, you\n# can opt to disable this feature.\n# The default value is: YES.\n# This tag requires that the tag SOURCE_BROWSER is set to YES.\n\nSOURCE_TOOLTIPS = YES\n\n# If the USE_HTAGS tag is set to YES then the references to source code will\n# point to the HTML generated by the htags(1) tool instead of doxygen built-in\n# source browser. The htags tool is part of GNU's global source tagging system\n# (see http://www.gnu.org/software/global/global.html). You will need version\n# 4.8.6 or higher.\n#\n# To use it do the following:\n# - Install the latest version of global\n# - Enable SOURCE_BROWSER and USE_HTAGS in the config file\n# - Make sure the INPUT points to the root of the source tree\n# - Run doxygen as normal\n#\n# Doxygen will invoke htags (and that will in turn invoke gtags), so these\n# tools must be available from the command line (i.e. in the search path).\n#\n# The result: instead of the source browser generated by doxygen, the links to\n# source code will now point to the output of htags.\n# The default value is: NO.\n# This tag requires that the tag SOURCE_BROWSER is set to YES.\n\nUSE_HTAGS = NO\n\n# If the VERBATIM_HEADERS tag is set the YES then doxygen will generate a\n# verbatim copy of the header file for each class for which an include is\n# specified. Set to NO to disable this.\n# See also: Section \\class.\n# The default value is: YES.\n\nVERBATIM_HEADERS = YES\n\n#---------------------------------------------------------------------------\n# Configuration options related to the alphabetical class index\n#---------------------------------------------------------------------------\n\n# If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index of all\n# compounds will be generated. Enable this if the project contains a lot of\n# classes, structs, unions or interfaces.\n# The default value is: YES.\n\nALPHABETICAL_INDEX = YES\n\n# The COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns in\n# which the alphabetical index list will be split.\n# Minimum value: 1, maximum value: 20, default value: 5.\n# This tag requires that the tag ALPHABETICAL_INDEX is set to YES.\n\nCOLS_IN_ALPHA_INDEX = 5\n\n# In case all classes in a project start with a common prefix, all classes will\n# be put under the same header in the alphabetical index. The IGNORE_PREFIX tag\n# can be used to specify a prefix (or a list of prefixes) that should be ignored\n# while generating the index headers.\n# This tag requires that the tag ALPHABETICAL_INDEX is set to YES.\n\nIGNORE_PREFIX =\n\n#---------------------------------------------------------------------------\n# Configuration options related to the HTML output\n#---------------------------------------------------------------------------\n\n# If the GENERATE_HTML tag is set to YES doxygen will generate HTML output\n# The default value is: YES.\n\nGENERATE_HTML = YES\n\n# The HTML_OUTPUT tag is used to specify where the HTML docs will be put. If a\n# relative path is entered the value of OUTPUT_DIRECTORY will be put in front of\n# it.\n# The default directory is: html.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nHTML_OUTPUT = html\n\n# The HTML_FILE_EXTENSION tag can be used to specify the file extension for each\n# generated HTML page (for example: .htm, .php, .asp).\n# The default value is: .html.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nHTML_FILE_EXTENSION = .html\n\n# The HTML_HEADER tag can be used to specify a user-defined HTML header file for\n# each generated HTML page. If the tag is left blank doxygen will generate a\n# standard header.\n#\n# To get valid HTML the header file that includes any scripts and style sheets\n# that doxygen needs, which is dependent on the configuration options used (e.g.\n# the setting GENERATE_TREEVIEW). It is highly recommended to start with a\n# default header using\n# doxygen -w html new_header.html new_footer.html new_stylesheet.css\n# YourConfigFile\n# and then modify the file new_header.html. See also section \"Doxygen usage\"\n# for information on how to generate the default header that doxygen normally\n# uses.\n# Note: The header is subject to change so you typically have to regenerate the\n# default header when upgrading to a newer version of doxygen. For a description\n# of the possible markers and block names see the documentation.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nHTML_HEADER =\n\n# The HTML_FOOTER tag can be used to specify a user-defined HTML footer for each\n# generated HTML page. If the tag is left blank doxygen will generate a standard\n# footer. See HTML_HEADER for more information on how to generate a default\n# footer and what special commands can be used inside the footer. See also\n# section \"Doxygen usage\" for information on how to generate the default footer\n# that doxygen normally uses.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nHTML_FOOTER =\n\n# The HTML_STYLESHEET tag can be used to specify a user-defined cascading style\n# sheet that is used by each HTML page. It can be used to fine-tune the look of\n# the HTML output. If left blank doxygen will generate a default style sheet.\n# See also section \"Doxygen usage\" for information on how to generate the style\n# sheet that doxygen normally uses.\n# Note: It is recommended to use HTML_EXTRA_STYLESHEET instead of this tag, as\n# it is more robust and this tag (HTML_STYLESHEET) will in the future become\n# obsolete.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nHTML_STYLESHEET =\n\n# The HTML_EXTRA_STYLESHEET tag can be used to specify an additional user-\n# defined cascading style sheet that is included after the standard style sheets\n# created by doxygen. Using this option one can overrule certain style aspects.\n# This is preferred over using HTML_STYLESHEET since it does not replace the\n# standard style sheet and is therefor more robust against future updates.\n# Doxygen will copy the style sheet file to the output directory. For an example\n# see the documentation.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nHTML_EXTRA_STYLESHEET =\n\n# The HTML_EXTRA_FILES tag can be used to specify one or more extra images or\n# other source files which should be copied to the HTML output directory. Note\n# that these files will be copied to the base HTML output directory. Use the\n# $relpath^ marker in the HTML_HEADER and/or HTML_FOOTER files to load these\n# files. In the HTML_STYLESHEET file, use the file name only. Also note that the\n# files will be copied as-is; there are no commands or markers available.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nHTML_EXTRA_FILES =\n\n# The HTML_COLORSTYLE_HUE tag controls the color of the HTML output. Doxygen\n# will adjust the colors in the stylesheet and background images according to\n# this color. Hue is specified as an angle on a colorwheel, see\n# http://en.wikipedia.org/wiki/Hue for more information. For instance the value\n# 0 represents red, 60 is yellow, 120 is green, 180 is cyan, 240 is blue, 300\n# purple, and 360 is red again.\n# Minimum value: 0, maximum value: 359, default value: 220.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nHTML_COLORSTYLE_HUE = 220\n\n# The HTML_COLORSTYLE_SAT tag controls the purity (or saturation) of the colors\n# in the HTML output. For a value of 0 the output will use grayscales only. A\n# value of 255 will produce the most vivid colors.\n# Minimum value: 0, maximum value: 255, default value: 100.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nHTML_COLORSTYLE_SAT = 100\n\n# The HTML_COLORSTYLE_GAMMA tag controls the gamma correction applied to the\n# luminance component of the colors in the HTML output. Values below 100\n# gradually make the output lighter, whereas values above 100 make the output\n# darker. The value divided by 100 is the actual gamma applied, so 80 represents\n# a gamma of 0.8, The value 220 represents a gamma of 2.2, and 100 does not\n# change the gamma.\n# Minimum value: 40, maximum value: 240, default value: 80.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nHTML_COLORSTYLE_GAMMA = 80\n\n# If the HTML_TIMESTAMP tag is set to YES then the footer of each generated HTML\n# page will contain the date and time when the page was generated. Setting this\n# to NO can help when comparing the output of multiple runs.\n# The default value is: YES.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nHTML_TIMESTAMP = YES\n\n# If the HTML_DYNAMIC_SECTIONS tag is set to YES then the generated HTML\n# documentation will contain sections that can be hidden and shown after the\n# page has loaded.\n# The default value is: NO.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nHTML_DYNAMIC_SECTIONS = NO\n\n# With HTML_INDEX_NUM_ENTRIES one can control the preferred number of entries\n# shown in the various tree structured indices initially; the user can expand\n# and collapse entries dynamically later on. Doxygen will expand the tree to\n# such a level that at most the specified number of entries are visible (unless\n# a fully collapsed tree already exceeds this amount). So setting the number of\n# entries 1 will produce a full collapsed tree by default. 0 is a special value\n# representing an infinite number of entries and will result in a full expanded\n# tree by default.\n# Minimum value: 0, maximum value: 9999, default value: 100.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nHTML_INDEX_NUM_ENTRIES = 100\n\n# If the GENERATE_DOCSET tag is set to YES, additional index files will be\n# generated that can be used as input for Apple's Xcode 3 integrated development\n# environment (see: http://developer.apple.com/tools/xcode/), introduced with\n# OSX 10.5 (Leopard). To create a documentation set, doxygen will generate a\n# Makefile in the HTML output directory. Running make will produce the docset in\n# that directory and running make install will install the docset in\n# ~/Library/Developer/Shared/Documentation/DocSets so that Xcode will find it at\n# startup. See http://developer.apple.com/tools/creatingdocsetswithdoxygen.html\n# for more information.\n# The default value is: NO.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nGENERATE_DOCSET = NO\n\n# This tag determines the name of the docset feed. A documentation feed provides\n# an umbrella under which multiple documentation sets from a single provider\n# (such as a company or product suite) can be grouped.\n# The default value is: Doxygen generated docs.\n# This tag requires that the tag GENERATE_DOCSET is set to YES.\n\nDOCSET_FEEDNAME = \"Doxygen generated docs\"\n\n# This tag specifies a string that should uniquely identify the documentation\n# set bundle. This should be a reverse domain-name style string, e.g.\n# com.mycompany.MyDocSet. Doxygen will append .docset to the name.\n# The default value is: org.doxygen.Project.\n# This tag requires that the tag GENERATE_DOCSET is set to YES.\n\nDOCSET_BUNDLE_ID = org.doxygen.Project\n\n# The DOCSET_PUBLISHER_ID tag specifies a string that should uniquely identify\n# the documentation publisher. This should be a reverse domain-name style\n# string, e.g. com.mycompany.MyDocSet.documentation.\n# The default value is: org.doxygen.Publisher.\n# This tag requires that the tag GENERATE_DOCSET is set to YES.\n\nDOCSET_PUBLISHER_ID = org.doxygen.Publisher\n\n# The DOCSET_PUBLISHER_NAME tag identifies the documentation publisher.\n# The default value is: Publisher.\n# This tag requires that the tag GENERATE_DOCSET is set to YES.\n\nDOCSET_PUBLISHER_NAME = Publisher\n\n# If the GENERATE_HTMLHELP tag is set to YES then doxygen generates three\n# additional HTML index files: index.hhp, index.hhc, and index.hhk. The\n# index.hhp is a project file that can be read by Microsoft's HTML Help Workshop\n# (see: http://www.microsoft.com/en-us/download/details.aspx?id=21138) on\n# Windows.\n#\n# The HTML Help Workshop contains a compiler that can convert all HTML output\n# generated by doxygen into a single compiled HTML file (.chm). Compiled HTML\n# files are now used as the Windows 98 help format, and will replace the old\n# Windows help format (.hlp) on all Windows platforms in the future. Compressed\n# HTML files also contain an index, a table of contents, and you can search for\n# words in the documentation. The HTML workshop also contains a viewer for\n# compressed HTML files.\n# The default value is: NO.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nGENERATE_HTMLHELP = NO\n\n# The CHM_FILE tag can be used to specify the file name of the resulting .chm\n# file. You can add a path in front of the file if the result should not be\n# written to the html output directory.\n# This tag requires that the tag GENERATE_HTMLHELP is set to YES.\n\nCHM_FILE =\n\n# The HHC_LOCATION tag can be used to specify the location (absolute path\n# including file name) of the HTML help compiler ( hhc.exe). If non-empty\n# doxygen will try to run the HTML help compiler on the generated index.hhp.\n# The file has to be specified with full path.\n# This tag requires that the tag GENERATE_HTMLHELP is set to YES.\n\nHHC_LOCATION =\n\n# The GENERATE_CHI flag controls if a separate .chi index file is generated (\n# YES) or that it should be included in the master .chm file ( NO).\n# The default value is: NO.\n# This tag requires that the tag GENERATE_HTMLHELP is set to YES.\n\nGENERATE_CHI = NO\n\n# The CHM_INDEX_ENCODING is used to encode HtmlHelp index ( hhk), content ( hhc)\n# and project file content.\n# This tag requires that the tag GENERATE_HTMLHELP is set to YES.\n\nCHM_INDEX_ENCODING =\n\n# The BINARY_TOC flag controls whether a binary table of contents is generated (\n# YES) or a normal table of contents ( NO) in the .chm file. Furthermore it\n# enables the Previous and Next buttons.\n# The default value is: NO.\n# This tag requires that the tag GENERATE_HTMLHELP is set to YES.\n\nBINARY_TOC = NO\n\n# The TOC_EXPAND flag can be set to YES to add extra items for group members to\n# the table of contents of the HTML help documentation and to the tree view.\n# The default value is: NO.\n# This tag requires that the tag GENERATE_HTMLHELP is set to YES.\n\nTOC_EXPAND = YES\n\n# If the GENERATE_QHP tag is set to YES and both QHP_NAMESPACE and\n# QHP_VIRTUAL_FOLDER are set, an additional index file will be generated that\n# can be used as input for Qt's qhelpgenerator to generate a Qt Compressed Help\n# (.qch) of the generated HTML documentation.\n# The default value is: NO.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nGENERATE_QHP = NO\n\n# If the QHG_LOCATION tag is specified, the QCH_FILE tag can be used to specify\n# the file name of the resulting .qch file. The path specified is relative to\n# the HTML output folder.\n# This tag requires that the tag GENERATE_QHP is set to YES.\n\nQCH_FILE =\n\n# The QHP_NAMESPACE tag specifies the namespace to use when generating Qt Help\n# Project output. For more information please see Qt Help Project / Namespace\n# (see: http://qt-project.org/doc/qt-4.8/qthelpproject.html#namespace).\n# The default value is: org.doxygen.Project.\n# This tag requires that the tag GENERATE_QHP is set to YES.\n\nQHP_NAMESPACE = org.doxygen.Project\n\n# The QHP_VIRTUAL_FOLDER tag specifies the namespace to use when generating Qt\n# Help Project output. For more information please see Qt Help Project / Virtual\n# Folders (see: http://qt-project.org/doc/qt-4.8/qthelpproject.html#virtual-\n# folders).\n# The default value is: doc.\n# This tag requires that the tag GENERATE_QHP is set to YES.\n\nQHP_VIRTUAL_FOLDER = doc\n\n# If the QHP_CUST_FILTER_NAME tag is set, it specifies the name of a custom\n# filter to add. For more information please see Qt Help Project / Custom\n# Filters (see: http://qt-project.org/doc/qt-4.8/qthelpproject.html#custom-\n# filters).\n# This tag requires that the tag GENERATE_QHP is set to YES.\n\nQHP_CUST_FILTER_NAME =\n\n# The QHP_CUST_FILTER_ATTRS tag specifies the list of the attributes of the\n# custom filter to add. For more information please see Qt Help Project / Custom\n# Filters (see: http://qt-project.org/doc/qt-4.8/qthelpproject.html#custom-\n# filters).\n# This tag requires that the tag GENERATE_QHP is set to YES.\n\nQHP_CUST_FILTER_ATTRS =\n\n# The QHP_SECT_FILTER_ATTRS tag specifies the list of the attributes this\n# project's filter section matches. Qt Help Project / Filter Attributes (see:\n# http://qt-project.org/doc/qt-4.8/qthelpproject.html#filter-attributes).\n# This tag requires that the tag GENERATE_QHP is set to YES.\n\nQHP_SECT_FILTER_ATTRS =\n\n# The QHG_LOCATION tag can be used to specify the location of Qt's\n# qhelpgenerator. If non-empty doxygen will try to run qhelpgenerator on the\n# generated .qhp file.\n# This tag requires that the tag GENERATE_QHP is set to YES.\n\nQHG_LOCATION =\n\n# If the GENERATE_ECLIPSEHELP tag is set to YES, additional index files will be\n# generated, together with the HTML files, they form an Eclipse help plugin. To\n# install this plugin and make it available under the help contents menu in\n# Eclipse, the contents of the directory containing the HTML and XML files needs\n# to be copied into the plugins directory of eclipse. The name of the directory\n# within the plugins directory should be the same as the ECLIPSE_DOC_ID value.\n# After copying Eclipse needs to be restarted before the help appears.\n# The default value is: NO.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nGENERATE_ECLIPSEHELP = NO\n\n# A unique identifier for the Eclipse help plugin. When installing the plugin\n# the directory name containing the HTML and XML files should also have this\n# name. Each documentation set should have its own identifier.\n# The default value is: org.doxygen.Project.\n# This tag requires that the tag GENERATE_ECLIPSEHELP is set to YES.\n\nECLIPSE_DOC_ID = org.doxygen.Project\n\n# If you want full control over the layout of the generated HTML pages it might\n# be necessary to disable the index and replace it with your own. The\n# DISABLE_INDEX tag can be used to turn on/off the condensed index (tabs) at top\n# of each HTML page. A value of NO enables the index and the value YES disables\n# it. Since the tabs in the index contain the same information as the navigation\n# tree, you can set this option to YES if you also set GENERATE_TREEVIEW to YES.\n# The default value is: NO.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nDISABLE_INDEX = YES\n\n# The GENERATE_TREEVIEW tag is used to specify whether a tree-like index\n# structure should be generated to display hierarchical information. If the tag\n# value is set to YES, a side panel will be generated containing a tree-like\n# index structure (just like the one that is generated for HTML Help). For this\n# to work a browser that supports JavaScript, DHTML, CSS and frames is required\n# (i.e. any modern browser). Windows users are probably better off using the\n# HTML help feature. Via custom stylesheets (see HTML_EXTRA_STYLESHEET) one can\n# further fine-tune the look of the index. As an example, the default style\n# sheet generated by doxygen has an example that shows how to put an image at\n# the root of the tree instead of the PROJECT_NAME. Since the tree basically has\n# the same information as the tab index, you could consider setting\n# DISABLE_INDEX to YES when enabling this option.\n# The default value is: NO.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nGENERATE_TREEVIEW = YES\n\n# The ENUM_VALUES_PER_LINE tag can be used to set the number of enum values that\n# doxygen will group on one line in the generated HTML documentation.\n#\n# Note that a value of 0 will completely suppress the enum values from appearing\n# in the overview section.\n# Minimum value: 0, maximum value: 20, default value: 4.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nENUM_VALUES_PER_LINE = 4\n\n# If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be used\n# to set the initial width (in pixels) of the frame in which the tree is shown.\n# Minimum value: 0, maximum value: 1500, default value: 250.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nTREEVIEW_WIDTH = 250\n\n# When the EXT_LINKS_IN_WINDOW option is set to YES doxygen will open links to\n# external symbols imported via tag files in a separate window.\n# The default value is: NO.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nEXT_LINKS_IN_WINDOW = NO\n\n# Use this tag to change the font size of LaTeX formulas included as images in\n# the HTML documentation. When you change the font size after a successful\n# doxygen run you need to manually remove any form_*.png images from the HTML\n# output directory to force them to be regenerated.\n# Minimum value: 8, maximum value: 50, default value: 10.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nFORMULA_FONTSIZE = 10\n\n# Use the FORMULA_TRANPARENT tag to determine whether or not the images\n# generated for formulas are transparent PNGs. Transparent PNGs are not\n# supported properly for IE 6.0, but are supported on all modern browsers.\n#\n# Note that when changing this option you need to delete any form_*.png files in\n# the HTML output directory before the changes have effect.\n# The default value is: YES.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nFORMULA_TRANSPARENT = YES\n\n# Enable the USE_MATHJAX option to render LaTeX formulas using MathJax (see\n# http://www.mathjax.org) which uses client side Javascript for the rendering\n# instead of using prerendered bitmaps. Use this if you do not have LaTeX\n# installed or if you want to formulas look prettier in the HTML output. When\n# enabled you may also need to install MathJax separately and configure the path\n# to it using the MATHJAX_RELPATH option.\n# The default value is: NO.\n# This tag requires that the tag GENERATE_HTML is set to YES.\n\nUSE_MATHJAX = NO\n\n# When MathJax is enabled you can set the default output format to be used for\n# the MathJax output. See the MathJax site (see:\n# http://docs.mathjax.org/en/latest/output.html) for more details.\n# Possible values are: HTML-CSS (which is slower, but has the best\n# compatibility), NativeMML (i.e. MathML) and SVG.\n# The default value is: HTML-CSS.\n# This tag requires that the tag USE_MATHJAX is set to YES.\n\nMATHJAX_FORMAT = HTML-CSS\n\n# When MathJax is enabled you need to specify the location relative to the HTML\n# output directory using the MATHJAX_RELPATH option. The destination directory\n# should contain the MathJax.js script. For instance, if the mathjax directory\n# is located at the same level as the HTML output directory, then\n# MATHJAX_RELPATH should be ../mathjax. The default value points to the MathJax\n# Content Delivery Network so you can quickly see the result without installing\n# MathJax. However, it is strongly recommended to install a local copy of\n# MathJax from http://www.mathjax.org before deployment.\n# The default value is: http://cdn.mathjax.org/mathjax/latest.\n# This tag requires that the tag USE_MATHJAX is set to YES.\n\nMATHJAX_RELPATH = http://cdn.mathjax.org/mathjax/latest\n\n# The MATHJAX_EXTENSIONS tag can be used to specify one or more MathJax\n# extension names that should be enabled during MathJax rendering. For example\n# MATHJAX_EXTENSIONS = TeX/AMSmath TeX/AMSsymbols\n# This tag requires that the tag USE_MATHJAX is set to YES.\n\nMATHJAX_EXTENSIONS =\n\n# The MATHJAX_CODEFILE tag can be used to specify a file with javascript pieces\n# of code that will be used on startup of the MathJax code. See the MathJax site\n# (see: http://docs.mathjax.org/en/latest/output.html) for more details. For an\n# example see the documentation.\n# This tag requires that the tag USE_MATHJAX is set to YES.\n\nMATHJAX_CODEFILE =\n\n# When the SEARCHENGINE tag is enabled doxygen will generate a search box for\n# the HTML output. The underlying search engine uses javascript and DHTML and\n# should work on any modern browser. Note that when using HTML help\n# (GENERATE_HTMLHELP), Qt help (GENERATE_QHP), or docsets (GENERATE_DOCSET)\n# there is already a search function so this one should typically be disabled.\n# For large projects the javascript based search engine can be slow, then\n# enabling SERVER_BASED_SEARCH may provide a better solution. It is possible to\n# search using the keyboard; to jump to the search box use + S\n# (what the is depends on the OS and browser, but it is typically\n# , /