import struct import volatility conf as conf import volatility registry as registry memory_file "windowsxpsp vmemsys path append("/users/justin/downloads/volatility-"registry pluginimporter(config conf confobject(import volatility commands as commands import volatility addrspace as addrspace config parse_options(config profile "winxpsp config location "file://%smemory_file registry register_global_options(configcommands commandregistry register_global_options(configaddrspace baseaddressspacefirst we set variable to point to the memory image that we're going to analyze next we include our volatility download path so that our code can successfully import the volatility libraries the rest of the supporting code is just to set up our instance of volatility with profile and configuration options set as well now let' plumb in our actual hash-dumping code add the following lines to grabhashes py from volatility plugins registry registryapi import registryapi from volatility plugins registry lsadump import hashdump registry registryapi(configregistry populate_offsets(sam_offset none sys_offset none for offset in registry all_offsetsif registry all_offsets[offsetendswith("\\sam")sam_offset offset print "[*sam % xoffset if registry all_offsets[offsetendswith("\\system")sys_offset offset print "[*system % xoffset if sam_offset is not none and sys_offset is not noneconfig sys_offset sys_offset config sam_offset sam_offset hashdump hashdump(configfor hash in hashdump calculate()print hash break if sam_offset is none or sys_offset is noneprint "[*failed to find the system or sam offsets we first instantiate new instance of registryapi that' helper class with commonly used registry functionsit takes only the current configuration as parameter the populate_offsets call then performs the equivalent to running the hivelist command that we previously covered nextwe start walking through each of the discovered hives looking for the sam and system