I've been playing around with the script I've created in the previous blog post and I'm starting to think that there is some real potential in a web interface for Volatilty. So I've made some improvements to the script to make it more functional. The most significant improvements are:

The default page shows the list of available processes by using the ps() command.
The attributes of an object are probed to check if they point to another object and should be clickable. This adds significantly to the stability of the site.
It's possible to look at the raw hex of an object by using the dd() command.
The code has become more modular, so it's easier to add new functionality to it.

I've also started to implement code to traverse linked lists, but this is not really working at this moment. I've to figure out how to handle the navigation while traversing and how to dereference the objects to the correct type. Any ideas on this are welcome.

For the next version I'm thinking of converting the whole thing to a full Volatility plugin and not using volshell anymore. This would require me to duplicate some volshell code, but on the other hand give me the advantage of working with the native objects instead of parsing the stdout output.

Other items on the wish/todo list are:

Integrate more plugins in the interface.
Improvements on the navigation and useability.
Caching and downloading of results.
Improvements on the security of the site.

Some screenshots of the new version:

Select the a process from the processlist

Improved object information and navigation

Raw view of an object

The new version can be downloaded here. Read the previous post on how to get it started and for the conditions and precautions for using it.

Comments and requests are welcome!

New version of VolWeb