Creates a CSV of programs' memory usage from volatility's VADinfo output

vadinfo_totaler.py

import json
import pandas

VADINFO_FILE=r"FILE_PATH_GOES_HERE"
CSV_OUTPUT=r"FILE_PATH_GOES_HERE"

# thanks https://stackoverflow.com/questions/1094841/get-human-readable-version-of-file-size
def sizeof_fmt(num, suffix='B'):
    for unit in ['','Ki','Mi','Gi','Ti','Pi','Ei','Zi']:
        if abs(num) < 1024.0:
            return "%3.1f%s%s" % (num, unit, suffix)
        num /= 1024.0
    return "%.1f%s%s" % (num, 'Yi', suffix)


fh = open(VADINFO_FILE, "r")
process_details = {}

linecount = 0
for line in fh.readlines():
    linecount += 1
    # skip headers
    if linecount < 5:
        continue  
        
    line_vals = line.split("\t")
    #print(line_vals)
    # get columns of interest
    pid = line_vals[0]
    name = line_vals[1]
    mem_start = line_vals[3]
    mem_end = line_vals[4]
    # This is the max 64bit address; doesn't appear to actually be used so don't calcualate it
    if mem_end == "0x7fffffeffff":
        continue
    # calc total memory in allocated range
    mem_diff = int(mem_end, 0) - int(mem_start, 0)
    #print(f"{mem_end}({int(mem_end, 0)}) - {mem_start}({int(mem_start, 0)}) = {mem_diff}")
    
    # update/set variables
    process_dict = process_details.setdefault(pid, {})
    process_dict["process_name"] = name
    prev_mem_usage = process_dict.setdefault("memory_usage", 0)
    total_memory_usage = prev_mem_usage + mem_diff
    process_dict["memory_usage"] = total_memory_usage
    process_dict["memory_usage_hr"] = sizeof_fmt(total_memory_usage)

df = pandas.DataFrame.from_dict(process_details, orient="index")
df.to_csv(CSV_OUTPUT)
print(df)