volatility icon indicating copy to clipboard operation
volatility copied to clipboard

FYI Volatility 2.6.1 compatible with Python 3.6+

Open koromodako opened this issue 5 years ago • 0 comments

I create this issue to inform the community that a version of Volatility 2.x compatible with Python3.6+ is available here : https://github.com/koromodako/volatility

It is not Volatility3 obviously and does not aim at replacing it. It is just an effort to make Volatility 2.x work as long as possible because:

  • Python2 (deprecated) tends to slowly disappear from newer operating systems
  • Volatility dependencies are migrating to Python3 and become incompatible and unavailable for Python2
  • Volatility3 license is ambiguous when it comes to using it for education-related purpose (waiting for an answer on this issue).

Some points you might want to know:

  • this fork offers a requirements.txt (all dependencies on PyPI are compatible at the time of writing)
  • this fork offers a testing/ directory with scripts automating testing for OSes supported by Volatility
  • this fork has been tested and mostly works with equivalent or better performance for almost every plugin
  • some Volatility plugins output are not deterministic: not cool, it makes it difficult to perform diff-based test automation
  • most plugins have been successfully tested with three dumps: Windows 10 (winpmem), Windows 7 (vmem format) and Debian 9 Stretch (LiME) which is obviously far from covering every corner case
  • as no MacOSX dump was available for testing, mac_* plugins remain untested
  • updating the fork with new profiles does not seem difficult as most profile files prove to be fully compatible with Python3
  • few plugins or address space layers might still be bugged, know that most bugs come from the confusion between bytes/strings and encoding (Python2's worst behavior in my opinion). Thankfully, these bugs are pretty easy to catch and fix.

This issue is closely related with this 3-year-old issue.

Thanks for this amazing project, long live Volatility !

koromodako avatar Dec 17 '20 15:12 koromodako