volatility
volatility copied to clipboard
FYI Volatility 2.6.1 compatible with Python 3.6+
I create this issue to inform the community that a version of Volatility 2.x compatible with Python3.6+ is available here : https://github.com/koromodako/volatility
It is not Volatility3 obviously and does not aim at replacing it. It is just an effort to make Volatility 2.x work as long as possible because:
- Python2 (deprecated) tends to slowly disappear from newer operating systems
- Volatility dependencies are migrating to Python3 and become incompatible and unavailable for Python2
- Volatility3 license is ambiguous when it comes to using it for education-related purpose (waiting for an answer on this issue).
Some points you might want to know:
- this fork offers a
requirements.txt(all dependencies on PyPI are compatible at the time of writing) - this fork offers a
testing/directory with scripts automating testing for OSes supported by Volatility - this fork has been tested and mostly works with equivalent or better performance for almost every plugin
- some Volatility plugins output are not deterministic: not cool, it makes it difficult to perform diff-based test automation
- most plugins have been successfully tested with three dumps: Windows 10 (winpmem), Windows 7 (vmem format) and Debian 9 Stretch (LiME) which is obviously far from covering every corner case
- as no MacOSX dump was available for testing,
mac_*plugins remain untested - updating the fork with new profiles does not seem difficult as most profile files prove to be fully compatible with Python3
- few plugins or address space layers might still be bugged, know that most bugs come from the confusion between bytes/strings and encoding (Python2's worst behavior in my opinion). Thankfully, these bugs are pretty easy to catch and fix.
This issue is closely related with this 3-year-old issue.
Thanks for this amazing project, long live Volatility !