From 5cc8e360731b27563290f4e40da73b0d00e02364 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 8 Apr 2025 16:04:25 +0100 Subject: [PATCH] Documentation: Improve the readme to make quickstart the first thing people see --- README.md | 58 +++++++++++++++++++++++++++++-------------------------- 1 file changed, 31 insertions(+), 27 deletions(-) diff --git a/README.md b/README.md index 4f5a0a37e..3c8698c12 100644 --- a/README.md +++ b/README.md @@ -14,10 +14,33 @@ technical and performance challenges associated with the original code base that became apparent over the previous 10 years. Another benefit of the rewrite is that Volatility 3 could be released under a custom license that was more aligned with the goals of the Volatility community, -the Volatility Software License (VSL). See the -[LICENSE](https://www.volatilityfoundation.org/license/vsl-v1.0) file for +the Volatility Software License (VSL). See the +[LICENSE](https://www.volatilityfoundation.org/license/vsl-v1.0) file for more details. +## Quick Start + +1. Install the required dependencies: + + ```shell + pip install --user -e. + ``` + +2. See available options: + + ```shell + vol -h + ``` + +3. To get more information on a Windows memory sample and to make sure Volatility supports that sample type, run `vol -f windows.info`: + + ```shell + vol -f /home/user/samples/stuxnet.vmem windows.info + ``` + +4. Run some other plugins. The `-f` or `--single-location` is not strictly required, but most plugins expect a single sample. +Some also require/accept other options. Run `vol -h` for more information on a particular command. + ## Installing Volatility 3 requires Python 3.8.0 or later and is published on the [PyPi registry](https://pypi.org/project/volatility3). @@ -38,38 +61,19 @@ python3 -m venv venv && . venv/bin/activate pip install -e ".[dev]" ``` -## Quick Start - -1. Install Volatility 3 as documented in the Installing section of the readme. - -2. See available options: - - ```shell - vol -h - ``` - -3. To get more information on a Windows memory sample and to make sure Volatility supports that sample type, run `vol -f windows.info`: - - ```shell - vol -f /home/user/samples/stuxnet.vmem windows.info - ``` - -4. Run some other plugins. The `-f` or `--single-location` is not strictly required, but most plugins expect a single sample. -Some also require/accept other options. Run `vol -h` for more information on a particular command. - ## Symbol Tables Symbol table packs for the various operating systems are available for download at: - - - + + + The hashes to verify whether any of the symbol pack files have downloaded successfully or have changed can be found at: - - - + + + Symbol tables zip files must be placed, as named, into the `volatility3/symbols` directory (or just the symbols directory next to the executable file).