From 5e955e522004ca1aa20702ae93b41e6468ef0af2 Mon Sep 17 00:00:00 2001 From: Esa Jokinen Date: Tue, 10 Mar 2026 17:08:01 +0200 Subject: [PATCH] Support Cryptodome namespace when Crypto is unavailable --- .../framework/plugins/windows/registry/cachedump.py | 9 +++++++-- .../framework/plugins/windows/registry/hashdump.py | 6 +++++- .../framework/plugins/windows/registry/lsadump.py | 6 +++++- 3 files changed, 17 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/windows/registry/cachedump.py b/volatility3/framework/plugins/windows/registry/cachedump.py index 49c5495c2..5e138ba99 100644 --- a/volatility3/framework/plugins/windows/registry/cachedump.py +++ b/volatility3/framework/plugins/windows/registry/cachedump.py @@ -5,8 +5,13 @@ import logging from struct import unpack from typing import Tuple -from Crypto.Cipher import ARC4, AES -from Crypto.Hash import HMAC +try: + from Crypto.Cipher import ARC4, AES + from Crypto.Hash import HMAC +except ImportError: + # Debian/Ubuntu ship pycryptodome under Cryptodome namespace + from Cryptodome.Cipher import ARC4, AES + from Cryptodome.Hash import HMAC from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements diff --git a/volatility3/framework/plugins/windows/registry/hashdump.py b/volatility3/framework/plugins/windows/registry/hashdump.py index 19bd60e81..6f8a2bce8 100644 --- a/volatility3/framework/plugins/windows/registry/hashdump.py +++ b/volatility3/framework/plugins/windows/registry/hashdump.py @@ -7,7 +7,11 @@ import logging from struct import pack, unpack from typing import List, Optional, Tuple -from Crypto.Cipher import AES, ARC4, DES +try: + from Crypto.Cipher import ARC4, DES, AES +except ImportError: + # Debian/Ubuntu ship pycryptodome under Cryptodome namespace + from Cryptodome.Cipher import ARC4, DES, AES from volatility3.framework import interfaces, renderers, exceptions, constants from volatility3.framework.configuration import requirements diff --git a/volatility3/framework/plugins/windows/registry/lsadump.py b/volatility3/framework/plugins/windows/registry/lsadump.py index 50ecaebc1..7233f82ac 100644 --- a/volatility3/framework/plugins/windows/registry/lsadump.py +++ b/volatility3/framework/plugins/windows/registry/lsadump.py @@ -6,7 +6,11 @@ from struct import unpack from typing import Optional import hashlib -from Crypto.Cipher import ARC4, DES, AES +try: + from Crypto.Cipher import ARC4, DES, AES +except ImportError: + # Debian/Ubuntu ship pycryptodome under Cryptodome namespace + from Cryptodome.Cipher import ARC4, DES, AES from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements