diff --git a/.gitignore b/.gitignore index a02b967ad..281f003ca 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,7 @@ volatility/symbols/windows* # Volatility's config config*.json + +# Pyinstaller files +build +dist diff --git a/vol.spec b/vol.spec new file mode 100644 index 000000000..3776f3859 --- /dev/null +++ b/vol.spec @@ -0,0 +1,32 @@ +# -*- mode: python -*- + +block_cipher = None + + +a = Analysis(['vol.py'], + pathex=[], + binaries=[], + datas=[('volatility/schemas', 'volatility/schemas')], + hiddenimports=[], + hookspath=[], + runtime_hooks=[], + excludes=[], + win_no_prefer_redirects=False, + win_private_assemblies=False, + cipher=block_cipher, + noarchive=False) +pyz = PYZ(a.pure, a.zipped_data, + cipher=block_cipher) +exe = EXE(pyz, + a.scripts, + a.binaries, + a.zipfiles, + a.datas, + [], + name='vol', + debug=False, + bootloader_ignore_signals=False, + strip=False, + upx=True, + runtime_tmpdir=None, + console=True ) diff --git a/volatility/cli/__init__.py b/volatility/cli/__init__.py index 4fb68d40b..fca94dc23 100644 --- a/volatility/cli/__init__.py +++ b/volatility/cli/__init__.py @@ -102,10 +102,12 @@ class CommandLine(interfaces.plugins.FileConsumerInterface): known_args = [arg for arg in sys.argv if arg != '--help' and arg != '-h'] partial_args, _ = parser.parse_known_args(known_args) if partial_args.plugin_dirs: - volatility.plugins.__path__ = partial_args.plugin_dirs.split(";") + constants.PLUGINS_PATH + volatility.plugins.__path__ = [os.path.abspath(p) for p in + partial_args.plugin_dirs.split(";")] + constants.PLUGINS_PATH if partial_args.symbol_dirs: - volatility.symbols.__path__ = partial_args.symbol_dirs.split(";") + constants.SYMBOL_BASEPATHS + volatility.symbols.__path__ = [os.path.abspath(p) for p in + partial_args.symbol_dirs.split(";")] + constants.SYMBOL_BASEPATHS if partial_args.log: file_logger = logging.FileHandler(partial_args.log) diff --git a/volatility/framework/automagic/pdbscan.py b/volatility/framework/automagic/pdbscan.py index 64dd4dbe3..04edf1611 100644 --- a/volatility/framework/automagic/pdbscan.py +++ b/volatility/framework/automagic/pdbscan.py @@ -10,6 +10,7 @@ import os import struct import typing +from volatility import symbols from volatility.framework import constants, exceptions, layers, validity from volatility.framework.configuration import requirements from volatility.framework.interfaces import configuration diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 7805d12f2..55e5bd611 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -146,6 +146,8 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): zip_match = "/".join(os.path.split(filename)) # Check user symbol directory first, then fallback to the framework's library to allow for overloading + vollog.log(constants.LOGLEVEL_VVVV, + "Searching for symbols in {}".format(", ".join(volatility.symbols.__path__))) for path in volatility.symbols.__path__: if not os.path.isabs(path): path = os.path.abspath(os.path.join(__file__, path))