Merge pull request #1956 from oh2fih/fix/windows-pdb-download-to-cache

Add user cache directory as fallback for downloaded symbols

volatility3/framework/constants/__init__.py

@@ -25,6 +25,18 @@ from volatility3.framework.constants._version import (
 
 REQUIRED_PYTHON_VERSION = (3, 8, 0)
 
+CACHE_PATH = os.path.join(
+    os.environ.get("XDG_CACHE_HOME") or os.path.join(os.path.expanduser("~"), ".cache"),
+    "volatility3",
+)
+"""Default path to store cached data"""
+
+if sys.platform == "win32":
+    CACHE_PATH = os.path.realpath(
+        os.path.join(os.environ.get("APPDATA", os.path.expanduser("~")), "volatility3")
+    )
+os.makedirs(CACHE_PATH, exist_ok=True)
+
 PLUGINS_PATH = [
     os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "plugins")),
     os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "plugins")),
@@ -34,6 +46,9 @@ PLUGINS_PATH = [
 SYMBOL_BASEPATHS = [
     os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "symbols")),
     os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "symbols")),
+    os.path.abspath(
+        os.path.join(CACHE_PATH, "symbols")
+    ),  # User cache fallback for automatically downloaded temporary symbols
 ]
 """Default list of paths to load symbols from (volatility3/symbols and volatility3/framework/symbols)"""
 
@@ -71,21 +86,9 @@ LOGLEVEL_VVVV = 6
 """Logging level for four levels of detail: -vvvvvv"""
 
 
-CACHE_PATH = os.path.join(
-    os.environ.get("XDG_CACHE_HOME") or os.path.join(os.path.expanduser("~"), ".cache"),
-    "volatility3",
-)
-"""Default path to store cached data"""
-
 SQLITE_CACHE_PERIOD = "-3 days"
 """SQLite time modifier for how long each item is valid in the cache for"""
 
-if sys.platform == "win32":
-    CACHE_PATH = os.path.realpath(
-        os.path.join(os.environ.get("APPDATA", os.path.expanduser("~")), "volatility3")
-    )
-os.makedirs(CACHE_PATH, exist_ok=True)
-
 IDENTIFIERS_FILENAME = "identifier.cache"
 """Default location to record information about available identifiers"""
 

volatility3/framework/symbols/windows/pdbutil.py

@@ -289,7 +289,7 @@ class PDBUtility(interfaces.configuration.VersionableInterface):
                         )
                 break
             except PermissionError:
-                vollog.warning(
+                vollog.debug(
                     f"Cannot write necessary symbol file, please check permissions on {potential_output_filename}"
                 )
                 continue