volatile memory extraction framework
Project homepage: https://www.volatilityfoundation.org/
Description
Volatility is the world's most widely used framework for extracting
digital artifacts from volatile memory (RAM) samples. The extraction
techniques are performed completely independent of the system being
investigated but offer visibility into the runtime state of the system.
The framework is intended to introduce people to the techniques and
complexities associated with extracting digital artifacts from volatile
memory samples and provide a platform for further work into this
exciting area of research.
In 2019, the Volatility Foundation released a complete rewrite of the
framework, Volatility 3. The project was intended to address many of the
technical and performance challenges associated with the original code
base that became apparent over the previous 10 years. Another benefit of
the rewrite is that Volatility 3 could be released under a custom
license that was more aligned with the goals of the Volatility
community, the Volatility Software License (VSL).
Package information
- Ports path
- security/volatility3
- Package architecture
- amd64
- Maintainer
- Sebastian Reitenbach <sebastia@openbsd.org>
- Categories
- security, lang/python
- Available flavors
- None listed
- Only for architectures
- aarch64, amd64, arm, i386, mips64, mips64el, powerpc, powerpc64, riscv64, sparc64, alpha, hppa
Ports list build and test dependencies as well as runtime dependencies. pkg_add selects those needed for installation.
Direct dependencies
Runtime
- devel/py-arrow
- devel/capstone/python
- graphics/py-Pillow
- security/py-cryptodome
- security/py-pefile
- security/yara/python
- lang/python/3
Build
- lang/python/3
- devel/py-build
- devel/py-installer
- devel/py-setuptools py3-setuptools->=79v0
- devel/py-wheel
OpenBSD README
This README contains unresolved ports variables; replace them before using its commands.
+-------------------------------------------------------------------------------
| Running volatility3 on OpenBSD
+-------------------------------------------------------------------------------
Install symbol tables
=====================
Symbol table packs for the various operating systems are available for
download at:
https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip
https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip
https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip
The hashes to verify whether any of the symbol pack files have
downloaded successfully or have changed can be found at:
https://downloads.volatilityfoundation.org/volatility3/symbols/SHA256SUMS
https://downloads.volatilityfoundation.org/volatility3/symbols/SHA1SUMS
https://downloads.volatilityfoundation.org/volatility3/symbols/MD5SUMS
Symbol tables zip files must be placed, as named, into the
${LOCALBASE}/lib/python${MODPY_VERSION}/site-packages/volatility3/framework/symbols/
directory (or just the symbols directory next to the executable file).
Windows symbols that cannot be found will be queried, downloaded,
generated and cached. Mac and Linux symbol tables must be manually
produced by a tool such as dwarf2json.