volatilityfoundation / volatility3

Volatility 3.0 development
http://volatilityfoundation.org/
Other
2.51k stars 435 forks source link

ModuleNotFoundError: No module named '_lzma' #709

Closed Thrawn-Smith closed 2 years ago

Thrawn-Smith commented 2 years ago

Describe the bug Error importing lzma python library under python v3.7.0

root@SECTIO:/opt/TOOLS/FORENSIC/volatility3# python3.7 vol.py --help
Traceback (most recent call last):
  File "vol.py", line 7, in <module>
    import volatility3.cli
  File "/opt/TOOLS/FORENSIC/volatility3/volatility3/cli/__init__.py", line 30, in <module>
    from volatility3.framework.automagic import stacker
  File "/opt/TOOLS/FORENSIC/volatility3/volatility3/framework/automagic/stacker.py", line 22, in <module>
    from volatility3.framework.layers import physical
  File "/opt/TOOLS/FORENSIC/volatility3/volatility3/framework/layers/physical.py", line 10, in <module>
    from volatility3.framework.layers import resources
  File "/opt/TOOLS/FORENSIC/volatility3/volatility3/framework/layers/resources.py", line 10, in <module>
    import lzma
  File "/usr/local/lib/python3.7/lzma.py", line 27, in <module>
    from _lzma import *
ModuleNotFoundError: No module named '_lzma'

Context Volatility Version: volatility 3 build 2.0.3 Operating System: debian Python Version: 3.7.0 Suspected Operating System: N/A Command: python3.7 vol.py --help

To Reproduce Steps to reproduce the behavior:

  1. git clone
  2. install requirements, build, make etc.
  3. launch vol3
Thrawn-Smith commented 2 years ago

[SOLUTION]

  1. Install lzma backport https://pypi.org/project/backports.lzma
  2. edit /usr/local/lib/python3.7/lzma.py file for enabling this previously installed lib
try:
        from _lzma import *
        from _lzma import _encode_filter_properties, _decode_filter_properties
except ImportError:
        from backports.lzma import *
import _compression
  1. Test volatility with libzma backports
root@SECTIO:/opt/TOOLS/FORENSIC/volatility3# python3.7 vol.py --help
Volatility 3 Framework 2.0.3
usage: volatility [-h] [-c CONFIG] [--parallelism [{processes,threads,off}]]
                  [-e EXTEND] [-p PLUGIN_DIRS] [-s SYMBOL_DIRS] [-v] [-l LOG]
                  [-o OUTPUT_DIR] [-q] [-r RENDERER] [-f FILE]
                  [--write-config] [--save-config SAVE_CONFIG] [--clear-cache]
                  [--cache-path CACHE_PATH] [--offline]
                  [--single-location SINGLE_LOCATION]
                  [--stackers [STACKERS [STACKERS ...]]]
                  [--single-swap-locations [SINGLE_SWAP_LOCATIONS [SINGLE_SWAP_LOCATIONS ...]]]
                  plugin ...