Produce a windows standalone executable as part of the release

[asterictnl-lvdw]

Is your feature request related to a problem? Please describe. Like what you did in the past you guys released of Volatility2 Binary versions that were compiled by pyinstaller

Describe the solution you'd like A fully working volatility3.exe that can be run or either instructions on how to make the executable properly

Describe alternatives you've considered I have tried to use pyinstaller and auto-py-to-exe, but it fails to work when I try to run a plugin.

[ikelos]

This is something we'll have to investigate in our build chain. It was quite a manual process for volatility 2.6 and we'd want to automate generating them somewhat for volatility 3. @npetroni is this something the buildbot could do and should we roll it into our release process?

[ulysse0]

Sorry about the previous duplicate. Do you think this is something that will eventually become real, if yes, do you have an idea of when approximately ? Thank you

[ikelos]

I don't but if you have an installed and working copy of volatility 3 on your window system, you should be able to create a full binary using pyinstaller and the .spec file in the root of the repository.

[ulysse0]

Indeed I successfully created an executable. What did you try exactly with pyinstaller, OP ?

[asterictnl-lvdw]

Hello Thread,

I managed to actually create the Executable. It was an issue with the directory it was in previously. I changed it and executed pyinstaller on the .spec file again and then it successfully created the vol.exe correctly.

[lic-8]

Hi all, I have created the executable using the .spec file, but it did not embed plugins and symbols:

    > ./vol -f /home/user/Downloads/MemoryDump_Lab3.raw windows.info
Volatility 3 Framework 2.4.0
usage: volatility [-h] [-c CONFIG] [--parallelism [{processes,threads,off}]]
                  [-e EXTEND] [-p PLUGIN_DIRS] [-s SYMBOL_DIRS] [-v] [-l LOG]
                  [-o OUTPUT_DIR] [-q] [-r RENDERER] [-f FILE]
                  [--write-config] [--save-config SAVE_CONFIG] [--clear-cache]
                  [--cache-path CACHE_PATH] [--offline]
                  [--single-location SINGLE_LOCATION]
                  [--stackers [STACKERS ...]]
                  plugin ...
volatility: error: argument plugin: invalid choice windows.info (choose from )

@ikelos Any ideas ?

[asterictnl-lvdw]

@lic-8

IMPORTANT please execute "pip3 uninstall volatility3" first to remove the old volatility3 because it causes issues with the new installation
Requirements
- pyinstaller installed
- GitHub Repo: https://github.com/volatilityfoundation/volatility3
1. Clone the repo in C:\Volatility3
2. Open a Powershell / CMD prompt and run the following commands:
pip3 install -r .\requirements.txt
python3 install .
pyinstaller .\vol.spec

Please try the above instruction and tell me if that works.

[lic-8]

@asterictnl-lvdw

I am on on Linux, but I still tried what you said:

[ pikachu ] ~  $
    > pip3 uninstall volatility3
WARNING: Skipping volatility3 as it is not installed.

[ pikachu ] ~  $
    > git clone https://github.com/volatilityfoundation/volatility3
Cloning into 'volatility3'...
remote: Enumerating objects: 30126, done.
remote: Counting objects: 100% (970/970), done.
remote: Compressing objects: 100% (526/526), done.
remote: Total 30126 (delta 587), reused 775 (delta 438), pack-reused 29156
Receiving objects: 100% (30126/30126), 6.12 MiB | 979.00 KiB/s, done.
Resolving deltas: 100% (22768/22768), done.

[ pikachu ] ~  $
    > cd volatility3/

[ pikachu ] volatility3 (develop) $
    > git checkout stable 
Branch 'stable' set up to track remote branch 'stable' from 'origin'.
Switched to a new branch 'stable'

---

[ pikachu ] volatility3 (stable) $
    > pip3 install -r ./requirements.txt 
Defaulting to user installation because normal site-packages is not writeable
Collecting pefile>=2017.8.1
  Downloading pefile-2023.2.7-py3-none-any.whl (71 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 71.8/71.8 KB 3.1 MB/s eta 0:00:00
Collecting yara-python>=3.8.0
  Downloading yara-python-4.2.3.tar.gz (457 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 457.2/457.2 KB 3.8 MB/s eta 0:00:00
  Preparing metadata (setup.py) ... done
Collecting capstone>=3.0.5
  Downloading capstone-4.0.2-py2.py3-none-manylinux1_x86_64.whl (2.1 MB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.1/2.1 MB 4.8 MB/s eta 0:00:00
Collecting pycryptodome
  Downloading pycryptodome-3.17-cp35-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (2.1 MB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2.1/2.1 MB 8.9 MB/s eta 0:00:00
Collecting leechcorepyc>=2.4.0
  Downloading leechcorepyc-2.14.1-cp36-abi3-manylinux1_x86_64.whl (126 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 126.8/126.8 KB 10.6 MB/s eta 0:00:00
Collecting python-snappy==0.6.0
  Downloading python-snappy-0.6.0.tar.gz (21 kB)
  Preparing metadata (setup.py) ... done
Building wheels for collected packages: python-snappy, yara-python
  Building wheel for python-snappy (setup.py) ... error
  error: subprocess-exited-with-error

  × python setup.py bdist_wheel did not run successfully.
  │ exit code: 1
  ╰─> [26 lines of output]
      /usr/lib/python3.10/distutils/dist.py:274: UserWarning: Unknown distribution option: 'cffi_modules'
        warnings.warn(msg)
      running bdist_wheel
      running build
      running build_py
      creating build
      creating build/lib.linux-x86_64-3.10
      creating build/lib.linux-x86_64-3.10/snappy
      copying snappy/__main__.py -> build/lib.linux-x86_64-3.10/snappy
      copying snappy/snappy_formats.py -> build/lib.linux-x86_64-3.10/snappy
      copying snappy/snappy_cffi.py -> build/lib.linux-x86_64-3.10/snappy
      copying snappy/__init__.py -> build/lib.linux-x86_64-3.10/snappy
      copying snappy/snappy_cffi_builder.py -> build/lib.linux-x86_64-3.10/snappy
      copying snappy/hadoop_snappy.py -> build/lib.linux-x86_64-3.10/snappy
      copying snappy/snappy.py -> build/lib.linux-x86_64-3.10/snappy
      running build_ext
      building 'snappy._snappy' extension
      creating build/temp.linux-x86_64-3.10
      creating build/temp.linux-x86_64-3.10/snappy
      x86_64-linux-gnu-gcc -Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O2 -Wall -g -fstack-protector-strong -Wformat -Werror=format-security -g -fwrapv -O2 -g -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -fPIC -I/usr/include/python3.10 -c snappy/crc32c.c -o build/temp.linux-x86_64-3.10/snappy/crc32c.o
      x86_64-linux-gnu-gcc -Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O2 -Wall -g -fstack-protector-strong -Wformat -Werror=format-security -g -fwrapv -O2 -g -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -fPIC -I/usr/include/python3.10 -c snappy/snappymodule.cc -o build/temp.linux-x86_64-3.10/snappy/snappymodule.o
      snappy/snappymodule.cc:32:10: fatal error: snappy-c.h: No such file or directory
         32 | #include <snappy-c.h>
            |          ^~~~~~~~~~~~
      compilation terminated.
      error: command '/usr/bin/x86_64-linux-gnu-gcc' failed with exit code 1
      [end of output]

  note: This error originates from a subprocess, and is likely not a problem with pip.
  ERROR: Failed building wheel for python-snappy
  Running setup.py clean for python-snappy
  Building wheel for yara-python (setup.py) ... done
  Created wheel for yara-python: filename=yara_python-4.2.3-cp310-cp310-linux_x86_64.whl size=641858 sha256=2984d0de82398f53bca59324a76a15c8630ba691fb45e5c0b9241f4592685e29
  Stored in directory: /home/pikachu/.cache/pip/wheels/e4/f9/9a/782ba4e25446c571c0d3b75fcf05494345a0ee9a4947448e74
Successfully built yara-python
Failed to build python-snappy
Installing collected packages: yara-python, python-snappy, pycryptodome, pefile, leechcorepyc, capstone
  Running setup.py install for python-snappy ... error
  error: subprocess-exited-with-error

  × Running setup.py install for python-snappy did not run successfully.
  │ exit code: 1
  ╰─> [28 lines of output]
      /usr/lib/python3.10/distutils/dist.py:274: UserWarning: Unknown distribution option: 'cffi_modules'
        warnings.warn(msg)
      running install
      /usr/lib/python3/dist-packages/setuptools/command/install.py:34: SetuptoolsDeprecationWarning: setup.py install is deprecated. Use build and pip and other standards-based tools.
        warnings.warn(
      running build
      running build_py
      creating build
      creating build/lib.linux-x86_64-3.10
      creating build/lib.linux-x86_64-3.10/snappy
      copying snappy/__main__.py -> build/lib.linux-x86_64-3.10/snappy
      copying snappy/snappy_formats.py -> build/lib.linux-x86_64-3.10/snappy
      copying snappy/snappy_cffi.py -> build/lib.linux-x86_64-3.10/snappy
      copying snappy/__init__.py -> build/lib.linux-x86_64-3.10/snappy
      copying snappy/snappy_cffi_builder.py -> build/lib.linux-x86_64-3.10/snappy
      copying snappy/hadoop_snappy.py -> build/lib.linux-x86_64-3.10/snappy
      copying snappy/snappy.py -> build/lib.linux-x86_64-3.10/snappy
      running build_ext
      building 'snappy._snappy' extension
      creating build/temp.linux-x86_64-3.10
      creating build/temp.linux-x86_64-3.10/snappy
      x86_64-linux-gnu-gcc -Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O2 -Wall -g -fstack-protector-strong -Wformat -Werror=format-security -g -fwrapv -O2 -g -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -fPIC -I/usr/include/python3.10 -c snappy/crc32c.c -o build/temp.linux-x86_64-3.10/snappy/crc32c.o
      x86_64-linux-gnu-gcc -Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O2 -Wall -g -fstack-protector-strong -Wformat -Werror=format-security -g -fwrapv -O2 -g -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -fPIC -I/usr/include/python3.10 -c snappy/snappymodule.cc -o build/temp.linux-x86_64-3.10/snappy/snappymodule.o
      snappy/snappymodule.cc:32:10: fatal error: snappy-c.h: No such file or directory
         32 | #include <snappy-c.h>
            |          ^~~~~~~~~~~~
      compilation terminated.
      error: command '/usr/bin/x86_64-linux-gnu-gcc' failed with exit code 1
      [end of output]

  note: This error originates from a subprocess, and is likely not a problem with pip.
error: legacy-install-failure

× Encountered error while trying to install package.
╰─> python-snappy

note: This is an issue with the package mentioned above, not pip.
hint: See above for output from the failure.

---

[ pikachu ] volatility3 (stable) $
    > python3 -m PyInstaller ./vol.spec 
144 INFO: PyInstaller: 5.8.0
144 INFO: Python: 3.10.6
145 INFO: Platform: Linux-5.19.0-32-generic-x86_64-with-glibc2.35
146 INFO: UPX is not available.
177 WARNING: collect_data_files - skipping data collection for module 'volatility3.framework' as it is not a package.
207 WARNING: collect_data_files - skipping data collection for module 'volatility3.framework.automagic' as it is not a package.
242 WARNING: collect_data_files - skipping data collection for module 'volatility3.framework.plugins' as it is not a package.
273 WARNING: collect_data_files - skipping data collection for module 'volatility3.framework.layers' as it is not a package.
305 WARNING: collect_data_files - skipping data collection for module 'volatility3.schemas' as it is not a package.
336 WARNING: collect_data_files - skipping data collection for module 'volatility3.plugins' as it is not a package.
518 INFO: Extending PYTHONPATH with paths
['/home/pikachu/volatility3']
891 INFO: checking Analysis
891 INFO: Building Analysis because Analysis-00.toc is non existent
891 INFO: Initializing module dependency graph...
892 INFO: Caching module graph hooks...
897 WARNING: Several hooks defined for module 'numpy'. Please take care they do not conflict.
899 INFO: Analyzing base_library.zip ...
1648 INFO: Loading module hook 'hook-heapq.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
1925 INFO: Loading module hook 'hook-encodings.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
3040 INFO: Loading module hook 'hook-pickle.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
4229 INFO: Caching module dependency graph...
4328 INFO: running Analysis Analysis-00.toc
4355 INFO: Analyzing /home/pikachu/volatility3/vol.py
4676 INFO: Loading module hook 'hook-multiprocessing.util.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
4792 INFO: Loading module hook 'hook-xml.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
5328 INFO: Processing module hooks...
5389 INFO: Looking for ctypes DLLs
5392 INFO: Analyzing run-time hooks ...
5394 INFO: Including run-time hook '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_inspect.py'
5395 INFO: Including run-time hook '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_pkgutil.py'
5397 INFO: Including run-time hook '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_multiprocessing.py'
5402 INFO: Looking for dynamic libraries
5939 INFO: Looking for eggs
5939 INFO: Python library not among binary dependencies. Performing additional search...
5959 INFO: Using Python library /lib/x86_64-linux-gnu/libpython3.10.so.1.0
5961 INFO: Warnings written to /home/pikachu/volatility3/build/vol/warn-vol.txt
5978 INFO: Graph cross-reference written to /home/pikachu/volatility3/build/vol/xref-vol.html
5987 INFO: checking PYZ
5987 INFO: Building PYZ because PYZ-00.toc is non existent
5987 INFO: Building PYZ (ZlibArchive) /home/pikachu/volatility3/build/vol/PYZ-00.pyz
6250 INFO: Building PYZ (ZlibArchive) /home/pikachu/volatility3/build/vol/PYZ-00.pyz completed successfully.
6252 WARNING: Ignoring icon; supported only on Windows and macOS!
6252 INFO: checking PKG
6252 INFO: Building PKG because PKG-00.toc is non existent
6252 INFO: Building PKG (CArchive) vol.pkg
8999 INFO: Building PKG (CArchive) vol.pkg completed successfully.
9000 INFO: Bootloader /home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/bootloader/Linux-64bit-intel/run
9000 INFO: checking EXE
9000 INFO: Building EXE because EXE-00.toc is non existent
9000 INFO: Building EXE from EXE-00.toc
9000 INFO: Copying bootloader EXE to /home/pikachu/volatility3/dist/vol
9000 INFO: Appending PKG archive to custom ELF section in EXE
9020 INFO: Building EXE from EXE-00.toc completed successfully.

---

[ pikachu ] dist (stable) $
    > ./vol -f /home/pikachu/Downloads/MemoryDump_Lab3.raw windows.info
Volatility 3 Framework 2.4.1
usage: volatility [-h] [-c CONFIG] [--parallelism [{processes,threads,off}]]
                  [-e EXTEND] [-p PLUGIN_DIRS] [-s SYMBOL_DIRS] [-v] [-l LOG]
                  [-o OUTPUT_DIR] [-q] [-r RENDERER] [-f FILE]
                  [--write-config] [--save-config SAVE_CONFIG] [--clear-cache]
                  [--cache-path CACHE_PATH] [--offline]
                  [--single-location SINGLE_LOCATION]
                  [--stackers [STACKERS ...]]
                  plugin ...
volatility: error: argument plugin: invalid choice windows.info (choose from )

[asterictnl-lvdw]

@lic-8

Try this one if you are on Linux:

https://seanthegeek.net/1172/how-to-install-volatility-2-and-volatility-3-on-debian-ubuntu-or-kali-linux/

~ LvdW

Then remove from the requirements.txt snappy-python because it does not work properly.

[lic-8]

@asterictnl-lvdw Thanks but that's not what I want, I want a standalone version of the whole volatility 3 framework, not just an executable that will call python. I need to be able to run volatility on a machine that doesn't have python. Anyway I did exactly what the link you gave me told me to do and here is the result:

[ pikachu ] ~  $
    > vol -h
Volatility 3 Framework 2.4.1
Failed to import '/usr/lib/libyara.so'
PATH = /home/pikachu/.local/bin:/home/pikachu/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin:/usr/local/go/bin:/usr/local/go/bin:/home/pikachu/go/bin:/usr/local/go/bin:/home/pikachu/go/bin:/usr/local/go/bin:/home/pikachu/go/bin;/usr/lib
Traceback (most recent call last):
  File "/home/pikachu/.local/bin/vol", line 8, in <module>
    sys.exit(main())
  File "/home/pikachu/.local/lib/python3.10/site-packages/volatility3/cli/__init__.py", line 797, in main
    CommandLine().run()
  File "/home/pikachu/.local/lib/python3.10/site-packages/volatility3/cli/__init__.py", line 293, in run
    failures = framework.import_files(
  File "/home/pikachu/.local/lib/python3.10/site-packages/volatility3/framework/__init__.py", line 152, in import_files
    failures += import_file(
  File "/home/pikachu/.local/lib/python3.10/site-packages/volatility3/framework/__init__.py", line 184, in import_file
    importlib.import_module(module)
  File "/usr/lib/python3.10/importlib/__init__.py", line 126, in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
  File "<frozen importlib._bootstrap>", line 1050, in _gcd_import
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 883, in exec_module
  File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed
  File "/home/pikachu/.local/lib/python3.10/site-packages/volatility3/framework/plugins/yarascan.py", line 17, in <module>
    import yara
  File "/home/pikachu/.local/lib/python3.10/site-packages/yara/__init__.py", line 7, in <module>
    from yara.rules import compile
  File "/home/pikachu/.local/lib/python3.10/site-packages/yara/rules.py", line 17, in <module>
    from yara.libyara_wrapper import *
  File "/home/pikachu/.local/lib/python3.10/site-packages/yara/libyara_wrapper.py", line 315, in <module>
    libyaradll = cdll.LoadLibrary(library)
  File "/usr/lib/python3.10/ctypes/__init__.py", line 452, in LoadLibrary
    return self._dlltype(name)
  File "/usr/lib/python3.10/ctypes/__init__.py", line 374, in __init__
    self._handle = _dlopen(self._name, mode)
OSError: /usr/lib/libyara.so: cannot open shared object file: No such file or directory

[asterictnl-lvdw]

That is not possible. You have to use Python and install it with Python3 first. There is no standalone version available since pyinstaller uses Python as well. @lic-8

[lic-8]

@asterictnl-lvdw I want to generate a standalone version from a machine that has python, but once the binary file is created, it has to be able to be copied on a machine that doesn't have python and run on this machine. The standalone version should embed all the dependencies to run volatility in the same conditions as if it was Python-interpreted.

[asterictnl-lvdw]

@lic-8 I will suggest you to gather all the binaries first and try to make your own spec file. Besides that you have to make a plugin folder and import it into there. With a standalone app I cannot help unfortunately. Then I would have to look at which dependencies are listed and how they could be imported into the .spec file properly. Because it imports from inside files as well as other files that are needed to run Volatility properly.

[lic-8]

I'm gonna have to invoke God ( @ikelos ) on that

[ikelos]

Firstly, thanks but I've have no deity-esque powers, I'm just a python coder. 5:P

Secondly it looks as though this no longer works in pyinstaller >= 5, due to the way they handle some calls. I've got a ticket open with them as we speak to try to get it resolved. For now, you can either run pyinstaller 4.8, or run:

PYTHONPATH="." pyinstaller vol.spec

as a workaround.

[lic-8]

@ikelos I have tried with PYTHONPATH="." pyinstaller vol.spec and with pyinstalled 4.8 and the result was the same for both:

[ pikachu ] volatility3 (develop) $
    > PYTHONPATH="." pyinstaller vol.spec 
131 INFO: PyInstaller: 4.8
131 INFO: Python: 3.10.6
133 INFO: Platform: Linux-5.19.0-32-generic-x86_64-with-glibc2.35
134 INFO: UPX is not available.
Traceback (most recent call last):
  File "<string>", line 21, in walk_packages
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1002, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 945, in _find_spec
  File "/home/pikachu/volatility3/volatility3/__init__.py", line 45, in find_spec
    raise Warning(warning)
Warning: Please do not use the volatility3.framework.plugins namespace directly, only use volatility3.plugins
collect_submodules: failed to import 'volatility3.framework.plugins.linux'!
Traceback (most recent call last):
  File "<string>", line 21, in walk_packages
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1002, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 945, in _find_spec
  File "/home/pikachu/volatility3/volatility3/__init__.py", line 45, in find_spec
    raise Warning(warning)
Warning: Please do not use the volatility3.framework.plugins namespace directly, only use volatility3.plugins
collect_submodules: failed to import 'volatility3.framework.plugins.mac'!
Traceback (most recent call last):
  File "<string>", line 21, in walk_packages
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1002, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 945, in _find_spec
  File "/home/pikachu/volatility3/volatility3/__init__.py", line 45, in find_spec
    raise Warning(warning)
Warning: Please do not use the volatility3.framework.plugins namespace directly, only use volatility3.plugins
collect_submodules: failed to import 'volatility3.framework.plugins.windows'!
649 INFO: Extending PYTHONPATH with paths
['/home/pikachu/volatility3']
925 INFO: checking Analysis
925 INFO: Building Analysis because Analysis-00.toc is non existent
925 INFO: Initializing module dependency graph...
926 INFO: Caching module graph hooks...
931 WARNING: Several hooks defined for module 'numpy'. Please take care they do not conflict.
932 INFO: Analyzing base_library.zip ...
4412 INFO: Processing pre-find module path hook distutils from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks/pre_find_module_path/hook-distutils.py'.
4413 INFO: distutils: retargeting to non-venv dir '/usr/lib/python3.10'
5436 INFO: Caching module dependency graph...
5554 INFO: running Analysis Analysis-00.toc
5582 INFO: Analyzing vol.py
6610 INFO: Analyzing hidden import 'volatility3.framework.automagic.symbol_finder'
6734 INFO: Analyzing hidden import 'volatility3.framework.automagic.mac'
6894 INFO: Analyzing hidden import 'volatility3.framework.automagic.pdbscan'
7268 INFO: Analyzing hidden import 'volatility3.framework.automagic.module'
7269 INFO: Analyzing hidden import 'volatility3.framework.automagic.linux'
7359 INFO: Analyzing hidden import 'volatility3.framework.automagic.windows'
7368 INFO: Analyzing hidden import 'volatility3.framework.plugins.frameworkinfo'
7370 INFO: Analyzing hidden import 'volatility3.framework.plugins.timeliner'
7376 INFO: Analyzing hidden import 'volatility3.framework.plugins.isfinfo'
7381 INFO: Analyzing hidden import 'volatility3.framework.plugins.configwriter'
7383 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux'
7408 INFO: Analyzing hidden import 'volatility3.framework.plugins.layerwriter'
7411 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows'
7436 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac'
7461 INFO: Analyzing hidden import 'volatility3.framework.plugins.banners'
7463 INFO: Analyzing hidden import 'volatility3.framework.plugins.yarascan'
7518 INFO: Analyzing hidden import 'volatility3.framework.symbols.windows.versions'
7521 INFO: Analyzing hidden import 'volatility3.framework.symbols.linux.extensions.bash'
7523 INFO: Analyzing hidden import 'volatility3.framework.symbols.windows.extensions.network'
7528 INFO: Analyzing hidden import 'volatility3.framework.symbols.windows.extensions.mbr'
7529 INFO: Analyzing hidden import 'volatility3.framework.symbols.windows.extensions.mft'
7530 INFO: Analyzing hidden import 'volatility3.framework.symbols.windows.extensions.crash'
7532 INFO: Analyzing hidden import 'volatility3.framework.symbols.linux.bash'
7532 INFO: Analyzing hidden import 'volatility3.framework.symbols.windows.extensions.services'
7536 INFO: Processing module hooks...
7537 INFO: Loading module hook 'hook-difflib.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
7538 INFO: Loading module hook 'hook-multiprocessing.util.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
7539 INFO: Loading module hook 'hook-encodings.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
7586 INFO: Loading module hook 'hook-xml.etree.cElementTree.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
7586 INFO: Loading module hook 'hook-distutils.util.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
7587 INFO: Loading module hook 'hook-pkg_resources.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
7982 INFO: Processing pre-safe import module hook win32com from '/home/pikachu/.local/lib/python3.10/site-packages/_pyinstaller_hooks_contrib/hooks/pre_safe_import_module/hook-win32com.py'.
7984 WARNING: Hidden import "pkg_resources.py2_warn" not found!
7984 WARNING: Hidden import "pkg_resources.markers" not found!
7985 INFO: Loading module hook 'hook-sqlite3.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
8027 INFO: Loading module hook 'hook-xml.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
8083 INFO: Loading module hook 'hook-pickle.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
8084 INFO: Loading module hook 'hook-heapq.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
8085 INFO: Loading module hook 'hook-sysconfig.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
8095 INFO: Loading module hook 'hook-lib2to3.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
8104 INFO: Loading module hook 'hook-distutils.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
8114 INFO: Looking for ctypes DLLs
8152 INFO: Analyzing run-time hooks ...
8155 INFO: Including run-time hook '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_subprocess.py'
8156 INFO: Including run-time hook '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_inspect.py'
8157 INFO: Including run-time hook '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_pkgutil.py'
8159 INFO: Including run-time hook '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_multiprocessing.py'
8161 INFO: Including run-time hook '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_pkgres.py'
8170 INFO: Looking for dynamic libraries
8440 INFO: Looking for eggs
8440 INFO: Python library not in binary dependencies. Doing additional searching...
8461 INFO: Using Python library /lib/x86_64-linux-gnu/libpython3.10.so.1.0
8465 INFO: Warnings written to /home/pikachu/volatility3/build/vol/warn-vol.txt
8506 INFO: Graph cross-reference written to /home/pikachu/volatility3/build/vol/xref-vol.html
8517 INFO: Appending 'binaries' from .spec
8517 INFO: Appending 'datas' from .spec
8523 INFO: checking PYZ
8523 INFO: Building PYZ because PYZ-00.toc is non existent
8523 INFO: Building PYZ (ZlibArchive) /home/pikachu/volatility3/build/vol/PYZ-00.pyz
9037 INFO: Building PYZ (ZlibArchive) /home/pikachu/volatility3/build/vol/PYZ-00.pyz completed successfully.
9043 INFO: checking PKG
9043 INFO: Building PKG because PKG-00.toc is non existent
9043 INFO: Building PKG (CArchive) vol.pkg
13135 INFO: Building PKG (CArchive) vol.pkg completed successfully.
13140 INFO: Bootloader /home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/bootloader/Linux-64bit-intel/run
13140 INFO: checking EXE
13140 INFO: Building EXE because EXE-00.toc is non existent
13140 INFO: Building EXE from EXE-00.toc
13140 INFO: Copying bootloader EXE to /home/pikachu/volatility3/dist/vol
13140 INFO: Appending PKG archive to custom ELF section in EXE
13194 INFO: Building EXE from EXE-00.toc completed successfully.

[ pikachu ] volatility3 (develop) $
    > cd dist

[ pikachu ] dist (develop) $
    > ./vol -h
Volatility 3 Framework 2.4.1
Failed to import '/tmp/_MEIriYKLr/lib/libyara.so'
PATH = /home/pikachu/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin:/usr/local/go/bin:/usr/local/go/bin:/home/pikachu/go/bin:/usr/local/go/bin:/home/pikachu/go/bin;/tmp/_MEIriYKLr/lib
Traceback (most recent call last):
  File "PyInstaller/loader/pyimod04_ctypes.py", line 53, in __init__
  File "ctypes/__init__.py", line 374, in __init__
OSError: /tmp/_MEIriYKLr/lib/libyara.so: cannot open shared object file: No such file or directory

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "vol.py", line 10, in <module>
  File "volatility3/cli/__init__.py", line 797, in main
  File "volatility3/cli/__init__.py", line 293, in run
  File "volatility3/framework/__init__.py", line 152, in import_files
  File "volatility3/framework/__init__.py", line 184, in import_file
  File "importlib/__init__.py", line 126, in import_module
  File "<frozen importlib._bootstrap>", line 1050, in _gcd_import
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "PyInstaller/loader/pyimod03_importers.py", line 495, in exec_module
  File "volatility3/framework/plugins/yarascan.py", line 17, in <module>
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "PyInstaller/loader/pyimod03_importers.py", line 495, in exec_module
  File "yara/__init__.py", line 7, in <module>
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "PyInstaller/loader/pyimod03_importers.py", line 495, in exec_module
  File "yara/rules.py", line 17, in <module>
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "PyInstaller/loader/pyimod03_importers.py", line 495, in exec_module
  File "yara/libyara_wrapper.py", line 315, in <module>
  File "ctypes/__init__.py", line 452, in LoadLibrary
  File "PyInstaller/loader/pyimod04_ctypes.py", line 55, in __init__
pyimod04_ctypes.install.<locals>.PyInstallerImportError: Failed to load dynlib/dll '/tmp/_MEIriYKLr/lib/libyara.so'. Most likely this dynlib/dll was not found when the application was frozen.
[3089830] Failed to execute script 'vol' due to unhandled exception!

[ikelos]

That seems better, but still not there. The output I got from the PYTHONPATH method is:

136 INFO: PyInstaller: 5.8.0
136 INFO: Python: 3.10.10
137 INFO: Platform: Linux-6.1.12-x86_64-x86_64-Intel-R-_Core-TM-_i7-6700K_CPU_@_4.00GHz-with-glibc2.36
138 INFO: UPX is not available.
2035 INFO: Extending PYTHONPATH with paths
['/home/mike/tmp/volatility3']
2487 INFO: checking Analysis
2487 INFO: Building Analysis because Analysis-00.toc is non existent
2487 INFO: Initializing module dependency graph...
2488 INFO: Caching module graph hooks...
2492 WARNING: Several hooks defined for module 'yt_dlp'. Please take care they do not conflict.
2493 WARNING: Several hooks defined for module 'numpy'. Please take care they do not conflict.
2496 INFO: Analyzing base_library.zip ...
3164 INFO: Loading module hook 'hook-heapq.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
3248 INFO: Loading module hook 'hook-encodings.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
4352 INFO: Loading module hook 'hook-pickle.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
5756 INFO: Caching module dependency graph...
5866 INFO: running Analysis Analysis-00.toc
5877 INFO: Analyzing /home/mike/tmp/volatility3/vol.py
6183 INFO: Loading module hook 'hook-multiprocessing.util.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
6294 INFO: Loading module hook 'hook-xml.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
6693 INFO: Loading module hook 'hook-platform.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
6731 INFO: Processing pre-find module path hook distutils from '/usr/lib/python3.10/site-packages/PyInstaller/hooks/pre_find_module_path/hook-distutils.py'.
6878 INFO: Loading module hook 'hook-distutils.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
6901 INFO: Loading module hook 'hook-sysconfig.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
7009 INFO: Loading module hook 'hook-pkg_resources.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
7543 INFO: Loading module hook 'hook-jaraco.text.py' from '/usr/lib/python3.10/site-packages/_pyinstaller_hooks_contrib/hooks/stdhooks'...
7715 INFO: Loading module hook 'hook-platformdirs.py' from '/usr/lib/python3.10/site-packages/_pyinstaller_hooks_contrib/hooks/stdhooks'...
8320 INFO: Loading module hook 'hook-magic.py' from '/usr/lib/python3.10/site-packages/_pyinstaller_hooks_contrib/hooks/stdhooks'...
8320 WARNING: collect_data_files - skipping data collection for module 'magic' as it is not a package.
8320 WARNING: collect_dynamic_libs - skipping library collection for module 'magic' as it is not a package.
8322 INFO: Analyzing hidden import 'volatility3.framework.automagic.linux'
8355 INFO: Loading module hook 'hook-sqlite3.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
8566 INFO: Loading module hook 'hook-jsonschema.py' from '/usr/lib/python3.10/site-packages/_pyinstaller_hooks_contrib/hooks/stdhooks'...
9059 INFO: Loading module hook 'hook-regex.py' from '/usr/lib/python3.10/site-packages/_pyinstaller_hooks_contrib/hooks/stdhooks'...
9474 INFO: Processing pre-safe import module hook six.moves from '/usr/lib/python3.10/site-packages/PyInstaller/hooks/pre_safe_import_module/hook-six.moves.py'.
10793 INFO: Loading module hook 'hook-charset_normalizer.py' from '/usr/lib/python3.10/site-packages/_pyinstaller_hooks_contrib/hooks/stdhooks'...
10969 INFO: Loading module hook 'hook-cryptography.py' from '/usr/lib/python3.10/site-packages/_pyinstaller_hooks_contrib/hooks/stdhooks'...
12122 INFO: Loading module hook 'hook-certifi.py' from '/usr/lib/python3.10/site-packages/_pyinstaller_hooks_contrib/hooks/stdhooks'...
12387 INFO: Analyzing hidden import 'volatility3.framework.automagic.mac'
12449 INFO: Analyzing hidden import 'volatility3.framework.automagic.module'
12451 INFO: Analyzing hidden import 'volatility3.framework.automagic.pdbscan'
12796 INFO: Analyzing hidden import 'volatility3.framework.automagic.windows'
12805 INFO: Analyzing hidden import 'volatility3.framework.plugins.banners'
12807 INFO: Analyzing hidden import 'volatility3.framework.plugins.configwriter'
12809 INFO: Analyzing hidden import 'volatility3.framework.plugins.frameworkinfo'
12810 INFO: Analyzing hidden import 'volatility3.framework.plugins.isfinfo'
12815 INFO: Analyzing hidden import 'volatility3.framework.plugins.layerwriter'
12818 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux'
12836 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.bash'
12860 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.check_afinfo'
12863 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.check_creds'
12865 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.check_idt'
12868 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.check_modules'
12871 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.check_syscall'
12875 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.elfs'
12878 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.keyboard_notifiers'
12880 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.kmsg'
12889 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.lsmod'
12891 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.lsof'
12895 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.malfind'
12897 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.mountinfo'
12903 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.proc'
12905 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.psaux'
12908 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.pslist'
12912 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.psscan'
12915 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.pstree'
12917 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.sockstat'
12931 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.tty_check'
12933 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac'
12952 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.bash'
12974 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.check_syscall'
12977 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.check_sysctl'
12981 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.check_trap_table'
12984 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.ifconfig'
12986 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.kauth_listeners'
12988 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.kauth_scopes'
12991 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.kevents'
12996 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.list_files'
13001 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.lsmod'
13003 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.lsof'
13005 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.malfind'
13008 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.mount'
13010 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.netstat'
13013 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.proc_maps'
13015 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.psaux'
13019 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.pslist'
13025 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.pstree'
13028 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.socket_filters'
13030 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.timers'
13033 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.trustedbsd'
13036 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.vfsevents'
13038 INFO: Analyzing hidden import 'volatility3.framework.plugins.timeliner'
13046 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows'
13064 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.bigpools'
13072 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.cachedump'
13114 INFO: Loading module hook 'hook-Crypto.py' from '/usr/lib/python3.10/site-packages/_pyinstaller_hooks_contrib/hooks/stdhooks'...
13430 INFO: Loading module hook 'hook-pycparser.py' from '/usr/lib/python3.10/site-packages/_pyinstaller_hooks_contrib/hooks/stdhooks'...
13850 INFO: Loading module hook 'hook-distutils.util.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
14016 INFO: Loading module hook 'hook-setuptools.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
14721 INFO: Loading module hook 'hook-packaging.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
15814 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.callbacks'
15823 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.cmdline'
15825 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.crashinfo'
15839 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.devicetree'
15843 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.dlllist'
15848 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.driverirp'
15851 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.drivermodule'
15853 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.driverscan'
15856 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.dumpfiles'
15863 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.envars'
15868 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.filescan'
15870 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.getservicesids'
15873 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.getsids'
15879 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.handles'
15887 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.hashdump'
15902 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.info'
15908 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.joblinks'
15911 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.ldrmodules'
15914 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.lsadump'
15920 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.malfind'
15925 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.mbrscan'
15955 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.memmap'
15959 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.mftscan'
15965 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.modscan'
15970 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.modules'
15975 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.mutantscan'
15977 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.netscan'
15995 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.netstat'
16007 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.poolscanner'
16017 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.privileges'
16022 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.pslist'
16028 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.psscan'
16036 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.pstree'
16040 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.registry'
16059 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.registry.hivelist'
16066 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.registry.hivescan'
16069 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.registry.printkey'
16076 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.registry.userassist'
16084 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.sessions'
16087 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.skeleton_key_check'
16098 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.ssdt'
16102 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.strings'
16108 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.svcscan'
16119 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.symlinkscan'
16121 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.vadinfo'
16127 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.vadwalk'
16129 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.vadyarascan'
16132 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.verinfo'
16138 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.virtmap'
16143 INFO: Analyzing hidden import 'volatility3.framework.plugins.yarascan'
16148 INFO: Processing module hooks...
16150 WARNING: Hidden import "charset_normalizer.md__mypyc" not found!
16253 INFO: Loading module hook 'hook-setuptools.msvc.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
16357 INFO: Loading module hook 'hook-difflib.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
16981 INFO: Loading module hook 'hook-docutils.py' from '/usr/lib/python3.10/site-packages/_pyinstaller_hooks_contrib/hooks/stdhooks'...
18113 INFO: Loading module hook 'hook-xml.dom.domreg.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
18424 INFO: Loading module hook 'hook-pygments.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
19475 WARNING: Hidden import "pkg_resources._vendor.jaraco.functools" not found!
19475 WARNING: Hidden import "pkg_resources._vendor.jaraco.context" not found!
19475 WARNING: Hidden import "pkg_resources._vendor.jaraco.text" not found!
19584 INFO: Loading module hook 'hook-PIL.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
19647 INFO: Loading module hook 'hook-PIL.Image.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
20101 INFO: Loading module hook 'hook-numpy.py' from '/usr/lib/python3.10/site-packages/numpy/_pyinstaller'...
20449 INFO: Loading module hook 'hook-numpy._pytesttester.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
21153 INFO: Loading module hook 'hook-xml.etree.cElementTree.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
22025 INFO: Loading module hook 'hook-PIL.ImageFilter.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
24663 INFO: Loading module hook 'hook-PIL.SpiderImagePlugin.py' from '/usr/lib/python3.10/site-packages/PyInstaller/hooks'...
24729 INFO: Looking for ctypes DLLs
24780 WARNING: Library user32 required via ctypes not found
24812 INFO: Analyzing run-time hooks ...
24822 INFO: Including run-time hook '/usr/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_inspect.py'
24824 INFO: Including run-time hook '/usr/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_pkgutil.py'
24825 INFO: Including run-time hook '/usr/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_multiprocessing.py'
24828 INFO: Including run-time hook '/usr/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_pkgres.py'
24837 INFO: Including run-time hook '/usr/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_setuptools.py'
24882 INFO: Looking for dynamic libraries
/usr/lib/python3.10/site-packages/PyInstaller/building/build_main.py:175: UserWarning: The numpy.array_api submodule is still experimental. See NEP 47.
  __import__(package)
ldd: warning: you do not have execution permission for `/usr/lib/gcc/x86_64-pc-linux-gnu/12/libgcc_s.so.1'
26631 INFO: Looking for eggs
26631 INFO: Using Python library /usr/lib64/libpython3.10.so.1.0
26645 INFO: Warnings written to /home/mike/tmp/volatility3/build/vol/warn-vol.txt
26770 INFO: Graph cross-reference written to /home/mike/tmp/volatility3/build/vol/xref-vol.html
26802 INFO: Appending 'binaries' from .spec
26803 INFO: Appending 'datas' from .spec
26819 INFO: checking PYZ
26819 INFO: Building PYZ because PYZ-00.toc is non existent
26819 INFO: Building PYZ (ZlibArchive) /home/mike/tmp/volatility3/build/vol/PYZ-00.pyz
28006 INFO: Building PYZ (ZlibArchive) /home/mike/tmp/volatility3/build/vol/PYZ-00.pyz completed successfully.
28031 WARNING: Ignoring icon; supported only on Windows and macOS!
28032 INFO: checking PKG
28032 INFO: Building PKG because PKG-00.toc is non existent
28032 INFO: Building PKG (CArchive) vol.pkg

As you can see from my output our responses start to differ where the import warning kicks in, and I don't have the issue with the warning for importing volatility.framework.plugins. I know a long time ago we needed to put in special provisions for handling that, but I couldn't see it quickly in the code. To make sure we're both working from the same page, please could you attach your output from the PYTHONPATH="." method with pyinstaller 5.8.0?

[ikelos]

Oh yeah, there it is, we explicitly have code to avoid throwing that warning with pyinstaller...

https://github.com/volatilityfoundation/volatility3/blob/develop/volatility3/__init__.py#L42

[asterictnl-lvdw]

What is the equivalent for PYTHONPATH="." on Windows, because I assume this is for Linux?\ @ikelos @lic-8

~ LvdW

PS: When I compile with set PYTHONPATH="."; pyinstaller vol.spec I get the issue with the plugins not found, because they are gathered either externally or with the -p parameter. When I copy the plugins folder in the framework folder I do not get all the plugins there. When I do try to run the available plugins they do work so that is good.

~LvdW

[ikelos]

What is the equivalent for PYTHONPATH="." on Windows, because I assume this is for Linux?

This is setting an environment variable, and I believe it should work for windows as well?

I get the issue with the plugins not found, because they are gathered either externally or with the -p parameter.

The installer will only package the core plugins, if you have external plugins they can still be passed using -p to the volatility executable, or you should be able to put them under the directory that the executable runs in (so for example, if the executable is in C:\place\vol.exe, C:\place\plugins\ will get check for plugins and C:\place\symbols will get checked for symbols).

[asterictnl-lvdw]

What is the equivalent for PYTHONPATH="." on Windows, because I assume this is for Linux?

This I have solved with set PYTHONPATH="."; pyinstaller vol.spec

This is setting an environment variable, and I believe it should work for windows as well?

See above command for PowerShell / CMD that works

The installer will only package the core plugins, if you have external plugins they can still be passed using -p to the volatility executable, or you should be able to put them under the directory that the executable runs in (so for example, if the executable is in C:\place\vol.exe, C:\place\plugins\ will get check for plugins and C:\place\symbols will get checked for symbols).

I have done this by passing -p but I still do not get all the plugins. I have copied the framework\plugins folder to there, but it only detects the following plugins:

volatility: error: argument plugin: invalid choice windows.info.Info (choose from configwriter.ConfigWriter, frameworkinfo.FrameworkInfo, layerwriter.LayerWriter, linux.check_afinfo.Check_afinfo, linux.check_syscall.Check_syscall, timeliner.Timeliner)

So only some linux plugins and some other plugins are available in Standalone.

@ikelos

[lic-8]

To make sure we're both working from the same page, please could you attach your output from the PYTHONPATH="." method with pyinstaller 5.8.0?

Sure:

[ pikachu ] dist (develop) $
    > pyinstaller -v
5.8.0

[ pikachu ] volatility3 (develop) $
    > ls
API_CHANGES.md  doc          __pycache__               requirements.txt  vol.py
build           LICENSE.txt  README.md                 setup.py          volshell.py
development     MANIFEST.in  requirements-dev.txt      test              volshell.spec
dist            mypy.ini     requirements-minimal.txt  volatility3       vol.spec

[ pikachu ] volatility3 (develop) $
    > PYTHONPATH="." pyinstaller vol.spec
170 INFO: PyInstaller: 5.8.0
170 INFO: Python: 3.10.6
171 INFO: Platform: Linux-5.19.0-32-generic-x86_64-with-glibc2.35
173 INFO: UPX is not available.
1999 INFO: Extending PYTHONPATH with paths
['/home/pikachu/volatility3']
2425 INFO: checking Analysis
2429 INFO: Building because Analysis-00.toc is bad
2429 INFO: Initializing module dependency graph...
2430 INFO: Caching module graph hooks...
2435 WARNING: Several hooks defined for module 'numpy'. Please take care they do not conflict.
2438 INFO: Analyzing base_library.zip ...
3156 INFO: Loading module hook 'hook-encodings.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
3877 INFO: Loading module hook 'hook-pickle.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
5395 INFO: Loading module hook 'hook-heapq.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
5934 INFO: Caching module dependency graph...
6034 INFO: running Analysis Analysis-00.toc
6064 INFO: Analyzing /home/pikachu/volatility3/vol.py
6445 INFO: Loading module hook 'hook-multiprocessing.util.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
6580 INFO: Loading module hook 'hook-xml.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
7028 INFO: Loading module hook 'hook-platform.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
7043 INFO: Processing pre-find module path hook distutils from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks/pre_find_module_path/hook-distutils.py'.
7068 INFO: Loading module hook 'hook-distutils.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
7092 INFO: Loading module hook 'hook-sysconfig.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
7202 INFO: Loading module hook 'hook-pkg_resources.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
8166 INFO: Analyzing hidden import 'volatility3.framework.automagic.linux'
8206 INFO: Loading module hook 'hook-sqlite3.py' from '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks'...
8692 INFO: Analyzing hidden import 'volatility3.framework.automagic.mac'
8816 INFO: Analyzing hidden import 'volatility3.framework.automagic.module'
8817 INFO: Analyzing hidden import 'volatility3.framework.automagic.pdbscan'
9195 INFO: Analyzing hidden import 'volatility3.framework.automagic.windows'
9204 INFO: Analyzing hidden import 'volatility3.framework.plugins.banners'
9206 INFO: Analyzing hidden import 'volatility3.framework.plugins.configwriter'
9208 INFO: Analyzing hidden import 'volatility3.framework.plugins.frameworkinfo'
9210 INFO: Analyzing hidden import 'volatility3.framework.plugins.isfinfo'
9214 INFO: Analyzing hidden import 'volatility3.framework.plugins.layerwriter'
9218 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux'
9243 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.bash'
9275 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.check_afinfo'
9278 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.check_creds'
9280 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.check_idt'
9283 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.check_modules'
9285 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.check_syscall'
9290 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.elfs'
9292 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.keyboard_notifiers'
9295 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.kmsg'
9303 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.lsmod'
9305 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.lsof'
9308 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.malfind'
9311 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.mountinfo'
9316 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.proc'
9319 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.psaux'
9321 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.pslist'
9325 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.psscan'
9328 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.pstree'
9330 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.sockstat'
9342 INFO: Analyzing hidden import 'volatility3.framework.plugins.linux.tty_check'
9345 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac'
9370 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.bash'
9399 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.check_syscall'
9402 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.check_sysctl'
9406 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.check_trap_table'
9408 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.ifconfig'
9410 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.kauth_listeners'
9413 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.kauth_scopes'
9415 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.kevents'
9420 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.list_files'
9424 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.lsmod'
9427 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.lsof'
9429 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.malfind'
9431 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.mount'
9433 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.netstat'
9437 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.proc_maps'
9439 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.psaux'
9442 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.pslist'
9448 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.pstree'
9451 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.socket_filters'
9453 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.timers'
9456 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.trustedbsd'
9459 INFO: Analyzing hidden import 'volatility3.framework.plugins.mac.vfsevents'
9461 INFO: Analyzing hidden import 'volatility3.framework.plugins.timeliner'
9468 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows'
9493 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.bigpools'
9500 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.cachedump'
9555 INFO: Loading module hook 'hook-Crypto.py' from '/home/pikachu/.local/lib/python3.10/site-packages/_pyinstaller_hooks_contrib/hooks/stdhooks'...
9695 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.callbacks'
9703 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.cmdline'
9706 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.crashinfo'
9720 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.devicetree'
9724 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.dlllist'
9729 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.driverirp'
9731 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.drivermodule'
9733 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.driverscan'
9736 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.dumpfiles'
9743 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.envars'
9747 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.filescan'
9749 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.getservicesids'
9752 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.getsids'
9757 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.handles'
9765 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.hashdump'
9777 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.info'
9783 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.joblinks'
9786 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.ldrmodules'
9789 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.lsadump'
9796 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.malfind'
9800 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.mbrscan'
9807 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.memmap'
9810 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.mftscan'
9815 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.modscan'
9820 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.modules'
9824 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.mutantscan'
9826 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.netscan'
9840 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.netstat'
9851 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.poolscanner'
9860 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.privileges'
9863 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.pslist'
9869 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.psscan'
9875 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.pstree'
9879 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.registry'
9904 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.registry.hivelist'
9911 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.registry.hivescan'
9913 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.registry.printkey'
9920 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.registry.userassist'
9927 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.sessions'
9930 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.skeleton_key_check'
9940 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.ssdt'
9943 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.strings'
9948 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.svcscan'
9958 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.symlinkscan'
9960 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.vadinfo'
9966 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.vadwalk'
9968 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.vadyarascan'
9971 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.verinfo'
9977 INFO: Analyzing hidden import 'volatility3.framework.plugins.windows.virtmap'
9981 INFO: Analyzing hidden import 'volatility3.framework.plugins.yarascan'
10037 INFO: Processing module hooks...
10075 INFO: Processing pre-safe import module hook win32com from '/home/pikachu/.local/lib/python3.10/site-packages/_pyinstaller_hooks_contrib/hooks/pre_safe_import_module/hook-win32com.py'.
10669 INFO: Looking for ctypes DLLs
10686 INFO: Analyzing run-time hooks ...
10689 INFO: Including run-time hook '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_inspect.py'
10690 INFO: Including run-time hook '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_pkgutil.py'
10692 INFO: Including run-time hook '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_multiprocessing.py'
10694 INFO: Including run-time hook '/home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/hooks/rthooks/pyi_rth_pkgres.py'
10706 INFO: Looking for dynamic libraries
Failed to import '/usr/lib/libyara.so'
PATH = /home/pikachu/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin:/usr/local/go/bin:/usr/local/go/bin:/home/pikachu/go/bin:/usr/local/go/bin:/home/pikachu/go/bin;/usr/lib
11374 INFO: Looking for eggs
11374 INFO: Python library not among binary dependencies. Performing additional search...
11396 INFO: Using Python library /lib/x86_64-linux-gnu/libpython3.10.so.1.0
11401 INFO: Warnings written to /home/pikachu/volatility3/build/vol/warn-vol.txt
11437 INFO: Graph cross-reference written to /home/pikachu/volatility3/build/vol/xref-vol.html
11446 INFO: Appending 'binaries' from .spec
11446 INFO: Appending 'datas' from .spec
11456 INFO: checking PYZ
11459 INFO: Building because toc changed
11459 INFO: Building PYZ (ZlibArchive) /home/pikachu/volatility3/build/vol/PYZ-00.pyz
11907 INFO: Building PYZ (ZlibArchive) /home/pikachu/volatility3/build/vol/PYZ-00.pyz completed successfully.
11914 WARNING: Ignoring icon; supported only on Windows and macOS!
11915 INFO: checking PKG
11918 INFO: Building because toc changed
11918 INFO: Building PKG (CArchive) vol.pkg
16193 INFO: Building PKG (CArchive) vol.pkg completed successfully.
16199 INFO: Bootloader /home/pikachu/.local/lib/python3.10/site-packages/PyInstaller/bootloader/Linux-64bit-intel/run
16199 INFO: checking EXE
16201 INFO: Rebuilding EXE-00.toc because vol missing
16201 INFO: Building EXE from EXE-00.toc
16201 INFO: Copying bootloader EXE to /home/pikachu/volatility3/dist/vol
16201 INFO: Appending PKG archive to custom ELF section in EXE
16253 INFO: Building EXE from EXE-00.toc completed successfully.

[ pikachu ] volatility3 (develop) $
    > cd dist

[ pikachu ] dist (develop) $
    > ./vol -h
Volatility 3 Framework 2.4.1
Failed to import '/tmp/_MEIP8EIDz/lib/libyara.so'
PATH = /home/pikachu/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin:/usr/local/go/bin:/usr/local/go/bin:/home/pikachu/go/bin:/usr/local/go/bin:/home/pikachu/go/bin;/tmp/_MEIP8EIDz/lib
Traceback (most recent call last):
  File "PyInstaller/loader/pyimod03_ctypes.py", line 53, in __init__
  File "ctypes/__init__.py", line 374, in __init__
OSError: /tmp/_MEIP8EIDz/lib/libyara.so: cannot open shared object file: No such file or directory

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "vol.py", line 10, in <module>
  File "volatility3/cli/__init__.py", line 797, in main
  File "volatility3/cli/__init__.py", line 293, in run
  File "volatility3/framework/__init__.py", line 152, in import_files
  File "volatility3/framework/__init__.py", line 184, in import_file
  File "importlib/__init__.py", line 126, in import_module
  File "<frozen importlib._bootstrap>", line 1050, in _gcd_import
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "PyInstaller/loader/pyimod02_importers.py", line 352, in exec_module
  File "volatility3/framework/plugins/yarascan.py", line 17, in <module>
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "PyInstaller/loader/pyimod02_importers.py", line 352, in exec_module
  File "yara/__init__.py", line 7, in <module>
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "PyInstaller/loader/pyimod02_importers.py", line 352, in exec_module
  File "yara/rules.py", line 17, in <module>
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "PyInstaller/loader/pyimod02_importers.py", line 352, in exec_module
  File "yara/libyara_wrapper.py", line 315, in <module>
  File "ctypes/__init__.py", line 452, in LoadLibrary
  File "PyInstaller/loader/pyimod03_ctypes.py", line 55, in __init__
pyimod03_ctypes.install.<locals>.PyInstallerImportError: Failed to load dynlib/dll '/tmp/_MEIP8EIDz/lib/libyara.so'. Most likely this dynlib/dll was not found when the application was frozen.
[3218508] Failed to execute script 'vol' due to unhandled exception!

[lic-8]

Just to make sure I get this right, it is possible to compile volatility so it can run on a "brand new" machine on which python, symbols and volatility were never installed ?

[ikelos]

Correct, but without a symbol pack (.zip file) or an internet connection, it won't have any symbols and will be useless. Even if it has an internet connection, unless you provide it a symbol pack, it will only analyze windows images (which it can download and generate symbols for itself).

There is no need for python and no need for volatility, it should only require standard libraries.

Referring back to your output, can you please ensure you have yara installed and functioning correctly? You output from pyinstaller shows that it is trying to find libyara, but cannot:

10706 INFO: Looking for dynamic libraries
Failed to import '/usr/lib/libyara.so'

Please make sure you local python installation (on the box to run pyinstaller) has yara and yara-python correctly installed and functioning.

[asterictnl-lvdw]

@lic-8

Try to add and replace to the vol.spec:

Would be for me now at line 21 - 25 and line 27 and run the pyinstaller again.

    import capstone
    import yara
    import pefile
    import pycryptodome
    import leechcorepyc

    binaries = collect_dynamic_libs('capstone','yara-python','pefile','pycryptodome','leechcorepyc')

Does not give any error. for me afterwards.

I have the next problem that is correlated to the plugin folder not parsing all plugins.

When running .\vol.exe -f C:\RAM-OUTPUT\windows-2012-memory.mem windows.info -p .\plugins\ windows.info.Info I get the error:

volatility: error: argument plugin: invalid choice windows.info (choose from configwriter.ConfigWriter, frameworkinfo.FrameworkInfo, layerwriter.LayerWriter, linux.check_afinfo.Check_afinfo, linux.check_syscall.Check_syscall, timeliner.Timeliner)

For me I do not have volatility3 installed at the moment nor yara nor the other dependencies.

~ LvdW

PS: I can confirm after uninstalling yara-python the program keeps working when the dynamic library and import is done.

@ikelos

[asterictnl-lvdw]

Update:

Can you also please run the command with -v -vv -vvv -vvvv

.\vol.exe -v -f C:\RAM-OUTPUT\windows-2012-memory.mem -p .\volatility3\framework\plugins\ windows.info.Info .\vol.exe -vv -f C:\RAM-OUTPUT\windows-2012-memory.mem -p .\volatility3\framework\plugins\ windows.info.Info

You will get a lot of debug information about the program. It seems that with the .exe it fails to import a lot of things. and volatility3.framework cannot find Crypto and Yara.

@ikelos and @lic-8

[lic-8]

@ikelos

Correct, but without a symbol pack (.zip file) or an internet connection, it won't have any symbols and will be useless

Isn't it possible to "embed" the all the symbols in the executable ? If yes, how would you do so ?

Also, it seems that I have yara:

[ pikachu ] dist (develop) $
    > pip3 install yara yara-python
Defaulting to user installation because normal site-packages is not writeable
Requirement already satisfied: yara in /home/pikachu/.local/lib/python3.10/site-packages (1.7.7)
Requirement already satisfied: yara-python in /home/pikachu/.local/lib/python3.10/site-packages (4.2.3)

[ pikachu ] dist (develop) $
    > sudo apt-get install yara
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
yara is already the newest version (4.1.3-1build1).
The following packages were automatically installed and are no longer required:
  chromium-codecs-ffmpeg-extra gstreamer1.0-vaapi i965-va-driver intel-media-va-driver libaacs0 libaom3
  libass9 libavcodec58 libavformat58 libavutil56 libbdplus0 libblas3 libbluray2 libbs2b0 libchromaprint1
  libcodec2-1.0 libdav1d5 libflashrom1 libflite1 libftdi1-2 libgme0 libgnome-bg-4-1 libgsm1
  libgstreamer-plugins-bad1.0-0 libigdgmm12 liblilv-0-0 libllvm13 libmfx1 libmysofa1 libnorm1
  libntfs-3g89 libopenmpt0 libpgm-5.3-0 libpostproc55 librabbitmq4 librubberband2 libserd-0-0 libshine3
  libsnappy1v5 libsord-0-0 libsratom-0-0 libsrt1.4-gnutls libssh-gcrypt-4 libswresample3 libswscale5
  libudfread0 libva-drm2 libva-wayland2 libva-x11-2 libva2 libvidstab1.1 libwnck-3-0 libwnck-3-common
  libx265-199 libxres1 libxvidcore4 libzimg2 libzmq5 libzvbi-common libzvbi0 mesa-va-drivers
  pocketsphinx-en-us python3-brlapi python3-louis python3-pyatspi python3-speechd va-driver-all xbrlapi
Use 'sudo apt autoremove' to remove them.
0 upgraded, 0 newly installed, 0 to remove and 21 not upgraded.

[ pikachu ] dist (develop) $
    > sudo apt-get install python3-yara
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages were automatically installed and are no longer required:
  chromium-codecs-ffmpeg-extra gstreamer1.0-vaapi i965-va-driver intel-media-va-driver libaacs0 libaom3
  libass9 libavcodec58 libavformat58 libavutil56 libbdplus0 libblas3 libbluray2 libbs2b0 libchromaprint1
  libcodec2-1.0 libdav1d5 libflashrom1 libflite1 libftdi1-2 libgme0 libgnome-bg-4-1 libgsm1
  libgstreamer-plugins-bad1.0-0 libigdgmm12 liblilv-0-0 libllvm13 libmfx1 libmysofa1 libnorm1
  libntfs-3g89 libopenmpt0 libpgm-5.3-0 libpostproc55 librabbitmq4 librubberband2 libserd-0-0 libshine3
  libsnappy1v5 libsord-0-0 libsratom-0-0 libsrt1.4-gnutls libssh-gcrypt-4 libswresample3 libswscale5
  libudfread0 libva-drm2 libva-wayland2 libva-x11-2 libva2 libvidstab1.1 libwnck-3-0 libwnck-3-common
  libx265-199 libxres1 libxvidcore4 libzimg2 libzmq5 libzvbi-common libzvbi0 mesa-va-drivers
  pocketsphinx-en-us python3-brlapi python3-louis python3-pyatspi python3-speechd va-driver-all xbrlapi
Use 'sudo apt autoremove' to remove them.
The following NEW packages will be installed:
  python3-yara
0 upgraded, 1 newly installed, 0 to remove and 21 not upgraded.
Need to get 17,0 kB of archives.
After this operation, 62,5 kB of additional disk space will be used.
Get:1 http://fr.archive.ubuntu.com/ubuntu jammy/universe amd64 python3-yara amd64 4.0.4-1build4 [17,0 kB]
Fetched 17,0 kB in 0s (57,1 kB/s)       
Selecting previously unselected package python3-yara.
(Reading database ... 332124 files and directories currently installed.)
Preparing to unpack .../python3-yara_4.0.4-1build4_amd64.deb ...
Unpacking python3-yara (4.0.4-1build4) ...
Setting up python3-yara (4.0.4-1build4) ...

But I can't import it:

[ pikachu ] dist (develop) $
    > python3
Python 3.10.6 (main, Nov 14 2022, 16:10:14) [GCC 11.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import yara
Failed to import '/usr/lib/libyara.so'
PATH = /home/pikachu/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin:/usr/local/go/bin:/usr/local/go/bin:/home/pikachu/go/bin:/usr/local/go/bin:/home/pikachu/go/bin;/usr/lib
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/pikachu/.local/lib/python3.10/site-packages/yara/__init__.py", line 7, in <module>
    from yara.rules import compile
  File "/home/pikachu/.local/lib/python3.10/site-packages/yara/rules.py", line 17, in <module>
    from yara.libyara_wrapper import *
  File "/home/pikachu/.local/lib/python3.10/site-packages/yara/libyara_wrapper.py", line 315, in <module>
    libyaradll = cdll.LoadLibrary(library)
  File "/usr/lib/python3.10/ctypes/__init__.py", line 452, in LoadLibrary
    return self._dlltype(name)
  File "/usr/lib/python3.10/ctypes/__init__.py", line 374, in __init__
    self._handle = _dlopen(self._name, mode)
OSError: /usr/lib/libyara.so: cannot open shared object file: No such file or directory

@asterictnl-lvdw I have modified vol.spec accordingly to your advice. Running with -v, -vv, -vvv, -vvvv always gives the same output:

[ pikachu ] dist (develop) $
    > ./vol -h -vvvv
Volatility 3 Framework 2.4.1
INFO     volatility3.cli: Volatility plugins path: ['/home/pikachu/volatility3/dist/plugins', '/tmp/_MEIGM5xv5/volatility3/plugins', '/tmp/_MEIGM5xv5/volatility3/framework/plugins']
INFO     volatility3.cli: Volatility symbols path: ['/home/pikachu/volatility3/dist/symbols', '/tmp/_MEIGM5xv5/volatility3/symbols', '/tmp/_MEIGM5xv5/volatility3/framework/symbols']
Failed to import '/tmp/_MEIGM5xv5/lib/libyara.so'
PATH = /home/pikachu/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin:/usr/local/go/bin:/usr/local/go/bin:/home/pikachu/go/bin:/usr/local/go/bin:/home/pikachu/go/bin;/tmp/_MEIGM5xv5/lib
Traceback (most recent call last):
  File "PyInstaller/loader/pyimod03_ctypes.py", line 53, in __init__
  File "ctypes/__init__.py", line 374, in __init__
OSError: /tmp/_MEIGM5xv5/lib/libyara.so: cannot open shared object file: No such file or directory

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "vol.py", line 10, in <module>
  File "volatility3/cli/__init__.py", line 797, in main
  File "volatility3/cli/__init__.py", line 293, in run
  File "volatility3/framework/__init__.py", line 152, in import_files
  File "volatility3/framework/__init__.py", line 184, in import_file
  File "importlib/__init__.py", line 126, in import_module
  File "<frozen importlib._bootstrap>", line 1050, in _gcd_import
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "PyInstaller/loader/pyimod02_importers.py", line 352, in exec_module
  File "volatility3/framework/plugins/yarascan.py", line 17, in <module>
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "PyInstaller/loader/pyimod02_importers.py", line 352, in exec_module
  File "yara/__init__.py", line 7, in <module>
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "PyInstaller/loader/pyimod02_importers.py", line 352, in exec_module
  File "yara/rules.py", line 17, in <module>
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "PyInstaller/loader/pyimod02_importers.py", line 352, in exec_module
  File "yara/libyara_wrapper.py", line 315, in <module>
  File "ctypes/__init__.py", line 452, in LoadLibrary
  File "PyInstaller/loader/pyimod03_ctypes.py", line 55, in __init__
pyimod03_ctypes.install.<locals>.PyInstallerImportError: Failed to load dynlib/dll '/tmp/_MEIGM5xv5/lib/libyara.so'. Most likely this dynlib/dll was not found when the application was frozen.
[3223223] Failed to execute script 'vol' due to unhandled exception!

[asterictnl-lvdw]

@lic-8 Please uninstall normal yara and only install yara-python

apt remove yara
apt-get install yara-python
pip3 uninstall yara
pip3 install yara-python

[lic-8]

@asterictnl-lvdw This fixes the yara import problem, but I still have the same issue when running ./vol -h

[asterictnl-lvdw]

@asterictnl-lvdw This fixes the yara import problem, but I still have the same issue when running ./vol -h

What error do you get now? Still the yara import problem issue?

[lic-8]

@asterictnl-lvdw By the way, thank you for the time you take to help me

[ pikachu ] dist (develop) $
    > python3
Python 3.10.6 (main, Nov 14 2022, 16:10:14) [GCC 11.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import yara
>>> 
[5]+  Stopped                 python3

[ pikachu ] dist (develop) $
    > ./vol -h -vvvv
Volatility 3 Framework 2.4.1
INFO     volatility3.cli: Volatility plugins path: ['/home/pikachu/volatility3/dist/plugins', '/tmp/_MEI4LrGyp/volatility3/plugins', '/tmp/_MEI4LrGyp/volatility3/framework/plugins']
INFO     volatility3.cli: Volatility symbols path: ['/home/pikachu/volatility3/dist/symbols', '/tmp/_MEI4LrGyp/volatility3/symbols', '/tmp/_MEI4LrGyp/volatility3/framework/symbols']
Failed to import '/tmp/_MEI4LrGyp/lib/libyara.so'
PATH = /home/pikachu/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin:/usr/local/go/bin:/usr/local/go/bin:/home/pikachu/go/bin:/usr/local/go/bin:/home/pikachu/go/bin;/tmp/_MEI4LrGyp/lib
Traceback (most recent call last):
  File "PyInstaller/loader/pyimod03_ctypes.py", line 53, in __init__
  File "ctypes/__init__.py", line 374, in __init__
OSError: /tmp/_MEI4LrGyp/lib/libyara.so: cannot open shared object file: No such file or directory

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "vol.py", line 10, in <module>
  File "volatility3/cli/__init__.py", line 797, in main
  File "volatility3/cli/__init__.py", line 293, in run
  File "volatility3/framework/__init__.py", line 152, in import_files
  File "volatility3/framework/__init__.py", line 184, in import_file
  File "importlib/__init__.py", line 126, in import_module
  File "<frozen importlib._bootstrap>", line 1050, in _gcd_import
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "PyInstaller/loader/pyimod02_importers.py", line 352, in exec_module
  File "volatility3/framework/plugins/yarascan.py", line 17, in <module>
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "PyInstaller/loader/pyimod02_importers.py", line 352, in exec_module
  File "yara/__init__.py", line 7, in <module>
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "PyInstaller/loader/pyimod02_importers.py", line 352, in exec_module
  File "yara/rules.py", line 17, in <module>
  File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
  File "PyInstaller/loader/pyimod02_importers.py", line 352, in exec_module
  File "yara/libyara_wrapper.py", line 315, in <module>
  File "ctypes/__init__.py", line 452, in LoadLibrary
  File "PyInstaller/loader/pyimod03_ctypes.py", line 55, in __init__
pyimod03_ctypes.install.<locals>.PyInstallerImportError: Failed to load dynlib/dll '/tmp/_MEI4LrGyp/lib/libyara.so'. Most likely this dynlib/dll was not found when the application was frozen.
[3224066] Failed to execute script 'vol' due to unhandled exception!

[asterictnl-lvdw]

Please do the following: Uninstall all yara libraries

1. apt remove yara
2. apt remove yara-python
3. pip3 uninstall yara
4. pip3 uninstall yara-python Add the yara import to the .spec file or install yara-python with apt install yara-python or pip3 install yara-python Remove the binary file and rebuild it with pyinstaller: PYTHONPATH="." pyinstaller vol.spec (Linux) or set PYTHONPATH="."; pyinstaller vol.spec (Windows)
5. Try again with ./vol -h @lic-8

[lic-8]

My bad, I forgot to re-run pyinstaller 😣It works since I have removed "yara" and installed "yara-python". So much shame on me. Thank you very much for your kind help !

[asterictnl-lvdw]

@lic-8

No problem, try to run ./vol and see how many plugins you get. Do you get the same results?

~ LvdW

[ikelos]

Isn't it possible to "embed" the all the symbols in the executable ? If yes, how would you do so ?

Yes, probably but this isn't something we've made provision for, since it's unlikely you'll ever have a complete library for all windows systems and certainly not for linux. The zip symbol pack files would be an easier way to provision the symbol files, they'll just need to live in a subdirectory.

@asterictnl-lvdw Sorry, this issue feels like it got slightly co-opted, are you still having difficulties or have you gotten what you needed to working?

@lic-8 I'm glad your issue has been resolve. For problems like this that have back and forth and need questions and responses, please could I ask that you use our slack server, so that we don't lose track of other people's original issues (or create your own issue so that we don't cross conversations that turn out to be unrelated).

[asterictnl-lvdw]

Hello @ikelos ,

My issue with the normal application has been resolved. I have written an instruction on how to properly build the executable when Volatility3 installed by pip3 install .

But now I want to use it standalone as well without installation of python, but I need to import the libraries properly. It seems there might be some issues with some of the plugins as they are unable to be imported. I have ran the -v and -vv to check what the problems are.

I have attached the file below:

consoleoutput.txt

Let me know if this is something helpful.

~ LvdW

[ikelos]

You can create an executable (from a system that has volatility and python installed) that can then be taken to another system without python.

The output you provided looks very strange, was this created from the vol.spec provided in the standard release? It appears to be missing a number of subsidiary parts (the scanners directory or the layers such as the intel layer) but only contains the package top level files. It's very difficult to tell what's going on from that, and I'd need the output from running the pyinstaller file to create the executable to tell what's going on.

Thank you for linking a file with the output, hopefully it will keep the length of the issue to a more manageable level. 5:)

[asterictnl-lvdw]

@ikelos

The above I understand. And no I haven't changed anything. What I did is the following:

• Installed the required libraries on the host computer where the .exe will be compiled
• Run set PYTHONPATH="."; pyinstaller vol.spec into the folder and compile
• The file would be aprox. 10.6MB in size.
• I have made a copy of the /framework/plugins folder
• Run .\vol.exe -vv -f C:\RAM-OUTPUT\windows-2012-memory.mem -p .\volatility3\framework\plugins\ windows.info.Info (You can remove -vv if you do not want verbose) Getting the debug message and error that the plugin is not loaded, thus an error from volatility that the plugin is not found and that only some plugins are found:

volatility: error: argument plugin: invalid choice windows.info (choose from configwriter.ConfigWriter, frameworkinfo.FrameworkInfo, layerwriter.LayerWriter, linux.check_afinfo.Check_afinfo, linux.check_syscall.Check_syscall, timeliner.Timeliner)

[ikelos]

• I have made a copy of the /framework/plugins folder

This shouldn't be necessary, the framework/plugins should be included automatically. If they're not, then there's a problem with pyinstaller or the spec file. If you can provide the output from pyinstaller vol.spec then we can check to see where it goes wrong. 5:)

[asterictnl-lvdw]

@ikelos

I will describe the situation for you. It didn't matter for me if I used the edited version of vol.spec which included the yara or the standard one.

This is what I did:

• Install all the dependencies except for snappy
• Use: set PYTHONPATH="."; pyinstaller vol.spec
• Run .\vol.exe -vv -f C:\RAM-OUTPUT\windows-2012-memory.mem -p .\volatility3\framework\plugins\ windows.info.Info

  I did NOT run pip3 install . or python3 setup.py install at all

  If you have volatility3 installed you can simply uninstall it by pip3 uninstall volatility3

The output of the regular vol.spec is listed below: pyinstalleroutput.txt The output of the warn.log is listed below: warn-vol.txt

Let me know if this is anything you need.

~ LvdW

[asterictnl-lvdw]

Ok, I have found out how it works now.

I have forgotten to install volatility3 before buildling the .exe. After that I can safely delete volatility3 again.

~ LvdW

[asterictnl-lvdw]

How to Compile Standalone Windows Version of Volatility 3

Works with Python 3.11 and build with the latest pyinstaller 5.0.8!

• Modify the requirements.txt file and remove snappy-python, because it does not work on Windows
• Run pip3 install -r requirements.txt to install the dependencies
• Install Volatility3 by using pip3 install . or python3 setup.py install
• Build the executable by using set PYTHONPATH="."; pyinstaller vol.spec
• Check in the dist folder and run vol.exe -vv -f <yourfile>.mem windows.info.Info to check if the command succesfully runs
• Now you can safely uninstall all dependencies and volatility3 by running pip3 uninstall volatility3

~LvdW

[ikelos]

Hi @asterictnl-lvdw!

I'm very glad you managed to get it all installed. It should be able to install from the local directory (that's what the PYTHONPATH is there for, it could be that the set command doesn't persist the environment variable properly), but regardless you seem to have it working now. I'll leave this issue open as I think the initial request of the bug was to produce a standalone executable for windows as part of the release process. We can close this off once that's done...

[lic-9]

Hello , any idea why I cannot produce an executable with all the plugins ?

[ikelos]

Hello , any idea why I cannot produce an executable with all the plugins ?

@lic-9 Please don't cross-post on issues. You filed a new issue (#919), it will get answered, github already creates a link between the two issues, so adding questions like this creates extra work for everyone trying to figure out whether you're discussing this issue or the new one you just filed. It's not going to get you an answer more quickly, if anything it's going to do the opposite. You'll get the fastest answers on slack, please be patient.

[github-actions[bot]]

This issue is stale because it has been open for 200 days with no activity.

[github-actions[bot]]

This issue was closed because it has been inactive for 60 days since being marked as stale.

[tmechen]

pls reopen

[ikelos]

@npetroni could we look into producing a pyinstaller exe of this as part of the build process please? I don't know if we should have it actually run to test that it worked, but it might be wise just to spot obvious errors? We could then start distributing it (although before we do that we may need to consider how many "I can't do..." bugs might get filed if we do)...

[ikelos]

@npetroni I've thrown together a testing branch, but I dunno how to get it to fire to test it out, other than jiggering the constraints on the tasks...

1111