@@ -14,10 +14,33 @@ technical and performance challenges associated with the original
1414code base that became apparent over the previous 10 years. Another benefit
1515of the rewrite is that Volatility 3 could be released under a custom
1616license that was more aligned with the goals of the Volatility community,
17- the Volatility Software License (VSL). See the
18- [ LICENSE] ( https://www.volatilityfoundation.org/license/vsl-v1.0 ) file for
17+ the Volatility Software License (VSL). See the
18+ [ LICENSE] ( https://www.volatilityfoundation.org/license/vsl-v1.0 ) file for
1919more details.
2020
21+ ## Quick Start
22+
23+ 1 . Install the required dependencies:
24+
25+ ``` shell
26+ pip install --user -e " .[full]"
27+ ```
28+
29+ 2. See available options:
30+
31+ ` ` ` shell
32+ vol -h
33+ ` ` `
34+
35+ 3. To get more information on a Windows memory sample and to make sure Volatility supports that sample type, run ` vol -f < imagepath> windows.info` :
36+
37+ ` ` ` shell
38+ vol -f /home/user/samples/stuxnet.vmem windows.info
39+ ` ` `
40+
41+ 4. Run some other plugins. The ` -f` or ` --single-location` is not strictly required, but most plugins expect a single sample.
42+ Some also require/accept other options. Run ` vol < plugin> -h` for more information on a particular command.
43+
2144# # Installing
2245
2346Volatility 3 requires Python 3.8.0 or later and is published on the [PyPi registry](https://pypi.org/project/volatility3).
@@ -38,38 +61,19 @@ python3 -m venv venv && . venv/bin/activate
3861pip install -e " .[dev]"
3962` ` `
4063
41- ## Quick Start
42-
43- 1 . Install Volatility 3 as documented in the Installing section of the readme.
44-
45- 2 . See available options:
46-
47- ``` shell
48- vol -h
49- ```
50-
51- 3. To get more information on a Windows memory sample and to make sure Volatility supports that sample type, run ` vol -f < imagepath> windows.info` :
52-
53- ` ` ` shell
54- vol -f /home/user/samples/stuxnet.vmem windows.info
55- ` ` `
56-
57- 4. Run some other plugins. The ` -f` or ` --single-location` is not strictly required, but most plugins expect a single sample.
58- Some also require/accept other options. Run ` vol < plugin> -h` for more information on a particular command.
59-
6064# # Symbol Tables
6165
6266Symbol table packs for the various operating systems are available for download at:
6367
64- < https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip>
65- < https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip>
66- < https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip>
68+ < https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip>
69+ < https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip>
70+ < https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip>
6771
6872The hashes to verify whether any of the symbol pack files have downloaded successfully or have changed can be found at:
6973
70- < https://downloads.volatilityfoundation.org/volatility3/symbols/SHA256SUMS>
71- < https://downloads.volatilityfoundation.org/volatility3/symbols/SHA1SUMS>
72- < https://downloads.volatilityfoundation.org/volatility3/symbols/MD5SUMS>
74+ < https://downloads.volatilityfoundation.org/volatility3/symbols/SHA256SUMS>
75+ < https://downloads.volatilityfoundation.org/volatility3/symbols/SHA1SUMS>
76+ < https://downloads.volatilityfoundation.org/volatility3/symbols/MD5SUMS>
7377
7478Symbol tables zip files must be placed, as named, into the ` volatility3/symbols` directory (or just the symbols directory next to the executable file).
7579
0 commit comments