-
Notifications
You must be signed in to change notification settings - Fork 581
Open
Description
Describe the bug
Attempting to run volatility3 with pypy3 raises KeyError "NamedTuple does not have key: 0"
Context
Volatility Version: Volatility 3 Framework 2.26.2
Operating System: Linux Debian 13 x86-64
Python Version: Python 3.11.11 (7.3.19+dfsg-2, Apr 11 2025, 02:57:20) [PyPy 7.3.19 with GCC 14.2.0]
Suspected Operating System: Windows Image
Command: vol.py -f windows.info.Info
Command: vol.py -f windows.vadyarascanner.VadYaraScanner
To Reproduce
Steps to reproduce the behavior:
- Clone repo
- create venv with
pypy3 -m venv venv
- load venv
. ./venv/bin/activate
- Install deps with `pypy3 -m pip install -e ".[full]"
- Run commands above
Expected behavior
Normal volatility behaviour
Example output
Volatility 3 Framework 2.26.2
Progress: 100.00 PDB scanning finished
Variable Value
Traceback (most recent call last):
File "/home/david/Projects/volatility3/vol.py", line 11, in <module>
volatility3.cli.main()
File "/home/david/Projects/volatility3/volatility3/cli/__init__.py", line 927, in main
CommandLine().run()
File "/home/david/Projects/volatility3/volatility3/cli/__init__.py", line 515, in run
renderer.render(grid)
File "/home/david/Projects/volatility3/volatility3/cli/text_renderer.py", line 330, in render
grid.populate(visitor, outfd)
File "/home/david/Projects/volatility3/volatility3/framework/renderers/__init__.py", line 317, in populate
for level, item in self._generator:
File "/home/david/Projects/volatility3/volatility3/framework/plugins/windows/info.py", line 196, in _generator
kdbg =
^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/david/Projects/volatility3/volatility3/framework/plugins/windows/info.py", line 103, in get_kdbg_structure
kdbg_obj =
^^^^^^^^^^^^^^^
File "/home/david/Projects/volatility3/volatility3/framework/contexts/__init__.py", line 128, in object
return
^^^^^^^^^^^^^^^^
File "/home/david/Projects/volatility3/volatility3/framework/objects/templates.py", line 96, in __call__
return
^^^^^^^^^^^^^^^^^^^^^^
File "/home/david/Projects/volatility3/volatility3/framework/objects/__init__.py", line 850, in __init__
super().__init__(
File "/home/david/Projects/volatility3/volatility3/framework/interfaces/objects.py", line 112, in __init__
mask = context.layers[object_info.layer_name].address_mask
^^^^^^^^^^^^^^^^^^^^^^
File "/home/david/Projects/volatility3/volatility3/framework/interfaces/objects.py", line 76, in __getitem__
raise KeyError(f"NamedTuple does not have a key {key}")
KeyError: 'NamedTuple does not have a key 0'
Metadata
Metadata
Assignees
Labels
No labels