Notes
- Windows kernel symbols are fetched from the Microsoft symbol server and converted, as the README said. v1.0.0 could not analyse a Windows image without Python Volatility 3 installed alongside.
- Short plugin names work, so
windows.pslistno longer needs the fullwindows.pslist.PsList. - The small symbol tables are built into the binary, so plugins like
linux.bashwork with nothing installed. - Malformed AVML and ELF files return an error instead of crashing.
- Release binaries are built from the tag they are attached to.