install_volatility.yaml

---
# Inspired by: https://seanthegeek.net/1172/how-to-install-volatility-2-and-volatility-3-on-debian-ubuntu-or-kali-linux/

# Variables:
#   venv_path (str): the path where vol.py and volatility virtualenv will be created. Default: $HOME
#   install_path (str): the path where vol.py and volatility script symlinks will be created. Default: $HOME/.local/bin

- hosts: localhost
  become: yes
  gather_facts: no
  connection: local
  tasks:
  - name: Install system dependencies for volatility 2
    tags: [vol2]
    ansible.builtin.apt:
      update_cache: yes
      state: present
      name:
      - build-essential
      - libdistorm3-dev
      - yara
      - libyara-dev
      - libraw1394-11
      - libcapstone-dev
      - capstone-tool
      - tzdata
      - python2-pip-whl
      - python2-setuptools-whl
      - virtualenv

  - name: Install system dependencies for volatility 3
    tags: [vol3]
    ansible.builtin.apt:
      update_cache: no
      state: present
      name:
      - python3
      - python3-dev
      - libpython3-dev
      - python3-setuptools
      - python3-wheel
      - python3-virtualenv

- hosts: localhost
  become: no
  gather_facts: no
  connection: local
  vars:
    venv_path: "{{ lookup('ansible.builtin.env', 'HOME') }}"
    install_path: "{{ lookup('ansible.builtin.env', 'HOME') }}/.local/bin"
  tasks:
  - name: Ensure install_path is a directory
    tags: [vol2, vol3]
    ansible.builtin.file:
      path: "{{ install_path }}"
      state: directory

  - name: Install volatility 2
    tags: [vol2]
    block:
    - name: Setup volatility 2 virtual env
      ansible.builtin.pip:
        virtualenv: "{{ venv_path }}/volatility2"
        virtualenv_command: virtualenv
        virtualenv_python: python2.7
        state: present
        name:
        - pip
        - setuptools
        - wheel

    - name: Install volatility 2 requirements
      ansible.builtin.pip:
        virtualenv: "{{ venv_path }}/volatility2"
        state: present
        name:
        - distorm3
        - yara
        - pycrypto
        - pillow
        - openpyxl
        - ujson
        - pytz
        - ipython
        - capstone
        - yara

    - name: Find libyara.so
      ansible.builtin.find:
        path: "{{ venv_path }}/volatility2"
        file_type: file
        recurse: yes
        use_regex: yes
        patterns: "^libyara.so$"
      register: libyara_path

    - name: Assert that we found libyara.so
      ansible.builtin.assert:
        that: libyara_path.matched > 0
        fail_msg: "'libyara.so' was not found in {{ venv_path }}/volatility2"

    - name: Symlink to libyara.so
      ansible.builtin.file:
        src: "{{ libyara_path.files[0].path }}"
        dest: "{{ venv_path }}/volatility2/lib/libyara.so"
        state: link

    - name: Install volatility 2
      ansible.builtin.pip:
        virtualenv: "{{ venv_path }}/volatility2"
        state: present
        name: git+https://github.com/volatilityfoundation/volatility.git

    - name: "Link volatility 2 in '{{ install_path }}'"
      ansible.builtin.file:
        src: "{{ venv_path }}/volatility2/bin/vol.py"
        dest: "{{ install_path }}/vol2"
        state: link

  - name: Install volatility 3
    tags: [vol3]
    block:
    - name: Setup volatility 3 virtual env
      ansible.builtin.pip:
        virtualenv: "{{ venv_path }}/volatility3"
        virtualenv_command: python3 -m venv
        state: present
        name:
        - pip
        - setuptools
        - wheel

    - name: Install volatility 3 requirements
      ansible.builtin.pip:
        virtualenv: "{{ venv_path }}/volatility3"
        state: present
        name:
        - distorm3
        - yara
        - pycrypto
        - pillow
        - openpyxl
        - ujson
        - pytz
        - ipython
        - capstone

    - name: Find libyara.so
      ansible.builtin.find:
        path: "{{ venv_path }}/volatility2"
        file_type: file
        recurse: yes
        use_regex: yes
        patterns: "^libyara.so$"
      register: libyara_path

    - name: Assert that we found libyara.so
      ansible.builtin.assert:
        that: libyara_path.matched > 0
        fail_msg: "'libyara.so' was not found in {{ venv_path }}/volatility2"

    - name: Symlink to libyara.so
      ansible.builtin.file:
        src: "{{ libyara_path.files[0].path }}"
        dest: "{{ venv_path }}/volatility3/lib/libyara.so"
        state: link

    - name: Install volatility 3
      ansible.builtin.pip:
        virtualenv: "{{ venv_path }}/volatility3"
        state: present
        name: git+https://github.com/volatilityfoundation/volatility3.git

    - name: "Link volatility 3 in '{{ install_path }}'"
      ansible.builtin.file:
        src: "{{ venv_path }}/volatility3/bin/vol"
        dest: "{{ install_path }}/vol3"
        state: link

    - name: "Link volshell in '{{ install_path }}'"
      ansible.builtin.file:
        src: "{{ venv_path }}/volatility3/bin/volshell"
        dest: "{{ install_path }}/volshell"
        state: link

  - name: Recap
    tags: [vol2]
    ansible.builtin.debug:
      msg: You can run volatility 2 by running vol2!

  - name: Recap
    tags: [vol3]
    ansible.builtin.debug:
      msg:
      - You can run volatility 3 by running vol3!
      - You can run volshell by simply running volshell!

  - name: Recap
    ansible.builtin.debug:
      msg: "If you have a 'command not found' error, make sure '{{ install_path }}' is in your PATH!"