Vol.py doesn't output the volatility banner/version for --help or other argparse results.

[ikelos]

Vol should always output the volatility banner unless producing pipeable output. Volshell does already, investigate when this went away and if there was a reason, and if not, restore it.

[eve-mem]

Hey @ikelos I had some time to have a quick look for you.

It looks like the change happens in 8479fa1 in #1861

Here is the version disappearing.

$ git checkout 8479fa1c136c3f71c7fb8602184219326fca1fae
HEAD is now at 8479fa1c moved renderer parsing to after the plugins are imported
$ python vol.py --help | head
usage: vol.py [-h] [-c CONFIG] [--parallelism [{processes,threads,off}]]
              [-e EXTEND] [-p PLUGIN_DIRS] [-s SYMBOL_DIRS] [-v] [-l LOG]
              [-o OUTPUT_DIR] [-q] [-f FILE] [--write-config]
              [--save-config SAVE_CONFIG] [--clear-cache]
              [--cache-path CACHE_PATH] [--offline | -u URL]
              [--filters FILTERS] [--hide-columns [HIDE_COLUMNS ...]]
              [-r RENDERER] [--single-location SINGLE_LOCATION]
              [--stackers [STACKERS ...]]
              [--single-swap-locations [SINGLE_SWAP_LOCATIONS ...]]
              PLUGIN ...

The commit before still has the version showing.

$ git checkout d3a6b030b7604f6289f59dc7fa3e2882eb69225a
Previous HEAD position was 8479fa1c moved renderer parsing to after the plugins are imported
HEAD is now at d3a6b030 moved arrow/parquet parsers to it's own file and reverted changes
$ python vol.py --help | head
Volatility 3 Framework 2.26.2
usage: vol.py [-h] [-c CONFIG] [--parallelism [{processes,threads,off}]]
              [-e EXTEND] [-p PLUGIN_DIRS] [-s SYMBOL_DIRS] [-v] [-l LOG]
              [-o OUTPUT_DIR] [-q] [-r RENDERER] [-f FILE] [--write-config]
              [--save-config SAVE_CONFIG] [--clear-cache]
              [--cache-path CACHE_PATH] [--offline | -u URL]
              [--filters FILTERS] [--hide-columns [HIDE_COLUMNS ...]]
              [--single-location SINGLE_LOCATION] [--stackers [STACKERS ...]]
              [--single-swap-locations [SINGLE_SWAP_LOCATIONS ...]]
              PLUGIN ...

I don't think it was intentional just a side affect of of the changes in that PR so should probably be restored, I'm not sure at the moment the best way to do it though. I hope that helps and saves you some time investigating.

[ikelos]

Definitely, thanks! I think we may have to do some jiggery pokery... The difficulty is as follows:

Banner output depends on knowing whether it should be displayed or not
Knowing whether it should be displayed or not depends on the renderer
Knowing which renderer depends on the renderer list
Filling the renderer list depends on the plugin path
Getting the plugin path depends on having parsed the argument partially

This was to support arrow being a pluggable output format. We need to display the title before full argparsing, which needs to happen after we've got the plugin path, so we can get the full list of renderers...

So what I don't know if we can just repeat partial_args, _ = parser.parse_known_args(known_args) before doing the full parse.parse_args() and whether that will get us the renderers, without launching the help... Might be doable I'll try mocking it up tonight...