Eve

Hello @suamsuamsuam - any luck?

@atcuno - I think the UnionType error is a red herring, it's just symptomatic of how the logic works in this part of the handles plugin works. This part is...

@atcuno Are you able to uncomment this line handy debug line in the handles plugin, and share the results on your sample that doesn't work? https://github.com/volatilityfoundation/volatility3/blob/1b3ba6ab2ef6f086993ad382f68d9f01a4ae7bdf/volatility3/framework/plugins/windows/handles.py#L176 Here is the output...

Hello @ikelos - I think this one still needs to stay open. Maybe auto closed by me referencing this issue in the PR? (sorry!) Don't think we've yet worked out...

Hello @nathan-out - thank you for spending time on this and raising a PR! I was going to suggest just using the `--log` option that already exists but it only...

Yup, once a core dev takes a look and thinks the way it's done etc is good. I'd imagine it'll be @ikelos to look over this one. Assuming it's all...

Could you add the log from vol with -vvvvv added before the plugin name. It really helps when working out issues. It would also be useful to see the output...

Great thanks. Looks like the symbols you made are in the right place and are being picked up, but it's not quite working. How exactly did you acquire the memory?

Hello, thank you for the information. Ah t the moment I'm not clear why it isn't working. Perhaps someone else will spot the issue. Is this memory sample one you...

@gcmoreira - looks really cool, I need to look over it properly. I certainly like pulling out the prefix into it's own column compared with https://github.com/volatilityfoundation/volatility3/pull/1029 - that makes it...