ikelos

So it did identify the correct banner, but we then immediately try to use a structure that wasn't present: ``` volatility3.framework.automagic.mac: Identified banner: b'Darwin Kernel Version 21.6.0: Mon Aug 22...

Ping @atcuno, before this times out in a couple months, could you please check about the `vm_map_object` in the mac symbol tables?

@atcuno The stale ticket just got added, which means it's been a couple of months since I asked. Have you had a chance to check out what's going on with...

@Abyss-W4tcher thanks for the analysis! Perhaps @atcuno or @gcmoreira can help out now we know what it is?

Hi there, just to follow up on this. I'm sorry to have taken so long over this, but I have finally found some time to investigate it., As mentioned [here](https://github.com/volatilityfoundation/volatility3/issues/815#issuecomment-1223844555),...

Thanks for giving this another pass. I'm still really uneasy about the indexing of the revmap, and it feels like we're not quite certain how it's working or how it's...

There is then also the issue of multiple physical layers (eg, swap space, etc). At the moment, I think we throw the layer name from the mapping value away. I...

Yep, so the curated list is important and valuable (string scanning can be notoriously slow for python over the `strings` program. It also means we wouldn't get an more efficient...

Building the reverse map will take a long time, if you know of a quicker way to determine which memory block belong to which processes, I'm all for it (the...

Well, I still think building a reverse mapping will be useful for lots of things. I'm interested in the speed savings you get from the interval tree, but it sounds...