ikelos
ikelos
There's now a pull request to with functions to support converting between canonical addresses, and the contiguous address spaces that volatility layers inhabit. This is #905 and contains two function...
#905 provides helpers that improve the situation significantly and makes the likelihood of deep changes within the intel layer even less likely. #702 has been closed, see [this comment](https://github.com/volatilityfoundation/volatility3/pull/702#pullrequestreview-1003890884) for...
I'm afraid not, this is still outstanding on @awalters and @iMHLv2 to look into...
No progress on this front yet I'm afraid. I'm still not keen on supporting partial dumps (kernel/process only dumps), but if there's anything that's needed for improving full dump support,...
I think this question has been answered, and isn't a commonly repeating question, so I'm going to mark it off as closed. Please feel free to reopen if you feel...
Still interested in doing this, it just needs thinking about...
Reopening this because it's still a valid request and we should add support into the framework...
Of course 5:)
Errr, so off the top of my head, I'm not sure it's possible to calculate the native_offset in a virtual layer with only the offset in the physical layer. The...
I'm just trying to trace the origin of this, and it looks like it was added as #584. Most scanners only ever scan the physical space, although this one did...