ikelos

Kallsyms does a lot of stuff manually that should use the framework

2

From #1599, there's [an open comment[(https://github.com/volatilityfoundation/volatility3/pull/1599/files/bf0271cd5765d656cc9a3844bb8b5c7e69e650ec#r1938483310) that points out that it does a lot of manual reads rather than using the framework. The rationale for this was to avoid loading...

`_get_boottime_raw` fails on old symbol tables, and the exception stops any further results

8

Just so I don't forget, the new linux `_get_boottime_raw` handling stuff breaks with very old symbol tables (where the type of the timekeeper symbol is `void`). In that instance, `vmlinux.has_symbol`...

Core: Scanning only splits up the layer

1

Scanning had been rigged to chop up a layer's readable bits into the chunks that make it up from the lower layer. Unfortunately it did this on chunks in the...

Closes 1923.

This should have a much faster string searching mechanism (see #876 and #1043). If only we can get a little native interval-tree structure working...