Skip to content

Conversation

@0xHasanM
Copy link

This pull request enhances the vadinfo plugin in Volatility3 by adding support for filtering processes by physical memory offset and displaying physical offsets in output. It introduces new configuration options, improves process selection flexibility, and ensures offsets are translated correctly when requested.

New Features:

  • Added offset (process physical address offset) and physical-offsets (toggle for displaying physical offsets) as new configuration requirements in vadinfo.py, allowing users to filter processes based on physical memory offsets and display VADs physical-offsets.

Process Selection Improvements:

  • Integrated psscan.PsScan for process scanning by offset, enabling process selection either by PID (using pslist) or by physical offset (using psscan), based on user configuration. [1] [2]

Offset Handling Enhancements:

  • Implemented _translate_offset to convert virtual offsets to physical offsets when physical-offsets is enabled, ensuring correct offset display and handling page faults gracefully.
  • Updated the output to use the translated offset when physical-offsets is set, so that the displayed offset matches user expectations.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant