volatility3
volatility3 copied to clipboard
Bugfix: Improve scan via the pdbname_scan
I had a case where the PdbSignatureScanner did find the right pdb. However due to a single paged out address in the kernel module the is_valid check failed which caused volatility not to work on my memory dump.
By adding maximum_invalid_count we allow ourselves to continue iterating downwards even if some pages were invalid.
The maximum_invalid_count is currently defaulted to 100 which was enough to to fix my issue, however we could increase it if is needed.
Otherwise functionality is the same.
Without this extra code I could not run volatility3 on my Win10 1809 memory dump (2GB ram)