diff --git a/.github/workflows/build-pypi.yml b/.github/workflows/build-pypi.yml
index 346d0337e..d1a63b4da 100644
--- a/.github/workflows/build-pypi.yml
+++ b/.github/workflows/build-pypi.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-20.04
     strategy:
       matrix:
-        python-version: ["3.7"]
+        python-version: ["3.8"]
     steps:
     - uses: actions/checkout@v4
     - name: Set up Python ${{ matrix.python-version }}
diff --git a/.github/workflows/install.yml b/.github/workflows/install.yml
index e13161085..398ff8ae3 100644
--- a/.github/workflows/install.yml
+++ b/.github/workflows/install.yml
@@ -8,7 +8,7 @@ jobs:
       fail-fast: false
       matrix:
         host: [ ubuntu-latest, windows-latest ]
-        python-version: [ "3.7", "3.8", "3.9", "3.10", "3.11" ]
+        python-version: [ "3.8", "3.9", "3.10", "3.11" ]
     steps:
     - uses: actions/checkout@v4
 
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 55b2e4b60..6358dd45d 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -6,7 +6,7 @@ jobs:
     runs-on: ubuntu-20.04
     strategy:
       matrix:
-        python-version: ["3.7"]
+        python-version: ["3.8"]
     steps:
     - uses: actions/checkout@v4
     - name: Set up Python ${{ matrix.python-version }}
@@ -46,7 +46,7 @@ jobs:
 
     - name: Clean up post-test
       run: |
-        rm -rf *.lime
+        rm -rf *.bin
         rm -rf *.img
         cd volatility3/symbols
         rm -rf linux
diff --git a/.style.yapf b/.style.yapf
deleted file mode 100644
index 3f154e07b..000000000
--- a/.style.yapf
+++ /dev/null
@@ -1,261 +0,0 @@
-[style]
-# Align closing bracket with visual indentation.
-align_closing_bracket_with_visual_indent=True
-
-# Allow dictionary keys to exist on multiple lines. For example:
-#
-#   x = {
-#       ('this is the first element of a tuple',
-#        'this is the second element of a tuple'):
-#            value,
-#   }
-allow_multiline_dictionary_keys=False
-
-# Allow lambdas to be formatted on more than one line.
-allow_multiline_lambdas=False
-
-# Allow splits before the dictionary value.
-allow_split_before_dict_value=True
-
-# Number of blank lines surrounding top-level function and class
-# definitions.
-blank_lines_around_top_level_definition=2
-
-# Insert a blank line before a class-level docstring.
-blank_line_before_class_docstring=False
-
-# Insert a blank line before a module docstring.
-blank_line_before_module_docstring=False
-
-# Insert a blank line before a 'def' or 'class' immediately nested
-# within another 'def' or 'class'. For example:
-#
-#   class Foo:
-#                      # <------ this blank line
-#     def method():
-#       ...
-blank_line_before_nested_class_or_def=True
-
-# Do not split consecutive brackets. Only relevant when
-# dedent_closing_brackets is set. For example:
-#
-#    call_func_that_takes_a_dict(
-#        {
-#            'key1': 'value1',
-#            'key2': 'value2',
-#        }
-#    )
-#
-# would reformat to:
-#
-#    call_func_that_takes_a_dict({
-#        'key1': 'value1',
-#        'key2': 'value2',
-#    })
-coalesce_brackets=False
-
-# The column limit.
-column_limit=120
-
-# The style for continuation alignment. Possible values are:
-#
-# - SPACE: Use spaces for continuation alignment. This is default behavior.
-# - FIXED: Use fixed number (CONTINUATION_INDENT_WIDTH) of columns
-#   (ie: CONTINUATION_INDENT_WIDTH/INDENT_WIDTH tabs) for continuation
-#   alignment.
-# - LESS: Slightly left if cannot vertically align continuation lines with
-#   indent characters.
-# - VALIGN-RIGHT: Vertically align continuation lines with indent
-#   characters. Slightly right (one more indent character) if cannot
-#   vertically align continuation lines with indent characters.
-#
-# For options FIXED, and VALIGN-RIGHT are only available when USE_TABS is
-# enabled.
-continuation_align_style=SPACE
-
-# Indent width used for line continuations.
-continuation_indent_width=4
-
-# Put closing brackets on a separate line, dedented, if the bracketed
-# expression can't fit in a single line. Applies to all kinds of brackets,
-# including function definitions and calls. For example:
-#
-#   config = {
-#       'key1': 'value1',
-#       'key2': 'value2',
-#   }        # <--- this bracket is dedented and on a separate line
-#
-#   time_series = self.remote_client.query_entity_counters(
-#       entity='dev3246.region1',
-#       key='dns.query_latency_tcp',
-#       transform=Transformation.AVERAGE(window=timedelta(seconds=60)),
-#       start_ts=now()-timedelta(days=3),
-#       end_ts=now(),
-#   )        # <--- this bracket is dedented and on a separate line
-dedent_closing_brackets=False
-
-# Disable the heuristic which places each list element on a separate line
-# if the list is comma-terminated.
-disable_ending_comma_heuristic=False
-
-# Place each dictionary entry onto its own line.
-each_dict_entry_on_separate_line=True
-
-# The regex for an i18n comment. The presence of this comment stops
-# reformatting of that line, because the comments are required to be
-# next to the string they translate.
-i18n_comment=
-
-# The i18n function call names. The presence of this function stops
-# reformatting on that line, because the string it has cannot be moved
-# away from the i18n comment.
-i18n_function_call=
-
-# Indent the dictionary value if it cannot fit on the same line as the
-# dictionary key. For example:
-#
-#   config = {
-#       'key1':
-#           'value1',
-#       'key2': value1 +
-#               value2,
-#   }
-indent_dictionary_value=False
-
-# The number of columns to use for indentation.
-indent_width=4
-
-# Join short lines into one line. E.g., single line 'if' statements.
-join_multiple_lines=True
-
-# Do not include spaces around selected binary operators. For example:
-#
-#   1 + 2 * 3 - 4 / 5
-#
-# will be formatted as follows when configured with "*,/":
-#
-#   1 + 2*3 - 4/5
-#
-no_spaces_around_selected_binary_operators=
-
-# Use spaces around default or named assigns.
-spaces_around_default_or_named_assign=True
-
-# Use spaces around the power operator.
-spaces_around_power_operator=True
-
-# The number of spaces required before a trailing comment.
-spaces_before_comment=2
-
-# Insert a space between the ending comma and closing bracket of a list,
-# etc.
-space_between_ending_comma_and_closing_bracket=True
-
-# Split before arguments
-split_all_comma_separated_values=False
-
-# Split before arguments if the argument list is terminated by a
-# comma.
-split_arguments_when_comma_terminated=False
-
-# Set to True to prefer splitting before '&', '|' or '^' rather than
-# after.
-split_before_bitwise_operator=True
-
-# Split before the closing bracket if a list or dict literal doesn't fit on
-# a single line.
-split_before_closing_bracket=True
-
-# Split before a dictionary or set generator (comp_for). For example, note
-# the split before the 'for':
-#
-#   foo = {
-#       variable: 'Hello world, have a nice day!'
-#       for variable in bar if variable != 42
-#   }
-split_before_dict_set_generator=True
-
-# Split before the '.' if we need to split a longer expression:
-#
-#   foo = ('This is a really long string: {}, {}, {}, {}'.format(a, b, c, d))
-#
-# would reformat to something like:
-#
-#   foo = ('This is a really long string: {}, {}, {}, {}'
-#          .format(a, b, c, d))
-split_before_dot=False
-
-# Split after the opening paren which surrounds an expression if it doesn't
-# fit on a single line.
-split_before_expression_after_opening_paren=False
-
-# If an argument / parameter list is going to be split, then split before
-# the first argument.
-split_before_first_argument=False
-
-# Set to True to prefer splitting before 'and' or 'or' rather than
-# after.
-split_before_logical_operator=True
-
-# Split named assignments onto individual lines.
-split_before_named_assigns=True
-
-# Set to True to split list comprehensions and generators that have
-# non-trivial expressions and multiple clauses before each of these
-# clauses. For example:
-#
-#   result = [
-#       a_long_var + 100 for a_long_var in xrange(1000)
-#       if a_long_var % 10]
-#
-# would reformat to something like:
-#
-#   result = [
-#       a_long_var + 100
-#       for a_long_var in xrange(1000)
-#       if a_long_var % 10]
-split_complex_comprehension=True
-
-# The penalty for splitting right after the opening bracket.
-split_penalty_after_opening_bracket=200
-
-# The penalty for splitting the line after a unary operator.
-split_penalty_after_unary_operator=10000
-
-# The penalty for splitting right before an if expression.
-split_penalty_before_if_expr=0
-
-# The penalty of splitting the line around the '&', '|', and '^'
-# operators.
-split_penalty_bitwise_operator=300
-
-# The penalty for splitting a list comprehension or generator
-# expression.
-split_penalty_comprehension=80
-
-# The penalty for characters over the column limit.
-split_penalty_excess_character=7000
-
-# The penalty incurred by adding a line split to the unwrapped line. The
-# more line splits added the higher the penalty.
-split_penalty_for_added_line_split=30
-
-# The penalty of splitting a list of "import as" names. For example:
-#
-#   from a_very_long_or_indented_module_name_yada_yad import (long_argument_1,
-#                                                             long_argument_2,
-#                                                             long_argument_3)
-#
-# would reformat to something like:
-#
-#   from a_very_long_or_indented_module_name_yada_yad import (
-#       long_argument_1, long_argument_2, long_argument_3)
-split_penalty_import_names=0
-
-# The penalty of splitting the line around the 'and' and 'or'
-# operators.
-split_penalty_logical_operator=300
-
-# Use the Tab character for indentation.
-use_tabs=False
-
diff --git a/README.md b/README.md
index 886790df8..4e6953592 100644
--- a/README.md
+++ b/README.md
@@ -20,7 +20,7 @@ more details.
 
 ## Requirements
 
-Volatility 3 requires Python 3.7.3 or later. To install the most minimal set of dependencies (some plugins will not work) use a command such as:
+Volatility 3 requires Python 3.8.0 or later. To install the most minimal set of dependencies (some plugins will not work) use a command such as:
 
 ```shell
 pip3 install -r requirements-minimal.txt
@@ -106,7 +106,7 @@ The latest generated copy of the documentation can be found at: <https://volatil
 
 ## Licensing and Copyright
 
-Copyright (C) 2007-2024 Volatility Foundation
+Copyright (C) 2007-2025 Volatility Foundation
 
 All Rights Reserved
 
diff --git a/doc/requirements.txt b/doc/requirements.txt
index b715e59f5..d3ba51224 100644
--- a/doc/requirements.txt
+++ b/doc/requirements.txt
@@ -4,5 +4,6 @@ sphinx_autodoc_typehints>=1.4.0
 sphinx-rtd-theme>=0.4.3
 
 yara-python
+yara-x
 pycryptodome
 pefile
diff --git a/doc/source/conf.py b/doc/source/conf.py
index cabfdc327..6e588fbc1 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -169,7 +169,7 @@ master_doc = "index"
 
 # General information about the project.
 project = "Volatility 3"
-copyright = "2012-2024, Volatility Foundation"
+copyright = "2012-2025, Volatility Foundation"
 
 # The version info for the project you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the
diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst
index 26ad2c2e4..d4b40d053 100644
--- a/doc/source/getting-started-linux-tutorial.rst
+++ b/doc/source/getting-started-linux-tutorial.rst
@@ -11,6 +11,7 @@ Volatility3 does not provide the ability to acquire memory.  Below are some exam
 * `AVML - Acquire Volatile Memory for Linux <https://github.com/microsoft/avml>`_
 * `LiME - Linux Memory Extract <https://github.com/504ensicsLabs/LiME>`_
 
+Be aware that LiME raw format is not supported by volatility3, the padded or lime option should be used instead. `This issue contains further information <https://github.com/504ensicsLabs/LiME/issues/111>`_.
 
 Procedure to create symbol tables for linux
 --------------------------------------------
diff --git a/pyproject.toml b/pyproject.toml
index 207f762cc..2e1636a43 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ readme = "README.md"
 authors = [
     { name = "Volatility Foundation", email = "volatility@volatilityfoundation.org" },
 ]
-requires-python = ">=3.7.3"
+requires-python = ">=3.8.0"
 license = { text = "VSL" }
 dynamic = ["dependencies", "optional-dependencies", "version"]
 
diff --git a/requirements.txt b/requirements.txt
index bd61edf14..e0d366391 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -9,7 +9,8 @@ yara-python>=3.8.0
 
 # This is required for several plugins that perform malware analysis and disassemble code.
 # It can also improve accuracy of Windows 8 and later memory samples.
-capstone>=3.0.5
+# FIXME: Version 6.0.0 is incompatible (#1336) so we'll need an adaptor at some point
+capstone>=3.0.5,<6.0.0
 
 # This is required by plugins that decrypt passwords, password hashes, etc.
 pycryptodome
@@ -19,4 +20,4 @@ leechcorepyc>=2.4.0; sys_platform != 'darwin'
 
 # This is required for memory analysis on a Amazon/MinIO S3 and Google Cloud object storage
 gcsfs>=2023.1.0
-s3fs>=2023.1.0
\ No newline at end of file
+s3fs>=2023.1.0
diff --git a/test/__init__.py b/test/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/test/plugins/__init__.py b/test/plugins/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/test/plugins/windows/__init__.py b/test/plugins/windows/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/test/plugins/windows/test_scheduled_tasks.py b/test/plugins/windows/test_scheduled_tasks.py
new file mode 100644
index 000000000..8f771b323
--- /dev/null
+++ b/test/plugins/windows/test_scheduled_tasks.py
@@ -0,0 +1,387 @@
+import sys
+import struct
+import traceback
+import unittest
+sys.path.insert(0, "../../volatility3")
+from volatility3.plugins.windows import scheduled_tasks
+
+class TestActionsDecoding(unittest.TestCase):
+    def test_decode_exe_action(self):
+        # fmt: off
+        buf = struct.pack(
+            "512B",
+            *[
+                0x03, 0x00, 0x16, 0x00, 0x00, 0x00, 0x4c, 0x00,
+                0x6f, 0x00, 0x63, 0x00, 0x61, 0x00, 0x6c, 0x00,
+                0x53, 0x00, 0x79, 0x00, 0x73, 0x00, 0x74, 0x00,
+                0x65, 0x00, 0x6d, 0x00, 0x66, 0x66, 0x00, 0x00,
+                0x00, 0x00, 0x6e, 0x00, 0x00, 0x00, 0x25, 0x00,
+                0x77, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00,
+                0x69, 0x00, 0x72, 0x00, 0x25, 0x00, 0x5c, 0x00,
+                0x73, 0x00, 0x79, 0x00, 0x73, 0x00, 0x74, 0x00,
+                0x65, 0x00, 0x6d, 0x00, 0x33, 0x00, 0x32, 0x00,
+                0x5c, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6e, 0x00,
+                0x64, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00,
+                0x50, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x65, 0x00,
+                0x72, 0x00, 0x53, 0x00, 0x68, 0x00, 0x65, 0x00,
+                0x6c, 0x00, 0x6c, 0x00, 0x5c, 0x00, 0x76, 0x00,
+                0x31, 0x00, 0x2e, 0x00, 0x30, 0x00, 0x5c, 0x00,
+                0x70, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x65, 0x00,
+                0x72, 0x00, 0x73, 0x00, 0x68, 0x00, 0x65, 0x00,
+                0x6c, 0x00, 0x6c, 0x00, 0x2e, 0x00, 0x65, 0x00,
+                0x78, 0x00, 0x65, 0x00, 0x62, 0x01, 0x00, 0x00,
+                0x2d, 0x00, 0x45, 0x00, 0x78, 0x00, 0x65, 0x00,
+                0x63, 0x00, 0x75, 0x00, 0x74, 0x00, 0x69, 0x00,
+                0x6f, 0x00, 0x6e, 0x00, 0x50, 0x00, 0x6f, 0x00,
+                0x6c, 0x00, 0x69, 0x00, 0x63, 0x00, 0x79, 0x00,
+                0x20, 0x00, 0x55, 0x00, 0x6e, 0x00, 0x72, 0x00,
+                0x65, 0x00, 0x73, 0x00, 0x74, 0x00, 0x72, 0x00,
+                0x69, 0x00, 0x63, 0x00, 0x74, 0x00, 0x65, 0x00,
+                0x64, 0x00, 0x20, 0x00, 0x2d, 0x00, 0x4e, 0x00,
+                0x6f, 0x00, 0x6e, 0x00, 0x49, 0x00, 0x6e, 0x00,
+                0x74, 0x00, 0x65, 0x00, 0x72, 0x00, 0x61, 0x00,
+                0x63, 0x00, 0x74, 0x00, 0x69, 0x00, 0x76, 0x00,
+                0x65, 0x00, 0x20, 0x00, 0x2d, 0x00, 0x4e, 0x00,
+                0x6f, 0x00, 0x50, 0x00, 0x72, 0x00, 0x6f, 0x00,
+                0x66, 0x00, 0x69, 0x00, 0x6c, 0x00, 0x65, 0x00,
+                0x20, 0x00, 0x2d, 0x00, 0x57, 0x00, 0x69, 0x00,
+                0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00, 0x77, 0x00,
+                0x53, 0x00, 0x74, 0x00, 0x79, 0x00, 0x6c, 0x00,
+                0x65, 0x00, 0x20, 0x00, 0x48, 0x00, 0x69, 0x00,
+                0x64, 0x00, 0x64, 0x00, 0x65, 0x00, 0x6e, 0x00,
+                0x20, 0x00, 0x22, 0x00, 0x26, 0x00, 0x20, 0x00,
+                0x25, 0x00, 0x77, 0x00, 0x69, 0x00, 0x6e, 0x00,
+                0x64, 0x00, 0x69, 0x00, 0x72, 0x00, 0x25, 0x00,
+                0x5c, 0x00, 0x73, 0x00, 0x79, 0x00, 0x73, 0x00,
+                0x74, 0x00, 0x65, 0x00, 0x6d, 0x00, 0x33, 0x00,
+                0x32, 0x00, 0x5c, 0x00, 0x57, 0x00, 0x69, 0x00,
+                0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00, 0x77, 0x00,
+                0x73, 0x00, 0x50, 0x00, 0x6f, 0x00, 0x77, 0x00,
+                0x65, 0x00, 0x72, 0x00, 0x53, 0x00, 0x68, 0x00,
+                0x65, 0x00, 0x6c, 0x00, 0x6c, 0x00, 0x5c, 0x00,
+                0x76, 0x00, 0x31, 0x00, 0x2e, 0x00, 0x30, 0x00,
+                0x5c, 0x00, 0x4d, 0x00, 0x6f, 0x00, 0x64, 0x00,
+                0x75, 0x00, 0x6c, 0x00, 0x65, 0x00, 0x73, 0x00,
+                0x5c, 0x00, 0x53, 0x00, 0x6d, 0x00, 0x62, 0x00,
+                0x53, 0x00, 0x68, 0x00, 0x61, 0x00, 0x72, 0x00,
+                0x65, 0x00, 0x5c, 0x00, 0x44, 0x00, 0x69, 0x00,
+                0x73, 0x00, 0x61, 0x00, 0x62, 0x00, 0x6c, 0x00,
+                0x65, 0x00, 0x55, 0x00, 0x6e, 0x00, 0x75, 0x00,
+                0x73, 0x00, 0x65, 0x00, 0x64, 0x00, 0x53, 0x00,
+                0x6d, 0x00, 0x62, 0x00, 0x31, 0x00, 0x2e, 0x00,
+                0x70, 0x00, 0x73, 0x00, 0x31, 0x00, 0x20, 0x00,
+                0x2d, 0x00, 0x53, 0x00, 0x63, 0x00, 0x65, 0x00,
+                0x6e, 0x00, 0x61, 0x00, 0x72, 0x00, 0x69, 0x00,
+                0x6f, 0x00, 0x20, 0x00, 0x43, 0x00, 0x6c, 0x00,
+                0x69, 0x00, 0x65, 0x00, 0x6e, 0x00, 0x74, 0x00,
+                0x22, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            ]
+        )
+
+        try:
+            actions = scheduled_tasks.ActionSet.decode(buf).actions  # type: ignore
+            self.assertEqual(len(actions), 1)
+            self.assertEqual(actions[0].action_type, scheduled_tasks.ActionType.Exe)
+        except Exception:
+            self.fail(
+                "ActionDecoder.decode should not raise exception:\n%s"
+                % traceback.format_exc()
+            )
+
+
+class TestTriggersDecoding(unittest.TestCase):
+    def test_decode_all_triggers(self):
+        """
+        Tests decoding a set of all triggers that can be constructed via the
+        Task Scheduler GUI interface. Ensures that the correct number of bytes
+        is being consumed for each trigger structure.
+        """
+        buf = struct.pack(
+            "1808B",
+            # fmt: off
+            *[
+                0x17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0xda, 0xaf, 0x8d, 0x09, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0xda, 0xaf, 0x8d, 0x09, 0x00, 0x00, 0x00,
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                0x38, 0x21, 0x41, 0x42, 0x48, 0x48, 0x48, 0x48,
+                0xa0, 0x12, 0xa0, 0xa4, 0x48, 0x48, 0x48, 0x48,
+                0x0e, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x41, 0x00, 0x75, 0x00, 0x74, 0x00, 0x68, 0x00,
+                0x6f, 0x00, 0x72, 0x00, 0x00, 0x00, 0x48, 0x48,
+                0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48,
+                0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48,
+                0x01, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x1c, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x01, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05,
+                0x15, 0x00, 0x00, 0x00, 0x69, 0xce, 0x28, 0x2a,
+                0xce, 0xd8, 0x1f, 0x77, 0x37, 0x9c, 0xe2, 0x44,
+                0xf4, 0x01, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x40, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x44, 0x00, 0x45, 0x00, 0x53, 0x00, 0x4b, 0x00,
+                0x54, 0x00, 0x4f, 0x00, 0x50, 0x00, 0x2d, 0x00,
+                0x45, 0x00, 0x33, 0x00, 0x38, 0x00, 0x38, 0x00,
+                0x44, 0x00, 0x38, 0x00, 0x50, 0x00, 0x5c, 0x00,
+                0x41, 0x00, 0x64, 0x00, 0x6d, 0x00, 0x69, 0x00,
+                0x6e, 0x00, 0x69, 0x00, 0x73, 0x00, 0x74, 0x00,
+                0x72, 0x00, 0x61, 0x00, 0x74, 0x00, 0x6f, 0x00,
+                0x72, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x2c, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
+                0x80, 0xf4, 0x03, 0x00, 0xff, 0xff, 0xff, 0xff,
+                0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0xdd, 0xdd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x01, 0x07, 0x0a, 0x00, 0x00, 0x00, 0x09, 0x00,
+                0x80, 0x48, 0x11, 0xf8, 0x36, 0x1a, 0xdb, 0x01,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x01, 0x2e, 0xe2, 0x01, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0xc2, 0x31, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0xaa, 0xaa, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0xda, 0xaf, 0x8d, 0x09, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0xda, 0xaf, 0x8d, 0x09, 0x00, 0x00, 0x00,
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,
+                0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x01, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48,
+                0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0xda, 0xaf, 0x8d, 0x09, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0xda, 0xaf, 0x8d, 0x09, 0x00, 0x00, 0x00,
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0xee, 0xee, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0xda, 0xaf, 0x8d, 0x09, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0xda, 0xaf, 0x8d, 0x09, 0x00, 0x00, 0x00,
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0xcc, 0xcc, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x01, 0x00, 0x65, 0x00, 0x78, 0x00, 0x65, 0x00,
+                0x22, 0x00, 0x20, 0x00, 0x53, 0x00, 0x74, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x84, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x3c, 0x00, 0x51, 0x00, 0x75, 0x00, 0x65, 0x00,
+                0x72, 0x00, 0x79, 0x00, 0x4c, 0x00, 0x69, 0x00,
+                0x73, 0x00, 0x74, 0x00, 0x3e, 0x00, 0x3c, 0x00,
+                0x51, 0x00, 0x75, 0x00, 0x65, 0x00, 0x72, 0x00,
+                0x79, 0x00, 0x20, 0x00, 0x49, 0x00, 0x64, 0x00,
+                0x3d, 0x00, 0x22, 0x00, 0x30, 0x00, 0x22, 0x00,
+                0x20, 0x00, 0x50, 0x00, 0x61, 0x00, 0x74, 0x00,
+                0x68, 0x00, 0x3d, 0x00, 0x22, 0x00, 0x49, 0x00,
+                0x6e, 0x00, 0x74, 0x00, 0x65, 0x00, 0x72, 0x00,
+                0x6e, 0x00, 0x65, 0x00, 0x74, 0x00, 0x20, 0x00,
+                0x45, 0x00, 0x78, 0x00, 0x70, 0x00, 0x6c, 0x00,
+                0x6f, 0x00, 0x72, 0x00, 0x65, 0x00, 0x72, 0x00,
+                0x22, 0x00, 0x3e, 0x00, 0x3c, 0x00, 0x53, 0x00,
+                0x65, 0x00, 0x6c, 0x00, 0x65, 0x00, 0x63, 0x00,
+                0x74, 0x00, 0x20, 0x00, 0x50, 0x00, 0x61, 0x00,
+                0x74, 0x00, 0x68, 0x00, 0x3d, 0x00, 0x22, 0x00,
+                0x49, 0x00, 0x6e, 0x00, 0x74, 0x00, 0x65, 0x00,
+                0x72, 0x00, 0x6e, 0x00, 0x65, 0x00, 0x74, 0x00,
+                0x20, 0x00, 0x45, 0x00, 0x78, 0x00, 0x70, 0x00,
+                0x6c, 0x00, 0x6f, 0x00, 0x72, 0x00, 0x65, 0x00,
+                0x72, 0x00, 0x22, 0x00, 0x3e, 0x00, 0x2a, 0x00,
+                0x5b, 0x00, 0x53, 0x00, 0x79, 0x00, 0x73, 0x00,
+                0x74, 0x00, 0x65, 0x00, 0x6d, 0x00, 0x5b, 0x00,
+                0x45, 0x00, 0x76, 0x00, 0x65, 0x00, 0x6e, 0x00,
+                0x74, 0x00, 0x49, 0x00, 0x44, 0x00, 0x3d, 0x00,
+                0x32, 0x00, 0x5d, 0x00, 0x5d, 0x00, 0x3c, 0x00,
+                0x2f, 0x00, 0x53, 0x00, 0x65, 0x00, 0x6c, 0x00,
+                0x65, 0x00, 0x63, 0x00, 0x74, 0x00, 0x3e, 0x00,
+                0x3c, 0x00, 0x2f, 0x00, 0x51, 0x00, 0x75, 0x00,
+                0x65, 0x00, 0x72, 0x00, 0x79, 0x00, 0x3e, 0x00,
+                0x3c, 0x00, 0x2f, 0x00, 0x51, 0x00, 0x75, 0x00,
+                0x65, 0x00, 0x72, 0x00, 0x79, 0x00, 0x4c, 0x00,
+                0x69, 0x00, 0x73, 0x00, 0x74, 0x00, 0x3e, 0x00,
+                0x00, 0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x88, 0x88, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x77, 0x77, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,
+                0x01, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x01, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48,
+                0x77, 0x77, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,
+                0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48,
+                0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48,
+                0x01, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x1c, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x01, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05,
+                0x15, 0x00, 0x00, 0x00, 0x69, 0xce, 0x28, 0x2a,
+                0xce, 0xd8, 0x1f, 0x77, 0x37, 0x9c, 0xe2, 0x44,
+                0xf4, 0x01, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x40, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x44, 0x00, 0x45, 0x00, 0x53, 0x00, 0x4b, 0x00,
+                0x54, 0x00, 0x4f, 0x00, 0x50, 0x00, 0x2d, 0x00,
+                0x45, 0x00, 0x33, 0x00, 0x38, 0x00, 0x38, 0x00,
+                0x44, 0x00, 0x38, 0x00, 0x50, 0x00, 0x5c, 0x00,
+                0x41, 0x00, 0x64, 0x00, 0x6d, 0x00, 0x69, 0x00,
+                0x6e, 0x00, 0x69, 0x00, 0x73, 0x00, 0x74, 0x00,
+                0x72, 0x00, 0x61, 0x00, 0x74, 0x00, 0x6f, 0x00,
+                0x72, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x77, 0x77, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,
+                0x01, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x01, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48,
+                0x77, 0x77, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,
+                0x01, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48,
+                0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48,
+                0x01, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x1c, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x01, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05,
+                0x15, 0x00, 0x00, 0x00, 0x69, 0xce, 0x28, 0x2a,
+                0xce, 0xd8, 0x1f, 0x77, 0x37, 0x9c, 0xe2, 0x44,
+                0xf4, 0x01, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x40, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x44, 0x00, 0x45, 0x00, 0x53, 0x00, 0x4b, 0x00,
+                0x54, 0x00, 0x4f, 0x00, 0x50, 0x00, 0x2d, 0x00,
+                0x45, 0x00, 0x33, 0x00, 0x38, 0x00, 0x38, 0x00,
+                0x44, 0x00, 0x38, 0x00, 0x50, 0x00, 0x5c, 0x00,
+                0x41, 0x00, 0x64, 0x00, 0x6d, 0x00, 0x69, 0x00,
+                0x6e, 0x00, 0x69, 0x00, 0x73, 0x00, 0x74, 0x00,
+                0x72, 0x00, 0x61, 0x00, 0x74, 0x00, 0x6f, 0x00,
+                0x72, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+            ]
+            # fmt: on
+        )
+        triggers = scheduled_tasks.TriggerSet.decode(buf)
+        self.assertIsNotNone(triggers)
+
+    def test_decode_triggers(self):
+        # fmt: off
+        buf = struct.pack(
+            "320B",
+            *[
+                0x17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0xB9, 0x61, 0x1A, 0xA8, 0xB9, 0x61, 0x1A,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0xB9, 0x61, 0x1A, 0xA8, 0xB9, 0x61, 0x1A,
+                0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+                0x08, 0xA1, 0x40, 0x42, 0x48, 0x48, 0x48, 0x48,
+                0x7A, 0x7F, 0x59, 0xDC, 0x48, 0x48, 0x48, 0x48,
+                0x22, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x49, 0x00, 0x6E, 0x00, 0x74, 0x00, 0x65, 0x00,
+                0x72, 0x00, 0x61, 0x00, 0x63, 0x00, 0x74, 0x00,
+                0x69, 0x00, 0x76, 0x00, 0x65, 0x00, 0x55, 0x00,
+                0x73, 0x00, 0x65, 0x00, 0x72, 0x00, 0x73, 0x00,
+                0x00, 0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48,
+                0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48,
+                0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48,
+                0x05, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x0C, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05,
+                0x04, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x2C, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
+                0x80, 0x51, 0x01, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
+                0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0xAA, 0xAA, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0xB9, 0x61, 0x1A, 0xA8, 0xB9, 0x61, 0x1A,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0xB9, 0x61, 0x1A, 0xA8, 0xB9, 0x61, 0x1A,
+                0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+                0x2C, 0x01, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0xC1, 0xD9, 0x04,
+                0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48,
+                0x01, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48,
+            ]
+        )
+        # fmt: on
+        triggers = scheduled_tasks.TriggerSet.decode(buf)
+        self.assertIsNotNone(triggers)
+        if not triggers:
+            return
+        self.assertGreater(len(triggers.triggers), 0)
diff --git a/test/requirements-testing.txt b/test/requirements-testing.txt
index 7afe19b94..51c8f602c 100644
--- a/test/requirements-testing.txt
+++ b/test/requirements-testing.txt
@@ -6,5 +6,6 @@ pefile>=2017.8.1 #foo
 
 # This is required for the yara plugins
 yara-python>=3.8.0
+yara-x>=0.5.0
 
 pytest>=7.0.0
diff --git a/test/test_volatility.py b/test/test_volatility.py
index 6e54aa053..847be88d9 100644
--- a/test/test_volatility.py
+++ b/test/test_volatility.py
@@ -341,6 +341,17 @@ def test_linux_tty_check(image, volatility, python):
     assert out.count(b"\n") >= 5
     assert rc == 0
 
+def test_linux_sockstat(image, volatility, python):
+    rc, out, err = runvol_plugin("linux.sockstat.Sockstat", image, volatility, python)
+
+    assert out.count(b"AF_UNIX") >= 354
+    assert out.count(b"AF_BLUETOOTH") >= 5
+    assert out.count(b"AF_INET") >= 32
+    assert out.count(b"AF_INET6") >= 20
+    assert out.count(b"AF_PACKET") >= 1
+    assert out.count(b"AF_NETLINK") >= 43
+    assert rc == 0
+
 
 def test_linux_library_list(image, volatility, python):
     rc, out, err = runvol_plugin(
diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py
index 1209d7cdc..75b62abf6 100644
--- a/volatility3/cli/__init__.py
+++ b/volatility3/cli/__init__.py
@@ -235,18 +235,35 @@ class CommandLine:
             default=constants.CACHE_PATH,
             type=str,
         )
-        parser.add_argument(
+        isf_group = parser.add_mutually_exclusive_group()
+        isf_group.add_argument(
             "--offline",
             help="Do not search online for additional JSON files",
             default=False,
             action="store_true",
         )
+        isf_group.add_argument(
+            "-u",
+            "--remote-isf-url",
+            metavar="URL",
+            help="Search online for ISF json files",
+            default=constants.REMOTE_ISF_URL,
+            type=str,
+        )
         parser.add_argument(
             "--filters",
             help="List of filters to apply to the output (in the form of [+-]columname,pattern[!])",
             default=[],
             action="append",
         )
+        parser.add_argument(
+            "--hide-columns",
+            help="Case-insensitive space separated list of prefixes to determine which columns to hide in the output if provided",
+            default=None,
+            action="extend",
+            nargs="*",
+            type=str,
+        )
 
         parser.set_defaults(**default_config)
 
@@ -313,6 +330,8 @@ class CommandLine:
 
         if partial_args.offline:
             constants.OFFLINE = partial_args.offline
+        elif partial_args.remote_isf_url:
+            constants.REMOTE_ISF_URL = partial_args.remote_isf_url
 
         # Do the initialization
         ctx = contexts.Context()  # Construct a blank context
@@ -348,7 +367,9 @@ class CommandLine:
         )
         for plugin in sorted(plugin_list):
             plugin_parser = subparser.add_parser(
-                plugin, help=plugin_list[plugin].__doc__
+                plugin,
+                help=plugin_list[plugin].__doc__,
+                description=plugin_list[plugin].__doc__,
             )
             self.populate_requirements_argparse(plugin_parser, plugin_list[plugin])
 
@@ -477,6 +498,7 @@ class CommandLine:
                 grid = constructed.run()
                 renderer = renderers[args.renderer]()
                 renderer.filter = text_filter.CLIFilter(grid, args.filters)
+                renderer.column_hide_list = args.hide_columns
                 renderer.render(grid)
         except exceptions.VolatilityException as excp:
             self.process_exceptions(excp)
@@ -604,6 +626,10 @@ class CommandLine:
             caused_by = [
                 "A required python module is not installed (install the module and re-run)"
             ]
+        elif isinstance(excp, exceptions.RenderException):
+            general = "Volatility experienced an issue when rendering the output:"
+            detail = f"{excp}"
+            caused_by = ["An invalid renderer option, such as no visible columns"]
         else:
             general = "Volatility encountered an unexpected situation."
             detail = ""
diff --git a/volatility3/cli/text_filter.py b/volatility3/cli/text_filter.py
index 948e969df..3d69934e9 100644
--- a/volatility3/cli/text_filter.py
+++ b/volatility3/cli/text_filter.py
@@ -53,7 +53,7 @@ class CLIFilter:
         """Filters the row based on each of the column_filters"""
         if not self._filters:
             return False
-        found = any([column_filter.found(row) for column_filter in self._filters])
+        found = any(column_filter.found(row) for column_filter in self._filters)
         return not found
 
 
@@ -86,7 +86,7 @@ class ColumnFilter:
         otherwise it is filtered.
         """
         if self.column_num is None:
-            found = any([self.find(x) for x in row])
+            found = any(self.find(x) for x in row)
         else:
             found = self.find(row[self.column_num])
         if self.exclude:
diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py
index ab9e44141..96970d3ce 100644
--- a/volatility3/cli/text_renderer.py
+++ b/volatility3/cli/text_renderer.py
@@ -12,7 +12,7 @@ from functools import wraps
 from typing import Any, Callable, Dict, List, Tuple
 from volatility3.cli import text_filter
 
-from volatility3.framework import interfaces, renderers
+from volatility3.framework import exceptions, interfaces, renderers
 from volatility3.framework.renderers import format_hints
 
 vollog = logging.getLogger(__name__)
@@ -141,6 +141,30 @@ class CLIRenderer(interfaces.renderers.Renderer):
     name = "unnamed"
     structured_output = False
     filter: text_filter.CLIFilter = None
+    column_hide_list: list = None
+
+    def ignored_columns(
+        self,
+        grid: interfaces.renderers.TreeGrid,
+    ) -> List[interfaces.renderers.Column]:
+        ignored_column_list = []
+        if self.column_hide_list:
+            for column in grid.columns:
+                accept = True
+                for column_prefix in self.column_hide_list:
+                    if column.name.lower().startswith(column_prefix.lower()):
+                        accept = False
+                if not accept:
+                    ignored_column_list.append(column)
+        elif self.column_hide_list is None:
+            return []
+
+        if len(ignored_column_list) == len(grid.columns):
+            raise exceptions.RenderException("No visible columns to render")
+        vollog.info(
+            f"Hiding columns: {[column.name for column in ignored_column_list]}"
+        )
+        return ignored_column_list
 
 
 class QuickTextRenderer(CLIRenderer):
@@ -173,13 +197,23 @@ class QuickTextRenderer(CLIRenderer):
         outfd = sys.stdout
 
         line = []
+        ignore_columns = self.ignored_columns(grid)
         for column in grid.columns:
             # Ignore the type because namedtuples don't realize they have accessible attributes
-            line.append(f"{column.name}")
+            if column not in ignore_columns:
+                line.append(f"{column.name}")
         outfd.write("\n{}\n".format("\t".join(line)))
 
         def visitor(node: interfaces.renderers.TreeNode, accumulator):
-            if self.filter and self.filter.filter(node.values):
+            line = []
+            for column_index, column in enumerate(grid.columns):
+                renderer = self._type_renderers.get(
+                    column.type, self._type_renderers["default"]
+                )
+                if column not in ignore_columns:
+                    line.append(renderer(node.values[column_index]))
+
+            if self.filter and self.filter.filter(line):
                 return accumulator
 
             accumulator.write("\n")
@@ -188,13 +222,6 @@ class QuickTextRenderer(CLIRenderer):
                 "*" * max(0, node.path_depth - 1)
                 + ("" if (node.path_depth <= 1) else " ")
             )
-            line = []
-            for column_index in range(len(grid.columns)):
-                column = grid.columns[column_index]
-                renderer = self._type_renderers.get(
-                    column.type, self._type_renderers["default"]
-                )
-                line.append(renderer(node.values[column_index]))
             accumulator.write("{}".format("\t".join(line)))
             accumulator.flush()
             return accumulator
@@ -245,11 +272,13 @@ class CSVRenderer(CLIRenderer):
             grid: The TreeGrid object to render
         """
         outfd = sys.stdout
+        ignore_columns = self.ignored_columns(grid)
 
         header_list = ["TreeDepth"]
         for column in grid.columns:
             # Ignore the type because namedtuples don't realize they have accessible attributes
-            header_list.append(f"{column.name}")
+            if column not in ignore_columns:
+                header_list.append(f"{column.name}")
 
         writer = csv.DictWriter(
             outfd, header_list, lineterminator="\n", escapechar="\\"
@@ -259,12 +288,20 @@ class CSVRenderer(CLIRenderer):
         def visitor(node: interfaces.renderers.TreeNode, accumulator):
             # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case
             row = {"TreeDepth": str(max(0, node.path_depth - 1))}
-            for column_index in range(len(grid.columns)):
-                column = grid.columns[column_index]
+            line = []
+            for column_index, column in enumerate(grid.columns):
                 renderer = self._type_renderers.get(
                     column.type, self._type_renderers["default"]
                 )
                 row[f"{column.name}"] = renderer(node.values[column_index])
+                if column not in ignore_columns:
+                    line.append(row[f"{column.name}"])
+                else:
+                    del row[f"{column.name}"]
+
+            if self.filter and self.filter.filter(line):
+                return accumulator
+
             accumulator.writerow(row)
             return accumulator
 
@@ -298,6 +335,7 @@ class PrettyTextRenderer(CLIRenderer):
 
         sys.stderr.write("Formatting...\n")
 
+        ignore_columns = self.ignored_columns(grid)
         display_alignment = ">"
         column_separator = " | "
 
@@ -317,12 +355,9 @@ class PrettyTextRenderer(CLIRenderer):
                 max_column_widths.get(tree_indent_column, 0), node.path_depth
             )
 
-            if self.filter and self.filter.filter(node.values):
-                return accumulator
-
             line = {}
-            for column_index in range(len(grid.columns)):
-                column = grid.columns[column_index]
+            rendered_line = []
+            for column_index, column in enumerate(grid.columns):
                 renderer = self._type_renderers.get(
                     column.type, self._type_renderers["default"]
                 )
@@ -333,7 +368,13 @@ class PrettyTextRenderer(CLIRenderer):
                 max_column_widths[column.name] = max(
                     max_column_widths.get(column.name, len(column.name)), field_width
                 )
-                line[column] = data.split("\n")
+                if column not in ignore_columns:
+                    line[column] = data.split("\n")
+                rendered_line.append(data)
+
+            if self.filter and self.filter.filter(rendered_line):
+                return accumulator
+
             accumulator.append((node.path_depth, line))
             return accumulator
 
@@ -347,44 +388,49 @@ class PrettyTextRenderer(CLIRenderer):
         format_string_list = [
             "{0:<" + str(max_column_widths.get(tree_indent_column, 0)) + "s}"
         ]
-        for column_index in range(len(grid.columns)):
-            column = grid.columns[column_index]
-            format_string_list.append(
-                "{"
-                + str(column_index + 1)
-                + ":"
-                + display_alignment
-                + str(max_column_widths[column.name])
-                + "s}"
-            )
+        column_offset = 0
+        for column_index, column in enumerate(grid.columns):
+            if column not in ignore_columns:
+                format_string_list.append(
+                    "{"
+                    + str(column_index - column_offset + 1)
+                    + ":"
+                    + display_alignment
+                    + str(max_column_widths[column.name])
+                    + "s}"
+                )
+            else:
+                column_offset += 1
 
         format_string = column_separator.join(format_string_list) + "\n"
 
-        column_titles = [""] + [column.name for column in grid.columns]
+        column_titles = [""] + [
+            column.name for column in grid.columns if column not in ignore_columns
+        ]
+
         outfd.write(format_string.format(*column_titles))
         for depth, line in final_output:
             nums_line = max([len(line[column]) for column in line])
             for column in line:
-                line[column] = line[column] + ([""] * (nums_line - len(line[column])))
+                if column in ignore_columns:
+                    del line[column]
+                else:
+                    line[column] = line[column] + (
+                        [""] * (nums_line - len(line[column]))
+                    )
             for index in range(nums_line):
                 if index == 0:
                     outfd.write(
                         format_string.format(
                             "*" * depth,
-                            *[
-                                self.tab_stop(line[column][index])
-                                for column in grid.columns
-                            ],
+                            *[self.tab_stop(line[column][index]) for column in line],
                         )
                     )
                 else:
                     outfd.write(
                         format_string.format(
                             " " * depth,
-                            *[
-                                self.tab_stop(line[column][index])
-                                for column in grid.columns
-                            ],
+                            *[self.tab_stop(line[column][index]) for column in line],
                         )
                     )
 
@@ -430,6 +476,8 @@ class JsonRenderer(CLIRenderer):
             List[interfaces.renderers.TreeNode],
         ] = ({}, [])
 
+        ignore_columns = self.ignored_columns(grid)
+
         def visitor(
             node: interfaces.renderers.TreeNode,
             accumulator: Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]],
@@ -437,8 +485,10 @@ class JsonRenderer(CLIRenderer):
             # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case
             acc_map, final_tree = accumulator
             node_dict: Dict[str, Any] = {"__children": []}
-            for column_index in range(len(grid.columns)):
-                column = grid.columns[column_index]
+            line = []
+            for column_index, column in enumerate(grid.columns):
+                if column in ignore_columns:
+                    continue
                 renderer = self._type_renderers.get(
                     column.type, self._type_renderers["default"]
                 )
@@ -446,6 +496,11 @@ class JsonRenderer(CLIRenderer):
                 if isinstance(data, interfaces.renderers.BaseAbsentValue):
                     data = None
                 node_dict[column.name] = data
+                line.append(data)
+
+            if self.filter and self.filter.filter(line):
+                return accumulator
+
             if node.parent:
                 acc_map[node.parent.path]["__children"].append(node_dict)
             else:
diff --git a/volatility3/cli/volshell/__init__.py b/volatility3/cli/volshell/__init__.py
index 2bf1958e2..5172c5363 100644
--- a/volatility3/cli/volshell/__init__.py
+++ b/volatility3/cli/volshell/__init__.py
@@ -159,12 +159,21 @@ class VolShell(cli.CommandLine):
             default=constants.CACHE_PATH,
             type=str,
         )
-        parser.add_argument(
+        isf_group = parser.add_mutually_exclusive_group()
+        isf_group.add_argument(
             "--offline",
             help="Do not search online for additional JSON files",
             default=False,
             action="store_true",
         )
+        isf_group.add_argument(
+            "-u",
+            "--remote-isf-url",
+            metavar="URL",
+            help="Search online for ISF json files",
+            default=constants.REMOTE_ISF_URL,
+            type=str,
+        )
 
         # Volshell specific flags
         os_specific = parser.add_mutually_exclusive_group(required=False)
@@ -236,6 +245,8 @@ class VolShell(cli.CommandLine):
 
         if partial_args.offline:
             constants.OFFLINE = partial_args.offline
+        elif partial_args.remote_isf_url:
+            constants.REMOTE_ISF_URL = partial_args.remote_isf_url
 
         # Do the initialization
         ctx = contexts.Context()  # Construct a blank context
diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py
index b95129d19..82c470e1a 100644
--- a/volatility3/cli/volshell/generic.py
+++ b/volatility3/cli/volshell/generic.py
@@ -14,7 +14,7 @@ from urllib import parse, request
 from volatility3.cli import text_renderer, volshell
 from volatility3.framework import exceptions, interfaces, objects, plugins, renderers
 from volatility3.framework.configuration import requirements
-from volatility3.framework.layers import intel, physical, resources
+from volatility3.framework.layers import intel, physical, resources, scanners
 
 try:
     import capstone
@@ -29,6 +29,8 @@ class Volshell(interfaces.plugins.PluginInterface):
 
     _required_framework_version = (2, 0, 0)
 
+    DEFAULT_NUM_DISPLAY_BYTES = 128
+
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.__current_layer: Optional[str] = None
@@ -58,7 +60,7 @@ class Volshell(interfaces.plugins.PluginInterface):
         ]
 
     def run(
-        self, additional_locals: Dict[str, Any] = None
+        self, additional_locals: Dict[str, Any] = {}
     ) -> interfaces.renderers.TreeGrid:
         """Runs the interactive volshell plugin.
 
@@ -94,7 +96,10 @@ class Volshell(interfaces.plugins.PluginInterface):
 """
 
         sys.ps1 = f"({self.current_layer}) >>> "
-        self.__console = code.InteractiveConsole(locals=self._construct_locals_dict())
+        # Dict self._construct_locals_dict() will have priority on keys
+        combined_locals = additional_locals.copy()
+        combined_locals.update(self._construct_locals_dict())
+        self.__console = code.InteractiveConsole(locals=combined_locals)
         # Since we have to do work to add the option only once for all different modes of volshell, we can't
         # rely on the default having been set
         if self.config.get("script", None) is not None:
@@ -112,7 +117,7 @@ class Volshell(interfaces.plugins.PluginInterface):
 
         variables = []
         print("\nMethods:")
-        for aliases, item in self.construct_locals():
+        for aliases, item in sorted(self.construct_locals()):
             name = ", ".join(aliases)
             if item.__doc__ and callable(item):
                 print(f"* {name}")
@@ -125,8 +130,7 @@ class Volshell(interfaces.plugins.PluginInterface):
             print(f"  {var}")
 
     def construct_locals(self) -> List[Tuple[List[str], Any]]:
-        """Returns a dictionary listing the functions to be added to the
-        environment."""
+        """Returns a listing of the functions to be added to the environment."""
         return [
             (["dt", "display_type"], self.display_type),
             (["db", "display_bytes"], self.display_bytes),
@@ -147,6 +151,7 @@ class Volshell(interfaces.plugins.PluginInterface):
             (["cc", "create_configurable"], self.create_configurable),
             (["lf", "load_file"], self.load_file),
             (["rs", "run_script"], self.run_script),
+            (["rx", "regex_scan"], self.regex_scan),
         ]
 
     def _construct_locals_dict(self) -> Dict[str, Any]:
@@ -266,27 +271,52 @@ class Volshell(interfaces.plugins.PluginInterface):
             self.__current_kernel_name = kernel_name
         print(f"Current kernel : {self.current_kernel_name}")
 
-    def display_bytes(self, offset, count=128, layer_name=None):
+    def display_bytes(self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None):
         """Displays byte values and ASCII characters"""
         remaining_data = self._read_data(offset, count=count, layer_name=layer_name)
         self._display_data(offset, remaining_data)
 
-    def display_quadwords(self, offset, count=128, layer_name=None):
+    def display_quadwords(
+        self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None
+    ):
         """Displays quad-word values (8 bytes) and corresponding ASCII characters"""
         remaining_data = self._read_data(offset, count=count, layer_name=layer_name)
         self._display_data(offset, remaining_data, format_string="Q")
 
-    def display_doublewords(self, offset, count=128, layer_name=None):
+    def display_doublewords(
+        self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None
+    ):
         """Displays double-word values (4 bytes) and corresponding ASCII characters"""
         remaining_data = self._read_data(offset, count=count, layer_name=layer_name)
         self._display_data(offset, remaining_data, format_string="I")
 
-    def display_words(self, offset, count=128, layer_name=None):
+    def display_words(self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None):
         """Displays word values (2 bytes) and corresponding ASCII characters"""
         remaining_data = self._read_data(offset, count=count, layer_name=layer_name)
         self._display_data(offset, remaining_data, format_string="H")
 
-    def disassemble(self, offset, count=128, layer_name=None, architecture=None):
+    def regex_scan(self, pattern, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None):
+        """Scans for regex pattern in layer using RegExScanner."""
+        if not isinstance(pattern, bytes):
+            raise TypeError("pattern must be bytes, e.g. rx(b'pattern')")
+        layer_name_to_scan = layer_name or self.current_layer
+        for offset in self.context.layers[layer_name_to_scan].scan(
+            scanner=scanners.RegExScanner(pattern),
+            context=self.context,
+        ):
+            remaining_data = self._read_data(
+                offset, count=count, layer_name=layer_name_to_scan
+            )
+            self._display_data(offset, remaining_data)
+            print("")
+
+    def disassemble(
+        self,
+        offset,
+        count=DEFAULT_NUM_DISPLAY_BYTES,
+        layer_name=None,
+        architecture=None,
+    ):
         """Disassembles a number of instructions from the code at offset"""
         remaining_data = self._read_data(offset, count=count, layer_name=layer_name)
         if not has_capstone:
@@ -529,7 +559,7 @@ class Volshell(interfaces.plugins.PluginInterface):
                 val, interfaces.configuration.BasicTypes
             ) and not isinstance(val, list):
                 if not isinstance(val, list) or all(
-                    [isinstance(x, interfaces.configuration.BasicTypes) for x in val]
+                    isinstance(x, interfaces.configuration.BasicTypes) for x in val
                 ):
                     raise TypeError(
                         "Configurable values must be simple types (int, bool, str, bytes)"
diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py
index 74db773cf..51310bfa2 100644
--- a/volatility3/framework/__init__.py
+++ b/volatility3/framework/__init__.py
@@ -7,7 +7,7 @@ import glob
 import sys
 import zipfile
 
-required_python_version = (3, 7, 3)
+required_python_version = (3, 8, 0)
 if (
     sys.version_info.major != required_python_version[0]
     or sys.version_info.minor < required_python_version[1]
diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py
index 06b2111b4..7f38a23e1 100644
--- a/volatility3/framework/automagic/pdbscan.py
+++ b/volatility3/framework/automagic/pdbscan.py
@@ -209,10 +209,8 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface):
             try:
                 kvp = vlayer.mapping(kvo, 0)
                 if any(
-                    [
-                        (p == kernel["mz_offset"] and layer_name == physical_layer_name)
-                        for (_, _, p, _, layer_name) in kvp
-                    ]
+                    (p == kernel["mz_offset"] and layer_name == physical_layer_name)
+                    for (_, _, p, _, layer_name) in kvp
                 ):
                     return (virtual_layer_name, kvo, kernel)
                 else:
diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py
index 1c0622574..86e1aac52 100644
--- a/volatility3/framework/configuration/requirements.py
+++ b/volatility3/framework/configuration/requirements.py
@@ -161,7 +161,7 @@ class ListRequirement(interfaces.configuration.RequirementInterface):
                 "TypeError - Too many values provided to list option.",
             )
             return {config_path: self}
-        if not all([isinstance(element, self.element_type) for element in value]):
+        if not all(isinstance(element, self.element_type) for element in value):
             vollog.log(
                 constants.LOGLEVEL_V,
                 "TypeError - At least one element in the list is not of the correct type.",
@@ -181,7 +181,7 @@ class ChoiceRequirement(interfaces.configuration.RequirementInterface):
         """
         super().__init__(*args, **kwargs)
         if not isinstance(choices, list) or any(
-            [not isinstance(choice, str) for choice in choices]
+            not isinstance(choice, str) for choice in choices
         ):
             raise TypeError("ChoiceRequirement takes a list of strings as choices")
         self.choices = choices
@@ -410,11 +410,9 @@ class TranslationLayerRequirement(
         args = {"context": context, "config_path": config_path, "name": name}
 
         if any(
-            [
-                subreq.unsatisfied(context, config_path)
-                for subreq in self.requirements.values()
-                if not subreq.optional
-            ]
+            subreq.unsatisfied(context, config_path)
+            for subreq in self.requirements.values()
+            if not subreq.optional
         ):
             return None
 
@@ -485,11 +483,9 @@ class SymbolTableRequirement(
         args = {"context": context, "config_path": config_path, "name": name}
 
         if any(
-            [
-                subreq.unsatisfied(context, config_path)
-                for subreq in self.requirements.values()
-                if not subreq.optional
-            ]
+            subreq.unsatisfied(context, config_path)
+            for subreq in self.requirements.values()
+            if not subreq.optional
         ):
             return None
 
@@ -527,12 +523,14 @@ class VersionRequirement(interfaces.configuration.RequirementInterface):
     def __init__(
         self,
         name: str,
-        description: str = None,
+        description: Optional[str] = None,
         default: bool = False,
         optional: bool = False,
         component: Type[interfaces.configuration.VersionableInterface] = None,
         version: Optional[Tuple[int, ...]] = None,
     ) -> None:
+        if description is None:
+            description = f"Version {'.'.join([str(x) for x in version])} dependency on {component.__module__}.{component.__name__} unmet"
         super().__init__(
             name=name, description=description, default=default, optional=optional
         )
@@ -544,15 +542,51 @@ class VersionRequirement(interfaces.configuration.RequirementInterface):
         self._version = version
 
     def unsatisfied(
-        self, context: interfaces.context.ContextInterface, config_path: str
+        self,
+        context: interfaces.context.ContextInterface,
+        config_path: str,
+        accumulator: Optional[
+            List[interfaces.configuration.VersionableInterface]
+        ] = None,
     ) -> Dict[str, interfaces.configuration.RequirementInterface]:
         # Mypy doesn't appreciate our classproperty implementation, self._plugin.version has no type
         config_path = interfaces.configuration.path_join(config_path, self.name)
         if not self.matches_required(self._version, self._component.version):
             return {config_path: self}
+
+        recurse = True
+        if accumulator is None:
+            accumulator = set([self._component])
+        else:
+            if self._component in accumulator:
+                recurse = False
+            else:
+                accumulator.add(self._component)
+
+        # Check for child requirements
+        if (
+            issubclass(self._component, interfaces.configuration.ConfigurableInterface)
+            and recurse
+        ):
+            result = {}
+            for requirement in self._component.get_requirements():
+                if not requirement.optional and isinstance(
+                    requirement, VersionRequirement
+                ):
+                    result.update(
+                        requirement.unsatisfied(
+                            context, config_path, accumulator.copy()
+                        )
+                    )
+
+            if result:
+                result.update({config_path: self})
+                return result
+
         context.config[interfaces.configuration.path_join(config_path, self.name)] = (
             True
         )
+
         return {}
 
     @classmethod
@@ -672,11 +706,9 @@ class ModuleRequirement(
         args = {"context": context, "config_path": config_path, "name": name}
 
         if any(
-            [
-                subreq.unsatisfied(context, config_path)
-                for subreq in self.requirements.values()
-                if not subreq.optional
-            ]
+            subreq.unsatisfied(context, config_path)
+            for subreq in self.requirements.values()
+            if not subreq.optional
         ):
             return None
 
diff --git a/volatility3/framework/constants/__init__.py b/volatility3/framework/constants/__init__.py
index 8743a64b0..27fae4ba1 100644
--- a/volatility3/framework/constants/__init__.py
+++ b/volatility3/framework/constants/__init__.py
@@ -134,4 +134,5 @@ def __getattr__(name):
     ]:
         warnings.warn(f"{name} is deprecated", FutureWarning)
         return globals()[f"{deprecated_tag}{name}"]
-    return None
+
+    return getattr(__import__(__name__), name)
diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py
index f219fb0af..ce803a687 100644
--- a/volatility3/framework/constants/_version.py
+++ b/volatility3/framework/constants/_version.py
@@ -1,6 +1,6 @@
 # We use the SemVer 2.0.0 versioning scheme
 VERSION_MAJOR = 2  # Number of releases of the library with a breaking change
-VERSION_MINOR = 8  # Number of changes that only add to the interface
+VERSION_MINOR = 11  # Number of changes that only add to the interface
 VERSION_PATCH = 0  # Number of changes that do not change the interface
 VERSION_SUFFIX = ""
 
diff --git a/volatility3/framework/constants/architectures.py b/volatility3/framework/constants/architectures.py
new file mode 100644
index 000000000..a8822d7d3
--- /dev/null
+++ b/volatility3/framework/constants/architectures.py
@@ -0,0 +1,21 @@
+from volatility3.framework.layers import intel
+
+WIN_ARCHS = ["Intel32", "Intel64"]
+"""Windows supported architectures"""
+WIN_ARCHS_LAYERS = [intel.Intel]
+"""Windows supported architectures layers"""
+
+LINUX_ARCHS = ["Intel32", "Intel64"]
+"""Linux supported architectures"""
+LINUX_ARCHS_LAYERS = [intel.Intel]
+"""Linux supported architectures layers"""
+
+MAC_ARCHS = ["Intel32", "Intel64"]
+"""Mac supported architectures"""
+MAC_ARCHS_LAYERS = [intel.Intel]
+"""Mac supported architectures layers"""
+
+FRAMEWORK_ARCHS = ["Intel32", "Intel64"]
+"""Framework supported architectures"""
+FRAMEWORK_ARCHS_LAYERS = [intel.Intel]
+"""Framework supported architectures layers"""
diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py
index 3eabc2341..6e49e6f37 100644
--- a/volatility3/framework/constants/linux/__init__.py
+++ b/volatility3/framework/constants/linux/__init__.py
@@ -5,7 +5,7 @@
 
 Linux-specific values that aren't found in debug symbols
 """
-from enum import IntEnum
+from enum import IntEnum, Flag
 
 KERNEL_NAME = "__kernel__"
 
@@ -302,3 +302,53 @@ class ELF_CLASS(IntEnum):
     ELFCLASSNONE = 0
     ELFCLASS32 = 1
     ELFCLASS64 = 2
+
+
+# PTrace
+PT_OPT_FLAG_SHIFT = 3
+
+PTRACE_EVENT_FORK = 1
+PTRACE_EVENT_VFORK = 2
+PTRACE_EVENT_CLONE = 3
+PTRACE_EVENT_EXEC = 4
+PTRACE_EVENT_VFORK_DONE = 5
+PTRACE_EVENT_EXIT = 6
+PTRACE_EVENT_SECCOMP = 7
+
+PTRACE_O_EXITKILL = 1 << 20
+PTRACE_O_SUSPEND_SECCOMP = 1 << 21
+
+
+class PT_FLAGS(Flag):
+    "PTrace flags"
+    PT_PTRACED = 0x00001
+    PT_SEIZED = 0x10000
+
+    PT_TRACESYSGOOD = 1 << (PT_OPT_FLAG_SHIFT + 0)
+    PT_TRACE_FORK = 1 << (PT_OPT_FLAG_SHIFT + PTRACE_EVENT_FORK)
+    PT_TRACE_VFORK = 1 << (PT_OPT_FLAG_SHIFT + PTRACE_EVENT_VFORK)
+    PT_TRACE_CLONE = 1 << (PT_OPT_FLAG_SHIFT + PTRACE_EVENT_CLONE)
+    PT_TRACE_EXEC = 1 << (PT_OPT_FLAG_SHIFT + PTRACE_EVENT_EXEC)
+    PT_TRACE_VFORK_DONE = 1 << (PT_OPT_FLAG_SHIFT + PTRACE_EVENT_VFORK_DONE)
+    PT_TRACE_EXIT = 1 << (PT_OPT_FLAG_SHIFT + PTRACE_EVENT_EXIT)
+    PT_TRACE_SECCOMP = 1 << (PT_OPT_FLAG_SHIFT + PTRACE_EVENT_SECCOMP)
+
+    PT_EXITKILL = PTRACE_O_EXITKILL << PT_OPT_FLAG_SHIFT
+    PT_SUSPEND_SECCOMP = PTRACE_O_SUSPEND_SECCOMP << PT_OPT_FLAG_SHIFT
+
+    @property
+    def flags(self) -> str:
+        """Returns the ptrace flags string"""
+        return str(self).replace(self.__class__.__name__ + ".", "")
+
+
+# Boot time
+NSEC_PER_SEC = 1e9
+
+
+# Valid sizes for modules. Note that the Linux kernel does not define these values; they
+# are based on empirical observations of typical memory allocations for kernel modules.
+# We use this to verify that the found module falls within reasonable limits.
+MODULE_MAXIMUM_CORE_SIZE = 20000000
+MODULE_MAXIMUM_CORE_TEXT_SIZE = 20000000
+MODULE_MINIMUM_SIZE = 4096
diff --git a/volatility3/framework/contexts/__init__.py b/volatility3/framework/contexts/__init__.py
index 4c169728c..6961d9328 100644
--- a/volatility3/framework/contexts/__init__.py
+++ b/volatility3/framework/contexts/__init__.py
@@ -245,7 +245,7 @@ class Module(interfaces.context.ModuleInterface):
         """
         if constants.BANG not in object_type:
             object_type = self.symbol_table_name + constants.BANG + object_type
-        else:
+        elif not object_type.startswith(self.symbol_table_name + constants.BANG):
             raise ValueError(
                 "Cannot reference another module when constructing an object"
             )
diff --git a/volatility3/framework/exceptions.py b/volatility3/framework/exceptions.py
index f8701683b..c44fb4f2e 100644
--- a/volatility3/framework/exceptions.py
+++ b/volatility3/framework/exceptions.py
@@ -126,3 +126,7 @@ class OfflineException(VolatilityException):
 
     def __str__(self):
         return f"Volatility 3 is offline: unable to access {self._url}"
+
+
+class RenderException(VolatilityException):
+    """Thrown if there is an error during rendering"""
diff --git a/volatility3/framework/interfaces/configuration.py b/volatility3/framework/interfaces/configuration.py
index 3bb3cb019..da0a4556c 100644
--- a/volatility3/framework/interfaces/configuration.py
+++ b/volatility3/framework/interfaces/configuration.py
@@ -494,8 +494,7 @@ class SimpleTypeRequirement(RequirementInterface):
         """Validates the instance requirement based upon its
         `instance_type`."""
         config_path = path_join(config_path, self.name)
-
-        value = self.config_value(context, config_path, None)
+        value = self.config_value(context, config_path, self.default)
         if not isinstance(value, self.instance_type):
             vollog.log(
                 constants.LOGLEVEL_V,
@@ -536,7 +535,7 @@ class ClassRequirement(RequirementInterface):
         """Checks to see if a class can be recovered."""
         config_path = path_join(config_path, self.name)
 
-        value = self.config_value(context, config_path, None)
+        value = self.config_value(context, config_path, self.default)
         self._cls = None
         if value is not None and isinstance(value, str):
             if "." in value:
diff --git a/volatility3/framework/interfaces/context.py b/volatility3/framework/interfaces/context.py
index a95f2b464..8b5e816e8 100644
--- a/volatility3/framework/interfaces/context.py
+++ b/volatility3/framework/interfaces/context.py
@@ -191,6 +191,9 @@ class ModuleInterface(interfaces.configuration.ConfigurableInterface):
                 self._native_layer_name
             ].build_configuration()
 
+        # Modules are constructable, and therefore require a class configuration variable
+        config["class"] = self.__class__.__module__ + "." + self.__class__.__name__
+
         for subconfig in subconfigs:
             for req in subconfigs[subconfig]:
                 config[interfaces.configuration.path_join(subconfig, req)] = subconfigs[
diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py
index ab568b927..51d25510d 100644
--- a/volatility3/framework/interfaces/objects.py
+++ b/volatility3/framework/interfaces/objects.py
@@ -216,7 +216,7 @@ class ObjectInterface(metaclass=abc.ABCMeta):
         Args:
             member_names: List of names to test as to members with those names validity
         """
-        return all([self.has_valid_member(member_name) for member_name in member_names])
+        return all(self.has_valid_member(member_name) for member_name in member_names)
 
     class VolTemplateProxy(metaclass=abc.ABCMeta):
         """A container for proxied methods that the ObjectTemplate of this
diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py
index b969b952b..2b0df5372 100644
--- a/volatility3/framework/layers/intel.py
+++ b/volatility3/framework/layers/intel.py
@@ -270,10 +270,8 @@ class Intel(linear.LinearlyMappedLayer):
         try:
             # TODO: Consider reimplementing this, since calls to mapping can call is_valid
             return all(
-                [
-                    self._context.layers[layer].is_valid(mapped_offset)
-                    for _, _, mapped_offset, _, layer in self.mapping(offset, length)
-                ]
+                self._context.layers[layer].is_valid(mapped_offset)
+                for _, _, mapped_offset, _, layer in self.mapping(offset, length)
             )
         except exceptions.InvalidAddressException:
             return False
diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py
index 9841d2bb0..609832886 100644
--- a/volatility3/framework/layers/registry.py
+++ b/volatility3/framework/layers/registry.py
@@ -170,6 +170,9 @@ class RegistryHive(linear.LinearlyMappedLayer):
         return_list specifies whether the return result will be a single
         node (default) or a list of nodes from root to the current node
         (if return_list is true).
+
+        Raises RegistryFormatException if an invalid structure is encountered
+        Raises KeyError if the key is not found
         """
         root_node = self.get_node(self.root_cell_offset)
         if not root_node.vol.type_name.endswith(constants.BANG + "_CM_KEY_NODE"):
@@ -318,10 +321,8 @@ class RegistryHive(linear.LinearlyMappedLayer):
         with contextlib.suppress(exceptions.InvalidAddressException):
             # Pass this to the lower layers for now
             return all(
-                [
-                    self.context.layers[layer].is_valid(offset, length)
-                    for (_, _, offset, length, layer) in self.mapping(offset, length)
-                ]
+                self.context.layers[layer].is_valid(offset, length)
+                for (_, _, offset, length, layer) in self.mapping(offset, length)
             )
         return False
 
diff --git a/volatility3/framework/layers/segmented.py b/volatility3/framework/layers/segmented.py
index e8c067072..9825ae15c 100644
--- a/volatility3/framework/layers/segmented.py
+++ b/volatility3/framework/layers/segmented.py
@@ -51,10 +51,8 @@ class NonLinearlySegmentedLayer(
         try:
             base_layer = self._context.layers[self._base_layer]
             return all(
-                [
-                    base_layer.is_valid(mapped_offset)
-                    for _i, _i, mapped_offset, _i, _s in self.mapping(offset, length)
-                ]
+                base_layer.is_valid(mapped_offset)
+                for _i, _i, mapped_offset, _i, _s in self.mapping(offset, length)
             )
         except exceptions.InvalidAddressException:
             return False
diff --git a/volatility3/framework/objects/__init__.py b/volatility3/framework/objects/__init__.py
index 316a30bec..b65277067 100644
--- a/volatility3/framework/objects/__init__.py
+++ b/volatility3/framework/objects/__init__.py
@@ -928,10 +928,8 @@ class AggregateType(interfaces.objects.ObjectInterface):
             members, collections.abc.Mapping
         ), f"{agg_name} members parameter must be a mapping: {type(members)}"
         assert all(
-            [
-                (isinstance(member, tuple) and len(member) == 2)
-                for member in members.values()
-            ]
+            (isinstance(member, tuple) and len(member) == 2)
+            for member in members.values()
         ), f"{agg_name} members must be a tuple of relative_offsets and templates"
 
     def member(self, attr: str = "member") -> object:
diff --git a/volatility3/framework/plugins/linux/boottime.py b/volatility3/framework/plugins/linux/boottime.py
new file mode 100644
index 000000000..8f63ee7f8
--- /dev/null
+++ b/volatility3/framework/plugins/linux/boottime.py
@@ -0,0 +1,98 @@
+# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+import datetime
+from typing import List, Tuple, Iterable
+
+
+from volatility3.framework import interfaces, renderers
+from volatility3.framework.configuration import requirements
+from volatility3.plugins import timeliner
+from volatility3.plugins.linux import pslist
+
+
+class Boottime(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
+    """Shows the time the system was started"""
+
+    _required_framework_version = (2, 11, 0)
+
+    _version = (1, 0, 0)
+
+    @classmethod
+    def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Linux kernel",
+                architectures=["Intel32", "Intel64"],
+            ),
+            requirements.PluginRequirement(
+                name="pslist", plugin=pslist.PsList, version=(2, 3, 0)
+            ),
+        ]
+
+    @classmethod
+    def get_time_namespaces_bootime(
+        cls,
+        context: interfaces.context.ContextInterface,
+        vmlinux_module_name: str,
+    ) -> Iterable[Tuple[int, int, int, str, datetime.datetime]]:
+        """Enumerates tasks' boot times based on their time namespaces.
+
+        Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
+            vmlinux_module_name: The name of the kernel module on which to operate
+            pids: Pid list
+            unique: Filter unique time namespaces
+
+        Yields:
+            A tuple with the fields to show in the plugin output.
+        """
+        time_namespace_ids = set()
+        for task in pslist.PsList.list_tasks(context, vmlinux_module_name):
+            time_namespace_id = task.get_time_namespace_id()
+            # If it cannot get the time namespace i.e. kernels < 5.6, this still works
+            # using None to just get the first tasks
+            if time_namespace_id in time_namespace_ids:
+                continue
+            time_namespace_ids.add(time_namespace_id)
+            boottime = task.get_boottime(root_time_namespace=False)
+
+            fields = (
+                time_namespace_id,
+                boottime,
+            )
+            yield fields
+
+    def _generator(self):
+        for (
+            time_namespace_id,
+            boottime,
+        ) in self.get_time_namespaces_bootime(
+            self.context,
+            self.config["kernel"],
+        ):
+            fields = [
+                time_namespace_id or renderers.NotAvailableValue(),
+                boottime,
+            ]
+            yield 0, fields
+
+    def generate_timeline(self):
+        for (
+            time_namespace_id,
+            boottime,
+        ) in self.get_time_namespaces_bootime(
+            self.context,
+            self.config["kernel"],
+        ):
+            description = f"System boot time for time namespace {time_namespace_id}"
+
+            yield description, timeliner.TimeLinerType.CREATED, boottime
+
+    def run(self):
+        columns = [
+            ("TIME NS", int),
+            ("Boot Time", datetime.datetime),
+        ]
+        return renderers.TreeGrid(columns, self._generator())
diff --git a/volatility3/framework/plugins/linux/check_afinfo.py b/volatility3/framework/plugins/linux/check_afinfo.py
index 7fced6acd..201a443f7 100644
--- a/volatility3/framework/plugins/linux/check_afinfo.py
+++ b/volatility3/framework/plugins/linux/check_afinfo.py
@@ -53,9 +53,7 @@ class Check_afinfo(plugins.PluginInterface):
     def _check_afinfo(self, var_name, var, op_members, seq_members):
         # check if object has a least one of the members used for analysis by this function
         required_members = ["seq_fops", "seq_ops", "seq_show"]
-        has_required_member = any(
-            [var.has_member(member) for member in required_members]
-        )
+        has_required_member = any(var.has_member(member) for member in required_members)
         if not has_required_member:
             vollog.debug(
                 f"{var_name} object at {hex(var.vol.offset)} had none of the required members: {', '.join([member for member in required_members])}"
diff --git a/volatility3/framework/plugins/linux/check_creds.py b/volatility3/framework/plugins/linux/check_creds.py
index ab6ee4935..b7f73c3eb 100644
--- a/volatility3/framework/plugins/linux/check_creds.py
+++ b/volatility3/framework/plugins/linux/check_creds.py
@@ -2,20 +2,19 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
-import logging
-
 from volatility3.framework import interfaces, renderers
+from volatility3.framework.renderers import format_hints
 from volatility3.framework.configuration import requirements
 from volatility3.plugins.linux import pslist
 
-vollog = logging.getLogger(__name__)
-
 
 class Check_creds(interfaces.plugins.PluginInterface):
     """Checks if any processes are sharing credential structures"""
 
     _required_framework_version = (2, 0, 0)
 
+    _version = (2, 0, 0)
+
     @classmethod
     def get_requirements(cls):
         return [
@@ -46,20 +45,28 @@ class Check_creds(interfaces.plugins.PluginInterface):
         tasks = pslist.PsList.list_tasks(self.context, vmlinux.name)
 
         for task in tasks:
-            cred_addr = task.cred.dereference().vol.offset
+            task_cred_ptr = task.cred
+            if not (task_cred_ptr and task_cred_ptr.is_readable()):
+                continue
 
-            if cred_addr not in creds:
-                creds[cred_addr] = []
+            cred_addr = task_cred_ptr.dereference().vol.offset
 
+            creds.setdefault(cred_addr, [])
             creds[cred_addr].append(task.pid)
 
-        for _, pids in creds.items():
+        for cred_addr, pids in creds.items():
             if len(pids) > 1:
-                pid_str = ""
-                for pid in pids:
-                    pid_str = pid_str + f"{pid:d}, "
-                pid_str = pid_str[:-2]
-                yield (0, [str(pid_str)])
+                pid_str = ", ".join([str(pid) for pid in pids])
+
+                fields = [
+                    format_hints.Hex(cred_addr),
+                    pid_str,
+                ]
+                yield (0, fields)
 
     def run(self):
-        return renderers.TreeGrid([("PIDs", str)], self._generator())
+        headers = [
+            ("CredVAddr", format_hints.Hex),
+            ("PIDs", str),
+        ]
+        return renderers.TreeGrid(headers, self._generator())
diff --git a/volatility3/framework/plugins/linux/ebpf.py b/volatility3/framework/plugins/linux/ebpf.py
new file mode 100644
index 000000000..2267dd922
--- /dev/null
+++ b/volatility3/framework/plugins/linux/ebpf.py
@@ -0,0 +1,73 @@
+# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+import logging
+from typing import List
+
+from volatility3.framework import renderers, interfaces, exceptions
+from volatility3.framework.renderers import format_hints
+from volatility3.framework.interfaces import plugins
+from volatility3.framework.configuration import requirements
+
+vollog = logging.getLogger(__name__)
+
+
+class EBPF(plugins.PluginInterface):
+    """Enumerate eBPF programs"""
+
+    _required_framework_version = (2, 0, 0)
+
+    _version = (1, 0, 0)
+
+    @classmethod
+    def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Linux kernel",
+                architectures=["Intel32", "Intel64"],
+            ),
+        ]
+
+    def get_ebpf_programs(
+        self,
+        context: interfaces.context.ContextInterface,
+        vmlinux_module_name: str,
+    ) -> interfaces.objects.ObjectInterface:
+        """Enumerate eBPF programs walking its IDR.
+
+        Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
+            vmlinux_module_name: The name of the kernel module on which to operate
+        Yields:
+            eBPF program objects
+        """
+        vmlinux = context.modules[vmlinux_module_name]
+
+        if not vmlinux.has_symbol("prog_idr"):
+            raise exceptions.VolatilityException(
+                "Cannot find the eBPF prog idr. Unsupported kernel"
+            )
+
+        prog_idr = vmlinux.object_from_symbol("prog_idr")
+        for page_addr in prog_idr.get_entries():
+            bpf_prog = vmlinux.object("bpf_prog", offset=page_addr, absolute=True)
+            yield bpf_prog
+
+    def _generator(self):
+        for prog in self.get_ebpf_programs(self.context, self.config["kernel"]):
+            prog_addr = prog.vol.offset
+            prog_type = prog.get_type() or renderers.NotAvailableValue()
+            prog_tag = prog.get_tag() or renderers.NotAvailableValue()
+            prog_name = prog.get_name() or renderers.NotAvailableValue()
+            fields = (format_hints.Hex(prog_addr), prog_name, prog_tag, prog_type)
+            yield (0, fields)
+
+    def run(self):
+        headers = [
+            ("Address", format_hints.Hex),
+            ("Name", str),
+            ("Tag", str),
+            ("Type", str),
+        ]
+        return renderers.TreeGrid(headers, self._generator())
diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py
new file mode 100644
index 000000000..fd4b28943
--- /dev/null
+++ b/volatility3/framework/plugins/linux/hidden_modules.py
@@ -0,0 +1,246 @@
+# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+import logging
+from typing import List, Set, Tuple, Iterable
+from volatility3.framework import renderers, interfaces, exceptions, objects
+from volatility3.framework.constants import architectures
+from volatility3.framework.renderers import format_hints
+from volatility3.framework.configuration import requirements
+from volatility3.plugins.linux import lsmod
+
+vollog = logging.getLogger(__name__)
+
+
+class Hidden_modules(interfaces.plugins.PluginInterface):
+    """Carves memory to find hidden kernel modules"""
+
+    _required_framework_version = (2, 10, 0)
+
+    _version = (1, 0, 0)
+
+    @classmethod
+    def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Linux kernel",
+                architectures=architectures.LINUX_ARCHS,
+            ),
+            requirements.PluginRequirement(
+                name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0)
+            ),
+        ]
+
+    @staticmethod
+    def get_modules_memory_boundaries(
+        context: interfaces.context.ContextInterface,
+        vmlinux_module_name: str,
+    ) -> Tuple[int]:
+        """Determine the boundaries of the module allocation area
+
+        Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
+            vmlinux_module_name: The name of the kernel module on which to operate
+
+        Returns:
+            A tuple containing the minimum and maximum addresses for the module allocation area.
+        """
+        vmlinux = context.modules[vmlinux_module_name]
+        if vmlinux.has_symbol("mod_tree"):
+            # Kernel >= 5.19    58d208de3e8d87dbe196caf0b57cc58c7a3836ca
+            mod_tree = vmlinux.object_from_symbol("mod_tree")
+            modules_addr_min = mod_tree.addr_min
+            modules_addr_max = mod_tree.addr_max
+        elif vmlinux.has_symbol("module_addr_min"):
+            # 2.6.27 <= kernel < 5.19   3a642e99babe0617febb6f402e1e063479f489db
+            modules_addr_min = vmlinux.object_from_symbol("module_addr_min")
+            modules_addr_max = vmlinux.object_from_symbol("module_addr_max")
+
+            if isinstance(modules_addr_min, objects.Void):
+                raise exceptions.VolatilityException(
+                    "Your ISF symbols lack type information. You may need to update the"
+                    "ISF using the latest version of dwarf2json"
+                )
+        else:
+            raise exceptions.VolatilityException(
+                "Cannot find the module memory allocation area. Unsupported kernel"
+            )
+
+        return modules_addr_min, modules_addr_max
+
+    @classmethod
+    def _get_module_address_alignment(
+        cls,
+        context: interfaces.context.ContextInterface,
+        vmlinux_module_name: str,
+    ) -> int:
+        """Obtain the module memory address alignment.
+
+        struct module is aligned to the L1 cache line, which is typically 64 bytes for most
+        common i386/AMD64/ARM64 configurations. In some cases, it can be 128 bytes, but this
+        will still work.
+
+        Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
+            vmlinux_module_name: The name of the kernel module on which to operate
+
+        Returns:
+            The struct module alignment
+        """
+        # FIXME: When dwarf2json/ISF supports type alignments. Read it directly from the type metadata
+        # Additionally, while 'context' and 'vmlinux_module_name' are currently unused, they will be
+        # essential for retrieving type metadata in the future.
+        return 64
+
+    @staticmethod
+    def _validate_alignment_patterns(
+        addresses: Iterable[int],
+        address_alignment: int,
+    ) -> bool:
+        """Check if the memory addresses meet our alignments patterns
+
+        Args:
+            addresses: Iterable with the address values
+            address_alignment: Number of bytes for alignment validation
+
+        Returns:
+            True if all the addresses meet the alignment
+        """
+        return all(addr % address_alignment == 0 for addr in addresses)
+
+    @classmethod
+    def get_hidden_modules(
+        cls,
+        context: interfaces.context.ContextInterface,
+        vmlinux_module_name: str,
+        known_module_addresses: Set[int],
+        modules_memory_boundaries: Tuple,
+    ) -> Iterable[interfaces.objects.ObjectInterface]:
+        """Enumerate hidden modules by taking advantage of memory address alignment patterns
+
+        This technique is much faster and uses less memory than the traditional scan method
+        in Volatility2, but it doesn't work with older kernels.
+
+        From kernels 4.2 struct module allocation are aligned to the L1 cache line size.
+        In i386/amd64/arm64 this is typically 64 bytes. However, this can be changed in
+        the Linux kernel configuration via CONFIG_X86_L1_CACHE_SHIFT. The alignment can
+        also be obtained from the DWARF info i.e. DW_AT_alignment<64>, but dwarf2json
+        doesn't support this feature yet.
+        In kernels < 4.2, alignment attributes are absent in the struct module, meaning
+        alignment cannot be guaranteed. Therefore, for older kernels, it's better to use
+        the traditional scan technique.
+
+        Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
+            vmlinux_module_name: The name of the kernel module on which to operate
+            known_module_addresses: Set with known module addresses
+            modules_memory_boundaries: Minimum and maximum address boundaries for module allocation.
+        Yields:
+            module objects
+        """
+        vmlinux = context.modules[vmlinux_module_name]
+        vmlinux_layer = context.layers[vmlinux.layer_name]
+
+        module_addr_min, module_addr_max = modules_memory_boundaries
+        module_address_alignment = cls._get_module_address_alignment(
+            context, vmlinux_module_name
+        )
+        if not cls._validate_alignment_patterns(
+            known_module_addresses, module_address_alignment
+        ):
+            vollog.warning(
+                f"Module addresses aren't aligned to {module_address_alignment} bytes. "
+                "Switching to 1 byte aligment scan method."
+            )
+            module_address_alignment = 1
+
+        mkobj_offset = vmlinux.get_type("module").relative_child_offset("mkobj")
+        mod_offset = vmlinux.get_type("module_kobject").relative_child_offset("mod")
+        offset_to_mkobj_mod = mkobj_offset + mod_offset
+        mod_member_template = vmlinux.get_type("module_kobject").child_template("mod")
+        mod_size = mod_member_template.size
+        mod_member_data_format = mod_member_template.data_format
+
+        for module_addr in range(
+            module_addr_min, module_addr_max, module_address_alignment
+        ):
+            if module_addr in known_module_addresses:
+                continue
+
+            try:
+                # This is just a pre-filter. Module readability and consistency are verified in module.is_valid()
+                self_referential_bytes = vmlinux_layer.read(
+                    module_addr + offset_to_mkobj_mod, mod_size
+                )
+                self_referential = objects.convert_data_to_value(
+                    self_referential_bytes, int, mod_member_data_format
+                )
+                if self_referential != module_addr:
+                    continue
+            except (
+                exceptions.PagedInvalidAddressException,
+                exceptions.InvalidAddressException,
+            ):
+                continue
+
+            module = vmlinux.object("module", offset=module_addr, absolute=True)
+            if module and module.is_valid():
+                yield module
+
+    @classmethod
+    def get_lsmod_module_addresses(
+        cls,
+        context: interfaces.context.ContextInterface,
+        vmlinux_module_name: str,
+    ) -> Set[int]:
+        """Obtain a set the known module addresses from linux.lsmod plugin
+
+        Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
+            vmlinux_module_name: The name of the kernel module on which to operate
+
+        Returns:
+            A set containing known kernel module addresses
+        """
+        vmlinux = context.modules[vmlinux_module_name]
+        vmlinux_layer = context.layers[vmlinux.layer_name]
+
+        known_module_addresses = {
+            vmlinux_layer.canonicalize(module.vol.offset)
+            for module in lsmod.Lsmod.list_modules(context, vmlinux_module_name)
+        }
+        return known_module_addresses
+
+    def _generator(self):
+        vmlinux_module_name = self.config["kernel"]
+        known_module_addresses = self.get_lsmod_module_addresses(
+            self.context, vmlinux_module_name
+        )
+        modules_memory_boundaries = self.get_modules_memory_boundaries(
+            self.context, vmlinux_module_name
+        )
+        for module in self.get_hidden_modules(
+            self.context,
+            vmlinux_module_name,
+            known_module_addresses,
+            modules_memory_boundaries,
+        ):
+            module_addr = module.vol.offset
+            module_name = module.get_name() or renderers.NotAvailableValue()
+            fields = (format_hints.Hex(module_addr), module_name)
+            yield (0, fields)
+
+    def run(self):
+        if self.context.symbol_space.verify_table_versions(
+            "dwarf2json", lambda version, _: (not version) or version < (0, 8, 0)
+        ):
+            raise exceptions.SymbolSpaceError(
+                "Invalid symbol table, please ensure the ISF table produced by dwarf2json was created with version 0.8.0 or later"
+            )
+
+        headers = [
+            ("Address", format_hints.Hex),
+            ("Name", str),
+        ]
+        return renderers.TreeGrid(headers, self._generator())
diff --git a/volatility3/framework/plugins/linux/kthreads.py b/volatility3/framework/plugins/linux/kthreads.py
new file mode 100644
index 000000000..2e51b4688
--- /dev/null
+++ b/volatility3/framework/plugins/linux/kthreads.py
@@ -0,0 +1,115 @@
+# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+import logging
+from typing import List
+
+from volatility3.framework import constants, exceptions, interfaces, renderers
+from volatility3.framework.configuration import requirements
+from volatility3.framework.interfaces import plugins
+from volatility3.framework.renderers import format_hints
+from volatility3.framework.symbols import linux
+from volatility3.framework.constants import architectures
+from volatility3.framework.objects import utility
+from volatility3.plugins.linux import pslist, lsmod
+
+vollog = logging.getLogger(__name__)
+
+
+class Kthreads(plugins.PluginInterface):
+    """Enumerates kthread functions"""
+
+    _required_framework_version = (2, 11, 0)
+
+    _version = (1, 0, 0)
+
+    @classmethod
+    def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Linux kernel",
+                architectures=architectures.LINUX_ARCHS,
+            ),
+            requirements.VersionRequirement(
+                name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0)
+            ),
+            requirements.PluginRequirement(
+                name="pslist", plugin=pslist.PsList, version=(2, 3, 0)
+            ),
+            requirements.PluginRequirement(
+                name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0)
+            ),
+        ]
+
+    def _generator(self):
+        vmlinux = self.context.modules[self.config["kernel"]]
+
+        modules = lsmod.Lsmod.list_modules(self.context, vmlinux.name)
+        handlers = linux.LinuxUtilities.generate_kernel_handler_info(
+            self.context, vmlinux.name, modules
+        )
+
+        kthread_type = vmlinux.get_type(
+            vmlinux.symbol_table_name + constants.BANG + "kthread"
+        )
+
+        if not kthread_type.has_member("threadfn"):
+            raise exceptions.VolatilityException(
+                "Unsupported kthread implementation. This plugin only works with kernels >= 5.8"
+            )
+
+        for task in pslist.PsList.list_tasks(
+            self.context, vmlinux.name, include_threads=True
+        ):
+            if not task.is_kernel_thread:
+                continue
+
+            if task.has_member("worker_private"):
+                # kernels >= 5.17 e32cf5dfbe227b355776948b2c9b5691b84d1cbd
+                ktread_base_pointer = task.worker_private
+            else:
+                # 5.8 <= kernels < 5.17 in 52782c92ac85c4e393eb4a903a62e6c24afa633f threadfn
+                # was added to struct kthread. task.set_child_tid is safe on those versions.
+                ktread_base_pointer = task.set_child_tid
+
+            if not ktread_base_pointer.is_readable():
+                continue
+
+            kthread = ktread_base_pointer.dereference().cast("kthread")
+            threadfn = kthread.threadfn
+            if not (threadfn and threadfn.is_readable()):
+                continue
+
+            task_name = utility.array_to_string(task.comm)
+
+            # kernels >= 5.17 in d6986ce24fc00b0638bd29efe8fb7ba7619ed2aa full_name was added to kthread
+            thread_name = (
+                utility.pointer_to_string(kthread.full_name, count=255)
+                if kthread.has_member("full_name")
+                else task_name
+            )
+            module_name, symbol_name = linux.LinuxUtilities.lookup_module_address(
+                vmlinux, handlers, threadfn
+            )
+
+            fields = [
+                task.pid,
+                thread_name,
+                format_hints.Hex(threadfn),
+                module_name,
+                symbol_name,
+            ]
+            yield 0, fields
+
+    def run(self):
+        return renderers.TreeGrid(
+            [
+                ("TID", int),
+                ("Thread Name", str),
+                ("Handler Address", format_hints.Hex),
+                ("Module", str),
+                ("Symbol", str),
+            ],
+            self._generator(),
+        )
diff --git a/volatility3/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py
index d970ad8a9..42b447dfb 100644
--- a/volatility3/framework/plugins/linux/lsof.py
+++ b/volatility3/framework/plugins/linux/lsof.py
@@ -1,10 +1,10 @@
-# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
+# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-"""A module containing a collection of plugins that produce data typically
-found in Linux's /proc file system."""
 import logging
-from typing import List, Callable
+import datetime
+import dataclasses
+from typing import List, Callable, Tuple, Iterable
 
 from volatility3.framework import renderers, interfaces, constants
 from volatility3.framework.configuration import requirements
@@ -12,16 +12,105 @@ from volatility3.framework.interfaces import plugins
 from volatility3.framework.objects import utility
 from volatility3.framework.symbols import linux
 from volatility3.plugins.linux import pslist
+from volatility3.plugins import timeliner
 
 vollog = logging.getLogger(__name__)
 
 
-class Lsof(plugins.PluginInterface):
-    """Lists all memory maps for all processes."""
+@dataclasses.dataclass
+class FDUser:
+    """FD user representation, featuring augmented information and formatted fields.
+    This is the data the plugin will eventually display.
+    """
+
+    task_tgid: int
+    task_tid: int
+    task_comm: str
+    fd_num: int
+    full_path: str
+    device: str = dataclasses.field(default=renderers.NotAvailableValue())
+    inode_num: int = dataclasses.field(default=renderers.NotAvailableValue())
+    inode_type: str = dataclasses.field(default=renderers.NotAvailableValue())
+    file_mode: str = dataclasses.field(default=renderers.NotAvailableValue())
+    change_time: datetime.datetime = dataclasses.field(
+        default=renderers.NotAvailableValue()
+    )
+    modification_time: datetime.datetime = dataclasses.field(
+        default=renderers.NotAvailableValue()
+    )
+    access_time: datetime.datetime = dataclasses.field(
+        default=renderers.NotAvailableValue()
+    )
+    inode_size: int = dataclasses.field(default=renderers.NotAvailableValue())
+
+
+@dataclasses.dataclass
+class FDInternal:
+    """FD internal representation containing only the core objects
+
+    Fields:
+        task: 'task_struct' object
+        fd_fields: FD fields as obtained from LinuxUtilities.files_descriptors_for_process()
+    """
+
+    task: interfaces.objects.ObjectInterface
+    fd_fields: Tuple[int, int, str]
+
+    def to_user(self) -> FDUser:
+        """Augment the FD information to be presented to the user
+
+        Returns:
+            An InodeUser dataclass
+        """
+        # Ensure all types are atomic immutable. Otherwise, astuple() will take a long
+        # time doing a deepcopy of the Volatility objects.
+        task_tgid = int(self.task.tgid)
+        task_tid = int(self.task.pid)
+        task_comm = utility.array_to_string(self.task.comm)
+        fd_num, filp, full_path = self.fd_fields
+        fd_num = int(fd_num)
+        full_path = str(full_path)
+        inode = filp.get_inode()
+        if inode:
+            superblock_ptr = inode.i_sb
+            if superblock_ptr and superblock_ptr.is_readable():
+                device = f"{superblock_ptr.major}:{superblock_ptr.minor}"
+            else:
+                device = renderers.NotAvailableValue()
+
+            fd_user = FDUser(
+                task_tgid=task_tgid,
+                task_tid=task_tid,
+                task_comm=task_comm,
+                fd_num=fd_num,
+                full_path=full_path,
+                device=device,
+                inode_num=int(inode.i_ino),
+                inode_type=inode.get_inode_type() or renderers.UnparsableValue(),
+                file_mode=inode.get_file_mode(),
+                change_time=inode.get_change_time(),
+                modification_time=inode.get_modification_time(),
+                access_time=inode.get_access_time(),
+                inode_size=int(inode.i_size),
+            )
+        else:
+            # We use the dataclasses' default values
+            fd_user = FDUser(
+                task_tgid=task_tgid,
+                task_tid=task_tid,
+                task_comm=task_comm,
+                fd_num=fd_num,
+                full_path=full_path,
+            )
+
+        return fd_user
+
+
+class Lsof(plugins.PluginInterface, timeliner.TimeLinerInterface):
+    """Lists open files for each processes."""
 
     _required_framework_version = (2, 0, 0)
-
-    _version = (1, 1, 0)
+    _version = (2, 0, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -49,41 +138,82 @@ class Lsof(plugins.PluginInterface):
     def list_fds(
         cls,
         context: interfaces.context.ContextInterface,
-        symbol_table: str,
+        vmlinux_module_name: str,
         filter_func: Callable[[int], bool] = lambda _: False,
-    ):
-        linuxutils_symbol_table = None  # type: ignore
-        for task in pslist.PsList.list_tasks(context, symbol_table, filter_func):
+    ) -> Iterable[FDInternal]:
+        """Enumerates open file descriptors in tasks
+
+        Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
+            vmlinux_module_name: The name of the kernel module on which to operate
+            filter_func: A function which takes a process object and returns True if the process
+                should be ignored/filtered
+
+        Yields:
+            A FDInternal object
+        """
+        linuxutils_symbol_table = None
+        for task in pslist.PsList.list_tasks(
+            context, vmlinux_module_name, filter_func, include_threads=True
+        ):
             if linuxutils_symbol_table is None:
                 if constants.BANG not in task.vol.type_name:
                     raise ValueError("Task is not part of a symbol table")
                 linuxutils_symbol_table = task.vol.type_name.split(constants.BANG)[0]
 
-            task_comm = utility.array_to_string(task.comm)
-            pid = int(task.pid)
-
             fd_generator = linux.LinuxUtilities.files_descriptors_for_process(
                 context, linuxutils_symbol_table, task
             )
 
             for fd_fields in fd_generator:
-                yield pid, task_comm, task, fd_fields
+                yield FDInternal(task=task, fd_fields=fd_fields)
 
-    def _generator(self, pids, symbol_table):
+    def _generator(self, pids, vmlinux_module_name):
         filter_func = pslist.PsList.create_pid_filter(pids)
-        fds_generator = self.list_fds(
-            self.context, symbol_table, filter_func=filter_func
-        )
-
-        for pid, task_comm, _task, fd_fields in fds_generator:
-            fd_num, _filp, full_path = fd_fields
-
-            fields = (pid, task_comm, fd_num, full_path)
-            yield (0, fields)
+        for fd_internal in self.list_fds(
+            self.context, vmlinux_module_name, filter_func=filter_func
+        ):
+            fd_user = fd_internal.to_user()
+            yield (0, dataclasses.astuple(fd_user))
 
     def run(self):
         pids = self.config.get("pid", None)
-        symbol_table = self.config["kernel"]
+        vmlinux_module_name = self.config["kernel"]
 
-        tree_grid_args = [("PID", int), ("Process", str), ("FD", int), ("Path", str)]
-        return renderers.TreeGrid(tree_grid_args, self._generator(pids, symbol_table))
+        tree_grid_args = [
+            ("PID", int),
+            ("TID", int),
+            ("Process", str),
+            ("FD", int),
+            ("Path", str),
+            ("Device", str),
+            ("Inode", int),
+            ("Type", str),
+            ("Mode", str),
+            ("Changed", datetime.datetime),
+            ("Modified", datetime.datetime),
+            ("Accessed", datetime.datetime),
+            ("Size", int),
+        ]
+        return renderers.TreeGrid(
+            tree_grid_args, self._generator(pids, vmlinux_module_name)
+        )
+
+    def generate_timeline(self):
+        pids = self.config.get("pid", None)
+        vmlinux_module_name = self.config["kernel"]
+
+        filter_func = pslist.PsList.create_pid_filter(pids)
+        for fd_internal in self.list_fds(
+            self.context, vmlinux_module_name, filter_func=filter_func
+        ):
+            fd_user = fd_internal.to_user()
+
+            description = (
+                f"Process {fd_user.task_comm} ({fd_user.task_tgid}/{fd_user.task_tid}) "
+                f"Open '{fd_user.full_path}'"
+            )
+
+            yield description, timeliner.TimeLinerType.CHANGED, fd_user.change_time
+            yield description, timeliner.TimeLinerType.MODIFIED, fd_user.modification_time
+            yield description, timeliner.TimeLinerType.ACCESSED, fd_user.access_time
diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py
index cf06ee0cc..18f3dcd56 100644
--- a/volatility3/framework/plugins/linux/malfind.py
+++ b/volatility3/framework/plugins/linux/malfind.py
@@ -5,7 +5,7 @@
 from typing import List
 import logging
 from volatility3.framework import constants, interfaces
-from volatility3.framework import renderers
+from volatility3.framework import renderers, symbols
 from volatility3.framework.configuration import requirements
 from volatility3.framework.objects import utility
 from volatility3.framework.renderers import format_hints
@@ -63,15 +63,9 @@ class Malfind(interfaces.plugins.PluginInterface):
     def _generator(self, tasks):
         # determine if we're on a 32 or 64 bit kernel
         vmlinux = self.context.modules[self.config["kernel"]]
-        if (
-            self.context.symbol_space.get_type(
-                vmlinux.symbol_table_name + constants.BANG + "pointer"
-            ).size
-            == 4
-        ):
-            is_32bit_arch = True
-        else:
-            is_32bit_arch = False
+        is_32bit_arch = not symbols.symbol_table_is_64bit(
+            self.context, vmlinux.symbol_table_name
+        )
 
         for task in tasks:
             process_name = utility.array_to_string(task.comm)
diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py
index da743bb60..2499f009e 100644
--- a/volatility3/framework/plugins/linux/mountinfo.py
+++ b/volatility3/framework/plugins/linux/mountinfo.py
@@ -37,7 +37,7 @@ class MountInfo(plugins.PluginInterface):
 
     _required_framework_version = (2, 2, 0)
 
-    _version = (1, 0, 0)
+    _version = (1, 2, 1)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -143,10 +143,10 @@ class MountInfo(plugins.PluginInterface):
             sb_opts,
         )
 
+    @staticmethod
     def _get_tasks_mountpoints(
-        self,
         tasks: Iterable[interfaces.objects.ObjectInterface],
-        filtered_by_pids: bool,
+        filtered_by_pids: bool = False,
     ):
         seen_mountpoints = set()
         for task in tasks:
@@ -184,8 +184,8 @@ class MountInfo(plugins.PluginInterface):
         self,
         tasks: Iterable[interfaces.objects.ObjectInterface],
         mnt_ns_ids: List[int],
-        mount_format: bool,
-        filtered_by_pids: bool,
+        mount_format: bool = False,
+        filtered_by_pids: bool = False,
     ) -> Iterable[Tuple[int, Tuple]]:
         show_filter_warning = False
         for task, mnt, mnt_ns_id in self._get_tasks_mountpoints(
@@ -247,6 +247,42 @@ class MountInfo(plugins.PluginInterface):
                 "Could not filter by mount namespace id. This field is not available in this kernel."
             )
 
+    @classmethod
+    def get_superblocks(
+        cls,
+        context: interfaces.context.ContextInterface,
+        vmlinux_module_name: str,
+    ) -> Iterable[interfaces.objects.ObjectInterface]:
+        """Yield file system superblocks based on the task's mounted filesystems.
+
+        Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
+            vmlinux_module_name: The name of the kernel module on which to operate
+
+        Yields:
+            super_block: Kernel's struct super_block object
+        """
+        # No filter so that we get all the mount namespaces from all tasks
+        tasks = pslist.PsList.list_tasks(context, vmlinux_module_name)
+
+        seen_sb_ptr = set()
+        for task, mnt, _mnt_ns_id in cls._get_tasks_mountpoints(tasks):
+            path_root = linux.LinuxUtilities.get_path_mnt(task, mnt)
+            if not path_root:
+                continue
+
+            sb_ptr = mnt.get_mnt_sb()
+            if not (sb_ptr and sb_ptr.is_readable()):
+                continue
+
+            if sb_ptr in seen_sb_ptr:
+                continue
+            seen_sb_ptr.add(sb_ptr)
+
+            superblock = sb_ptr.dereference()
+
+            yield superblock, path_root
+
     def run(self):
         pids = self.config.get("pids")
         mount_ns_ids = self.config.get("mntns")
diff --git a/volatility3/framework/plugins/linux/netfilter.py b/volatility3/framework/plugins/linux/netfilter.py
index d392a8371..73496dfd9 100644
--- a/volatility3/framework/plugins/linux/netfilter.py
+++ b/volatility3/framework/plugins/linux/netfilter.py
@@ -174,7 +174,7 @@ class AbstractNetfilter(ABC):
             priority [int]: Priority
             hook_ops_hook [int]: Hook address
             module_name [str]: Linux kernel module name
-            hooked [bool]: hooked?
+            hooked [bool]: "True" if the network stack has been hijacked
         """
         for netns, net in self.get_net_namespaces():
             for proto_idx, proto_name, hook_idx, hook_name in self._proto_hook_loop():
@@ -190,7 +190,7 @@ class AbstractNetfilter(ABC):
                         priority = int(hook_ops.priority)
                         hook_ops_hook = hook_ops.hook
                         module_name = self.get_module_name_for_address(hook_ops_hook)
-                        hooked = module_name is not None
+                        hooked = module_name is None
 
                         yield netns, proto_name, hook_name, priority, hook_ops_hook, module_name, hooked
 
@@ -675,7 +675,7 @@ class Netfilter(interfaces.plugins.PluginInterface):
 
     _required_framework_version = (2, 0, 0)
 
-    _version = (1, 0, 0)
+    _version = (1, 1, 0)
 
     _required_linuxutils_version = (2, 1, 0)
     _required_lsmod_version = (2, 0, 0)
@@ -714,7 +714,7 @@ class Netfilter(interfaces.plugins.PluginInterface):
             hook_name,
             priority,
             format_hints.Hex(hook_func),
-            module_name,
+            module_name or renderers.NotAvailableValue(),
             str(hooked),
         )
 
diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py
new file mode 100644
index 000000000..005fc9acc
--- /dev/null
+++ b/volatility3/framework/plugins/linux/pagecache.py
@@ -0,0 +1,538 @@
+# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+
+import math
+import logging
+import datetime
+from dataclasses import dataclass, astuple
+from typing import List, Set, Type, Iterable
+
+from volatility3.framework import renderers, interfaces
+from volatility3.framework.renderers import format_hints
+from volatility3.framework.interfaces import plugins
+from volatility3.framework.configuration import requirements
+from volatility3.plugins import timeliner
+from volatility3.plugins.linux import mountinfo
+
+vollog = logging.getLogger(__name__)
+
+
+@dataclass
+class InodeUser:
+    """Inode user representation, featuring augmented information and formatted fields.
+    This is the data the plugin will eventually display.
+    """
+
+    superblock_addr: int
+    mountpoint: str
+    device: str
+    inode_num: int
+    inode_addr: int
+    type: str
+    inode_pages: int
+    cached_pages: int
+    file_mode: str
+    access_time: str
+    modification_time: str
+    change_time: str
+    path: str
+
+
+@dataclass
+class InodeInternal:
+    """Inode internal representation containing only the core objects
+
+    Fields:
+        superblock: 'super_block' struct
+        mountpoint: Superblock mountpoint path
+        inode: 'inode' struct
+        path: Dentry full path
+    """
+
+    superblock: interfaces.objects.ObjectInterface
+    mountpoint: str
+    inode: interfaces.objects.ObjectInterface
+    path: str
+
+    def to_user(
+        self, kernel_layer: interfaces.layers.TranslationLayerInterface
+    ) -> InodeUser:
+        """Augment the inode information to be presented to the user
+
+        Args:
+            kernel_layer: The kernel layer to obtain the page size
+
+        Returns:
+            An InodeUser dataclass
+        """
+        # Ensure all types are atomic immutable. Otherwise, astuple() will take a long
+        # time doing a deepcopy of the Volatility objects.
+        superblock_addr = self.superblock.vol.offset
+        device = f"{self.superblock.major}:{self.superblock.minor}"
+        inode_num = int(self.inode.i_ino)
+        inode_addr = self.inode.vol.offset
+        inode_type = self.inode.get_inode_type() or renderers.UnparsableValue()
+        # Round up the number of pages to fit the inode's size
+        inode_pages = int(math.ceil(self.inode.i_size / float(kernel_layer.page_size)))
+        cached_pages = int(self.inode.i_mapping.nrpages)
+        file_mode = self.inode.get_file_mode()
+        access_time_dt = self.inode.get_access_time()
+        modification_time_dt = self.inode.get_modification_time()
+        change_time_dt = self.inode.get_change_time()
+
+        inode_user = InodeUser(
+            superblock_addr=superblock_addr,
+            mountpoint=self.mountpoint,
+            device=device,
+            inode_num=inode_num,
+            inode_addr=inode_addr,
+            type=inode_type,
+            inode_pages=inode_pages,
+            cached_pages=cached_pages,
+            file_mode=file_mode,
+            access_time=access_time_dt,
+            modification_time=modification_time_dt,
+            change_time=change_time_dt,
+            path=self.path,
+        )
+        return inode_user
+
+
+class Files(plugins.PluginInterface, timeliner.TimeLinerInterface):
+    """Lists files from memory"""
+
+    _required_framework_version = (2, 0, 0)
+
+    _version = (1, 0, 1)
+
+    @classmethod
+    def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Linux kernel",
+                architectures=["Intel32", "Intel64"],
+            ),
+            requirements.PluginRequirement(
+                name="mountinfo", plugin=mountinfo.MountInfo, version=(1, 2, 0)
+            ),
+            requirements.ListRequirement(
+                name="type",
+                description="List of space-separated file type filters i.e. --type REG DIR",
+                element_type=str,
+                optional=True,
+            ),
+            requirements.StringRequirement(
+                name="find",
+                description="Filename (full path) to find",
+                optional=True,
+            ),
+        ]
+
+    @staticmethod
+    def _follow_symlink(
+        inode: interfaces.objects.ObjectInterface,
+        symlink_path: str,
+    ) -> str:
+        """Follows (fast) symlinks (kernels >= 4.2.x).
+        Fast symlinks are filesystem agnostic.
+
+        Args:
+            inode: The inode (or pointer) to dump
+            symlink_path: The symlink name
+
+        Returns:
+            If it can resolve the symlink, it returns a string "symlink_path -> target_path"
+            Otherwise, it returns the same symlink_path
+        """
+        # i_link (fast symlinks) were introduced in 4.2
+        if inode and inode.is_link and inode.has_member("i_link") and inode.i_link:
+            i_link_str = inode.i_link.dereference().cast(
+                "string", max_length=255, encoding="utf-8", errors="replace"
+            )
+            symlink_path = f"{symlink_path} -> {i_link_str}"
+
+        return symlink_path
+
+    @classmethod
+    def _walk_dentry(
+        cls,
+        seen_dentries: Set[int],
+        root_dentry: interfaces.objects.ObjectInterface,
+        parent_dir: str,
+    ):
+        """Walks dentries recursively
+
+        Args:
+            seen_dentries: A set to ensure each dentry is processed only once
+            root_dentry: Root dentry object
+            parent_dir: Parent directory path
+
+        Yields:
+           file_path: Filename including path
+           dentry: Dentry object
+        """
+
+        for dentry in root_dentry.get_subdirs():
+            dentry_addr = dentry.vol.offset
+
+            # corruption
+            if dentry_addr == root_dentry.vol.offset:
+                continue
+
+            if dentry_addr in seen_dentries:
+                continue
+
+            seen_dentries.add(dentry_addr)
+
+            inode_ptr = dentry.d_inode
+            if not (inode_ptr and inode_ptr.is_readable()):
+                continue
+
+            inode = inode_ptr.dereference()
+            if not inode.is_valid():
+                continue
+
+            # This allows us to have consistent paths
+            if dentry.d_name.name:
+                basename = dentry.d_name.name_as_str()
+                # Do NOT use os.path.join() below
+                file_path = parent_dir + "/" + basename
+            else:
+                continue
+
+            yield file_path, dentry
+
+            if inode.is_dir:
+                yield from cls._walk_dentry(seen_dentries, dentry, parent_dir=file_path)
+
+    @classmethod
+    def get_inodes(
+        cls,
+        context: interfaces.context.ContextInterface,
+        vmlinux_module_name: str,
+    ) -> Iterable[InodeInternal]:
+        """Retrieves the inodes from the superblocks
+
+        Args:
+            context: The context that the plugin will operate within
+            vmlinux_module_name: The name of the kernel module on which to operate
+
+        Yields:
+            An InodeInternal object
+        """
+
+        superblocks_iter = mountinfo.MountInfo.get_superblocks(
+            context=context,
+            vmlinux_module_name=vmlinux_module_name,
+        )
+
+        seen_inodes = set()
+        seen_dentries = set()
+        for superblock, mountpoint in superblocks_iter:
+            parent_dir = "" if mountpoint == "/" else mountpoint
+
+            # Superblock root dentry
+            root_dentry_ptr = superblock.s_root
+            if not root_dentry_ptr:
+                continue
+
+            root_dentry = root_dentry_ptr.dereference()
+
+            # Dentry sanity check
+            if not root_dentry.is_root():
+                continue
+
+            # More dentry/inode sanity checks
+            root_inode_ptr = root_dentry.d_inode
+            if not (root_inode_ptr and root_inode_ptr.is_readable()):
+                continue
+
+            root_inode = root_inode_ptr.dereference()
+            if not root_inode.is_valid():
+                continue
+
+            # Inode already processed?
+            if root_inode_ptr in seen_inodes:
+                continue
+            seen_inodes.add(root_inode_ptr)
+
+            root_path = mountpoint
+
+            inode_in = InodeInternal(
+                superblock=superblock,
+                mountpoint=mountpoint,
+                inode=root_inode,
+                path=root_path,
+            )
+            yield inode_in
+
+            # Children
+            for file_path, file_dentry in cls._walk_dentry(
+                seen_dentries, root_dentry, parent_dir
+            ):
+                if not file_dentry:
+                    continue
+
+                # Dentry/inode sanity checks
+                file_inode_ptr = file_dentry.d_inode
+                if not (file_inode_ptr and file_inode_ptr.is_readable()):
+                    continue
+
+                file_inode = file_inode_ptr.dereference()
+                if not file_inode.is_valid():
+                    continue
+
+                # Inode already processed?
+                if file_inode_ptr in seen_inodes:
+                    continue
+                seen_inodes.add(file_inode_ptr)
+
+                file_path = cls._follow_symlink(file_inode_ptr, file_path)
+                inode_in = InodeInternal(
+                    superblock=superblock,
+                    mountpoint=mountpoint,
+                    inode=file_inode,
+                    path=file_path,
+                )
+                yield inode_in
+
+    def _generator(self):
+        vmlinux_module_name = self.config["kernel"]
+        vmlinux = self.context.modules[vmlinux_module_name]
+        vmlinux_layer = self.context.layers[vmlinux.layer_name]
+
+        inodes_iter = self.get_inodes(
+            context=self.context,
+            vmlinux_module_name=vmlinux_module_name,
+        )
+
+        types_filter = self.config["type"]
+        for inode_in in inodes_iter:
+            if types_filter and inode_in.inode.get_inode_type() not in types_filter:
+                continue
+
+            if self.config["find"]:
+                if inode_in.path == self.config["find"]:
+                    inode_out = inode_in.to_user(vmlinux_layer)
+                    yield (0, astuple(inode_out))
+                    break  # Only the first match
+            else:
+                inode_out = inode_in.to_user(vmlinux_layer)
+                yield (0, astuple(inode_out))
+
+    def generate_timeline(self):
+        """Generates tuples of (description, timestamp_type, timestamp)
+
+        These need not be generated in any particular order, sorting
+        will be done later
+        """
+        vmlinux_module_name = self.config["kernel"]
+        vmlinux = self.context.modules[vmlinux_module_name]
+        vmlinux_layer = self.context.layers[vmlinux.layer_name]
+
+        inodes_iter = self.get_inodes(
+            context=self.context,
+            vmlinux_module_name=vmlinux_module_name,
+        )
+
+        for inode_in in inodes_iter:
+            inode_out = inode_in.to_user(vmlinux_layer)
+            description = f"Cached Inode for {inode_out.path}"
+            yield description, timeliner.TimeLinerType.ACCESSED, inode_out.access_time
+            yield description, timeliner.TimeLinerType.MODIFIED, inode_out.modification_time
+            yield description, timeliner.TimeLinerType.CHANGED, inode_out.change_time
+
+    @staticmethod
+    def format_fields_with_headers(headers, generator):
+        """Uses the headers type to cast the fields obtained from the generator"""
+        for level, fields in generator:
+            formatted_fields = []
+            for header, field in zip(headers, fields):
+                header_type = header[1]
+
+                if isinstance(
+                    field, (header_type, interfaces.renderers.BaseAbsentValue)
+                ):
+                    formatted_field = field
+                else:
+                    formatted_field = header_type(field)
+
+                formatted_fields.append(formatted_field)
+            yield level, formatted_fields
+
+    def run(self):
+        headers = [
+            ("SuperblockAddr", format_hints.Hex),
+            ("MountPoint", str),
+            ("Device", str),
+            ("InodeNum", int),
+            ("InodeAddr", format_hints.Hex),
+            ("FileType", str),
+            ("InodePages", int),
+            ("CachedPages", int),
+            ("FileMode", str),
+            ("AccessTime", datetime.datetime),
+            ("ModificationTime", datetime.datetime),
+            ("ChangeTime", datetime.datetime),
+            ("FilePath", str),
+        ]
+
+        return renderers.TreeGrid(
+            headers, self.format_fields_with_headers(headers, self._generator())
+        )
+
+
+class InodePages(plugins.PluginInterface):
+    """Lists and recovers cached inode pages"""
+
+    _required_framework_version = (2, 0, 0)
+
+    _version = (1, 0, 1)
+
+    @classmethod
+    def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Linux kernel",
+                architectures=["Intel32", "Intel64"],
+            ),
+            requirements.PluginRequirement(
+                name="files", plugin=Files, version=(1, 0, 0)
+            ),
+            requirements.StringRequirement(
+                name="find",
+                description="Filename (full path) to find ",
+                optional=True,
+            ),
+            requirements.IntRequirement(
+                name="inode",
+                description="Inode address",
+                optional=True,
+            ),
+            requirements.StringRequirement(
+                name="dump",
+                description="Output file path",
+                optional=True,
+            ),
+        ]
+
+    @staticmethod
+    def write_inode_content_to_file(
+        inode: interfaces.objects.ObjectInterface,
+        filename: str,
+        open_method: Type[interfaces.plugins.FileHandlerInterface],
+        vmlinux_layer: interfaces.layers.TranslationLayerInterface,
+    ) -> None:
+        """Extracts the inode's contents from the page cache and saves them to a file
+
+        Args:
+            inode: The inode to dump
+            filename: Filename for writing the inode content
+            open_method: class for constructing output files
+            vmlinux_layer: The kernel layer to obtain the page size
+        """
+        if not inode.is_reg:
+            vollog.error("The inode is not a regular file")
+            return
+
+        # By using truncate/seek, provided the filesystem supports it, a sparse file will be
+        # created, saving both disk space and I/O time.
+        # Additionally, using the page index will guarantee that each page is written at the
+        # appropriate file position.
+        try:
+            with open_method(filename) as f:
+                inode_size = inode.i_size
+                f.truncate(inode_size)
+
+                for page_idx, page_content in inode.get_contents():
+                    current_fp = page_idx * vmlinux_layer.page_size
+                    max_length = inode_size - current_fp
+                    page_bytes = page_content[:max_length]
+                    if current_fp + len(page_bytes) > inode_size:
+                        vollog.error(
+                            "Page out of file bounds: inode 0x%x, inode size %d, page index %d",
+                            inode.vol.offset,
+                            inode_size,
+                            page_idx,
+                        )
+                    f.seek(current_fp)
+                    f.write(page_bytes)
+
+        except IOError as e:
+            vollog.error("Unable to write to file (%s): %s", filename, e)
+
+    def _generator(self):
+        vmlinux_module_name = self.config["kernel"]
+        vmlinux = self.context.modules[vmlinux_module_name]
+        vmlinux_layer = self.context.layers[vmlinux.layer_name]
+
+        if self.config["inode"] and self.config["find"]:
+            vollog.error("Cannot use --inode and --find simultaneously")
+            return
+
+        if self.config["find"]:
+            inodes_iter = Files.get_inodes(
+                context=self.context,
+                vmlinux_module_name=vmlinux_module_name,
+            )
+            for inode_in in inodes_iter:
+                if inode_in.path == self.config["find"]:
+                    inode = inode_in.inode
+                    break  # Only the first match
+
+        elif self.config["inode"]:
+            inode = vmlinux.object("inode", self.config["inode"], absolute=True)
+        else:
+            vollog.error("You must use either --inode or --find")
+            return
+
+        if not inode.is_valid():
+            vollog.error("Invalid inode at 0x%x", inode.vol.offset)
+            return
+
+        if not inode.is_reg:
+            vollog.error("The inode is not a regular file")
+            return
+
+        inode_size = inode.i_size
+        for page_obj in inode.get_pages():
+            page_vaddr = page_obj.vol.offset
+            page_paddr = page_obj.to_paddr()
+            page_mapping_addr = page_obj.mapping
+            page_index = int(page_obj.index)
+            page_file_offset = page_index * vmlinux_layer.page_size
+            dump_safe = page_file_offset < inode_size
+            page_flags_list = page_obj.get_flags_list()
+            page_flags = ",".join([x.replace("PG_", "") for x in page_flags_list])
+            fields = (
+                page_vaddr,
+                page_paddr,
+                page_mapping_addr,
+                page_index,
+                dump_safe,
+                page_flags,
+            )
+
+            yield 0, fields
+
+        if self.config["dump"]:
+            filename = self.config["dump"]
+            vollog.info("[*] Writing inode at 0x%x to '%s'", inode.vol.offset, filename)
+            self.write_inode_content_to_file(inode, filename, self.open, vmlinux_layer)
+
+    def run(self):
+        headers = [
+            ("PageVAddr", format_hints.Hex),
+            ("PagePAddr", format_hints.Hex),
+            ("MappingAddr", format_hints.Hex),
+            ("Index", int),
+            ("DumpSafe", bool),
+            ("Flags", str),
+        ]
+
+        return renderers.TreeGrid(
+            headers, Files.format_fields_with_headers(headers, self._generator())
+        )
diff --git a/volatility3/framework/plugins/linux/pidhashtable.py b/volatility3/framework/plugins/linux/pidhashtable.py
new file mode 100644
index 000000000..edafe97e0
--- /dev/null
+++ b/volatility3/framework/plugins/linux/pidhashtable.py
@@ -0,0 +1,255 @@
+# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+
+import logging
+from typing import List
+
+from volatility3.framework import renderers, interfaces, constants
+from volatility3.framework.symbols import linux
+from volatility3.framework.renderers import format_hints
+from volatility3.framework.interfaces import plugins
+from volatility3.framework.configuration import requirements
+from volatility3.plugins.linux import pslist
+
+vollog = logging.getLogger(__name__)
+
+
+class PIDHashTable(plugins.PluginInterface):
+    """Enumerates processes through the PID hash table"""
+
+    _required_framework_version = (2, 0, 0)
+
+    _version = (1, 0, 1)
+
+    @classmethod
+    def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Linux kernel",
+                architectures=["Intel32", "Intel64"],
+            ),
+            requirements.PluginRequirement(
+                name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
+            ),
+            requirements.VersionRequirement(
+                name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0)
+            ),
+            requirements.BooleanRequirement(
+                name="decorate_comm",
+                description="Show `user threads` comm in curly brackets, and `kernel threads` comm in square brackets",
+                optional=True,
+                default=False,
+            ),
+        ]
+
+    def _is_valid_task(self, task) -> bool:
+        return bool(task and task.pid > 0 and task.parent.is_readable())
+
+    def _get_pidtype_pid(self):
+        vmlinux = self.context.modules[self.config["kernel"]]
+
+        # The pid_type enumeration is present since 2.5.37, just in case
+        pid_type_enum = vmlinux.get_enumeration("pid_type")
+        if not pid_type_enum:
+            vollog.error("Cannot find pid_type enum. Unsupported kernel")
+            return None
+
+        pidtype_pid = pid_type_enum.choices.get("PIDTYPE_PID")
+        if pidtype_pid is None:
+            vollog.error("Cannot find PIDTYPE_PID. Unsupported kernel")
+            return None
+
+        # Typically PIDTYPE_PID = 0
+        return pidtype_pid
+
+    def _get_pidhash_array(self):
+        vmlinux = self.context.modules[self.config["kernel"]]
+
+        pidhash_shift = vmlinux.object_from_symbol("pidhash_shift")
+        pidhash_size = 1 << pidhash_shift
+
+        array_type_name = vmlinux.symbol_table_name + constants.BANG + "array"
+
+        pidhash_ptr = vmlinux.object_from_symbol("pid_hash")
+        # pidhash is an array of hlist_heads
+        pidhash = self._context.object(
+            array_type_name,
+            offset=pidhash_ptr,
+            subtype=vmlinux.get_type("hlist_head"),
+            count=pidhash_size,
+            layer_name=vmlinux.layer_name,
+        )
+
+        return pidhash
+
+    def _walk_upid(self, seen_upids, upid):
+        vmlinux = self.context.modules[self.config["kernel"]]
+        vmlinux_layer = self.context.layers[vmlinux.layer_name]
+
+        while upid and vmlinux_layer.is_valid(upid.vol.offset):
+            if upid.vol.offset in seen_upids:
+                break
+            seen_upids.add(upid.vol.offset)
+
+            pid_chain = upid.pid_chain
+            if not (pid_chain.next and pid_chain.next.is_readable()):
+                break
+
+            upid = linux.LinuxUtilities.container_of(
+                pid_chain.next, "upid", "pid_chain", vmlinux
+            )
+
+    def _get_upids(self):
+        vmlinux = self.context.modules[self.config["kernel"]]
+
+        # 2.6.24 <= kernels < 4.15
+        pidhash = self._get_pidhash_array()
+
+        seen_upids = set()
+        for hlist in pidhash:
+            # each entry in the hlist is a upid which is wrapped in a pid
+            ent = hlist.first
+
+            while ent and ent.is_readable():
+                # upid->pid_chain exists 2.6.24 <= kernel < 4.15
+                upid = linux.LinuxUtilities.container_of(
+                    ent.vol.offset, "upid", "pid_chain", vmlinux
+                )
+
+                if upid.vol.offset in seen_upids:
+                    break
+
+                self._walk_upid(seen_upids, upid)
+
+                ent = ent.next
+
+        return seen_upids
+
+    def _pid_hash_implementation(self):
+        vmlinux = self.context.modules[self.config["kernel"]]
+
+        # 2.6.24 <= kernels < 4.15
+        task_pids_off = vmlinux.get_type("task_struct").relative_child_offset("pids")
+        pidtype_pid = self._get_pidtype_pid()
+
+        for upid in self._get_upids():
+            pid = linux.LinuxUtilities.container_of(upid, "pid", "numbers", vmlinux)
+            if not pid:
+                continue
+
+            pid_tasks_0 = pid.tasks[pidtype_pid].first
+            if not (pid_tasks_0 and pid_tasks_0.is_readable()):
+                continue
+
+            task = vmlinux.object(
+                "task_struct", offset=pid_tasks_0 - task_pids_off, absolute=True
+            )
+            if self._is_valid_task(task):
+                yield task
+
+    def _task_for_radix_pid_node(self, nodep):
+        vmlinux = self.context.modules[self.config["kernel"]]
+
+        # kernels >= 4.15
+        pid = vmlinux.object("pid", offset=nodep, absolute=True)
+        pidtype_pid = self._get_pidtype_pid()
+
+        pid_tasks_0 = pid.tasks[pidtype_pid].first
+        if not (pid_tasks_0 and pid_tasks_0.is_readable()):
+            return None
+
+        task_struct_type = vmlinux.get_type("task_struct")
+        if task_struct_type.has_member("pids"):
+            member = "pids"
+        elif task_struct_type.has_member("pid_links"):
+            member = "pid_links"
+        else:
+            return None
+
+        task_pids_off = task_struct_type.relative_child_offset(member)
+        task = vmlinux.object(
+            "task_struct", offset=pid_tasks_0 - task_pids_off, absolute=True
+        )
+        return task
+
+    def _pid_namespace_idr(self):
+        vmlinux = self.context.modules[self.config["kernel"]]
+
+        # kernels >= 4.15
+        ns_addr = vmlinux.get_symbol("init_pid_ns").address
+        ns = vmlinux.object("pid_namespace", offset=ns_addr)
+
+        for page_addr in ns.idr.get_entries():
+            task = self._task_for_radix_pid_node(page_addr)
+            if self._is_valid_task(task):
+                yield task
+
+    def _determine_pid_func(self):
+        vmlinux = self.context.modules[self.config["kernel"]]
+
+        pid_hash = vmlinux.has_symbol("pid_hash") and vmlinux.has_symbol(
+            "pidhash_shift"
+        )  # 2.5.55 <= kernels < 4.15
+
+        has_pid_numbers = vmlinux.has_type("pid") and vmlinux.get_type(
+            "pid"
+        ).has_member(
+            "numbers"
+        )  # kernels >= 2.6.24
+
+        has_pid_chain = vmlinux.has_type("upid") and vmlinux.get_type(
+            "upid"
+        ).has_member(
+            "pid_chain"
+        )  # 2.6.24 <= kernels < 4.15
+
+        # kernels >= 4.15
+        pid_idr = vmlinux.has_type("pid_namespace") and vmlinux.get_type(
+            "pid_namespace"
+        ).has_member("idr")
+
+        if pid_idr:
+            # kernels >= 4.15
+            return self._pid_namespace_idr
+        elif pid_hash and has_pid_numbers and has_pid_numbers and has_pid_chain:
+            # 2.6.24 <= kernels < 4.15
+            return self._pid_hash_implementation
+
+        return None
+
+    def get_tasks(self) -> interfaces.objects.ObjectInterface:
+        """Enumerates processes through the PID hash table
+
+        Yields:
+            task_struct objects
+        """
+        pid_func = self._determine_pid_func()
+        if not pid_func:
+            vollog.error("Cannot determine which PID hash table this kernel is using")
+            return
+
+        yield from sorted(pid_func(), key=lambda t: (t.tgid, t.pid))
+
+    def _generator(
+        self, decorate_comm: bool = False
+    ) -> interfaces.objects.ObjectInterface:
+        for task in self.get_tasks():
+            offset, pid, tid, ppid, name = pslist.PsList.get_task_fields(
+                task, decorate_comm
+            )
+            fields = format_hints.Hex(offset), pid, tid, ppid, name
+            yield 0, fields
+
+    def run(self):
+        decorate_comm = self.config.get("decorate_comm")
+
+        headers = [
+            ("OFFSET", format_hints.Hex),
+            ("PID", int),
+            ("TID", int),
+            ("PPID", int),
+            ("COMM", str),
+        ]
+        return renderers.TreeGrid(headers, self._generator(decorate_comm=decorate_comm))
diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py
index 1888bd7b8..b05d69c7a 100644
--- a/volatility3/framework/plugins/linux/pslist.py
+++ b/volatility3/framework/plugins/linux/pslist.py
@@ -1,6 +1,7 @@
 # This file is Copyright 2021 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
+import datetime
 from typing import Any, Callable, Iterable, List, Tuple
 
 from volatility3.framework import interfaces, renderers
@@ -9,15 +10,16 @@ from volatility3.framework.objects import utility
 from volatility3.framework.renderers import format_hints
 from volatility3.framework.symbols import intermed
 from volatility3.framework.symbols.linux.extensions import elf
+from volatility3.plugins import timeliner
 from volatility3.plugins.linux import elfs
 
 
-class PsList(interfaces.plugins.PluginInterface):
+class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Lists the processes present in a particular linux memory image."""
 
     _required_framework_version = (2, 0, 0)
 
-    _version = (2, 2, 1)
+    _version = (2, 3, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -81,7 +83,7 @@ class PsList(interfaces.plugins.PluginInterface):
     @classmethod
     def get_task_fields(
         cls, task: interfaces.objects.ObjectInterface, decorate_comm: bool = False
-    ) -> Tuple[int, int, int, str]:
+    ) -> Tuple[int, int, int, int, str, datetime.datetime]:
         """Extract the fields needed for the final output
 
         Args:
@@ -96,13 +98,14 @@ class PsList(interfaces.plugins.PluginInterface):
         tid = task.pid
         ppid = task.parent.tgid if task.parent else 0
         name = utility.array_to_string(task.comm)
+        start_time = task.get_create_time()
         if decorate_comm:
             if task.is_kernel_thread:
                 name = f"[{name}]"
             elif task.is_user_thread:
                 name = f"{{{name}}}"
 
-        task_fields = (task.vol.offset, pid, tid, ppid, name)
+        task_fields = (task.vol.offset, pid, tid, ppid, name, start_time)
         return task_fields
 
     def _get_file_output(self, task: interfaces.objects.ObjectInterface) -> str:
@@ -177,7 +180,9 @@ class PsList(interfaces.plugins.PluginInterface):
             else:
                 file_output = "Disabled"
 
-            offset, pid, tid, ppid, name = self.get_task_fields(task, decorate_comm)
+            offset, pid, tid, ppid, name, creation_time = self.get_task_fields(
+                task, decorate_comm
+            )
 
             yield 0, (
                 format_hints.Hex(offset),
@@ -185,6 +190,7 @@ class PsList(interfaces.plugins.PluginInterface):
                 tid,
                 ppid,
                 name,
+                creation_time or renderers.NotAvailableValue(),
                 file_output,
             )
 
@@ -233,8 +239,23 @@ class PsList(interfaces.plugins.PluginInterface):
             ("TID", int),
             ("PPID", int),
             ("COMM", str),
+            ("CREATION TIME", datetime.datetime),
             ("File output", str),
         ]
         return renderers.TreeGrid(
             columns, self._generator(filter_func, include_threads, decorate_comm, dump)
         )
+
+    def generate_timeline(self):
+        pids = self.config.get("pid")
+        filter_func = self.create_pid_filter(pids)
+        for task in self.list_tasks(
+            self.context, self.config["kernel"], filter_func, include_threads=True
+        ):
+            offset, user_pid, user_tid, _user_ppid, name, creation_time = (
+                self.get_task_fields(task)
+            )
+
+            description = f"Process {user_pid}/{user_tid} {name} ({offset})"
+
+            yield (description, timeliner.TimeLinerType.CREATED, creation_time)
diff --git a/volatility3/framework/plugins/linux/ptrace.py b/volatility3/framework/plugins/linux/ptrace.py
new file mode 100644
index 000000000..e467ee644
--- /dev/null
+++ b/volatility3/framework/plugins/linux/ptrace.py
@@ -0,0 +1,97 @@
+# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+
+import logging
+from typing import List, Iterator
+
+from volatility3.framework import renderers, interfaces
+from volatility3.framework.constants import architectures
+from volatility3.framework.objects import utility
+from volatility3.framework.configuration import requirements
+from volatility3.framework.interfaces import plugins
+from volatility3.plugins.linux import pslist
+
+vollog = logging.getLogger(__name__)
+
+
+class Ptrace(plugins.PluginInterface):
+    """Enumerates ptrace's tracer and tracee tasks"""
+
+    _required_framework_version = (2, 10, 0)
+    _version = (1, 0, 0)
+
+    @classmethod
+    def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Linux kernel",
+                architectures=architectures.LINUX_ARCHS,
+            ),
+            requirements.PluginRequirement(
+                name="pslist", plugin=pslist.PsList, version=(2, 2, 0)
+            ),
+        ]
+
+    @classmethod
+    def enumerate_ptrace_tasks(
+        cls,
+        context: interfaces.context.ContextInterface,
+        vmlinux_module_name: str,
+    ) -> Iterator[interfaces.objects.ObjectInterface]:
+        """Enumerates ptrace's tracer and tracee tasks
+
+        Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
+            vmlinux_module_name: The name of the kernel module on which to operate
+
+        Yields:
+            A task_struct object
+        """
+
+        tasks = pslist.PsList.list_tasks(
+            context,
+            vmlinux_module_name,
+            filter_func=pslist.PsList.create_pid_filter(),
+            include_threads=True,
+        )
+
+        for task in tasks:
+            if task.is_being_ptraced or task.is_ptracing:
+                yield task
+
+    def _generator(self, vmlinux_module_name):
+        for task in self.enumerate_ptrace_tasks(self.context, vmlinux_module_name):
+            task_comm = utility.array_to_string(task.comm)
+            user_pid = task.tgid
+            user_tid = task.pid
+            tracer_tid = task.get_ptrace_tracer_tid() or renderers.NotAvailableValue()
+            tracee_tids = task.get_ptrace_tracee_tids() or [
+                renderers.NotAvailableValue()
+            ]
+            flags = task.get_ptrace_tracee_flags() or renderers.NotAvailableValue()
+
+            for level, tracee_tid in enumerate(tracee_tids):
+                fields = [
+                    task_comm,
+                    user_pid,
+                    user_tid,
+                    tracer_tid,
+                    tracee_tid,
+                    flags,
+                ]
+                yield (level, fields)
+
+    def run(self):
+        vmlinux_module_name = self.config["kernel"]
+
+        headers = [
+            ("Process", str),
+            ("PID", int),
+            ("TID", int),
+            ("Tracer TID", int),
+            ("Tracee TID", int),
+            ("Flags", str),
+        ]
+        return renderers.TreeGrid(headers, self._generator(vmlinux_module_name))
diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py
index 78217fbec..0ddd3e26d 100644
--- a/volatility3/framework/plugins/linux/sockstat.py
+++ b/volatility3/framework/plugins/linux/sockstat.py
@@ -22,9 +22,10 @@ class SockHandlers(interfaces.configuration.VersionableInterface):
 
     _required_framework_version = (2, 0, 0)
 
-    _version = (1, 0, 0)
+    _version = (3, 0, 0)
 
-    def __init__(self, vmlinux, task):
+    def __init__(self, vmlinux, task, *args, **kwargs):
+        super().__init__(*args, **kwargs)
         self._vmlinux = vmlinux
         self._task = task
 
@@ -151,17 +152,15 @@ class SockHandlers(interfaces.configuration.VersionableInterface):
 
         bpfprog = sock_filter.prog
 
-        BPF_PROG_TYPE_UNSPEC = 0  # cBPF filter
-        try:
-            bpfprog_type = bpfprog.get_type()
-            if bpfprog_type == BPF_PROG_TYPE_UNSPEC:
-                return  # cBPF filter
-        except AttributeError:
+        bpfprog_type = bpfprog.get_type()
+        if not bpfprog_type:
             # kernel < 3.18.140, it's a cBPF filter
             return None
 
-        BPF_PROG_TYPE_SOCKET_FILTER = 1  # eBPF filter
-        if bpfprog_type != BPF_PROG_TYPE_SOCKET_FILTER:
+        if bpfprog_type == "BPF_PROG_TYPE_UNSPEC":
+            return None  # cBPF filter
+
+        if bpfprog_type != "BPF_PROG_TYPE_SOCKET_FILTER":
             socket_filter["bpf_filter_type"] = f"UNK({bpfprog_type})"
             vollog.warning(f"Unexpected BPF type {bpfprog_type} for a socket")
             return None
@@ -440,7 +439,7 @@ class Sockstat(plugins.PluginInterface):
 
     _required_framework_version = (2, 0, 0)
 
-    _version = (1, 0, 0)
+    _version = (3, 0, 0)
 
     @classmethod
     def get_requirements(cls):
@@ -451,10 +450,10 @@ class Sockstat(plugins.PluginInterface):
                 architectures=["Intel32", "Intel64"],
             ),
             requirements.VersionRequirement(
-                name="SockHandlers", component=SockHandlers, version=(1, 0, 0)
+                name="SockHandlers", component=SockHandlers, version=(3, 0, 0)
             ),
             requirements.PluginRequirement(
-                name="lsof", plugin=lsof.Lsof, version=(1, 1, 0)
+                name="lsof", plugin=lsof.Lsof, version=(2, 0, 0)
             ),
             requirements.VersionRequirement(
                 name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0)
@@ -509,8 +508,9 @@ class Sockstat(plugins.PluginInterface):
         dfop_addr = vmlinux.object_from_symbol("sockfs_dentry_operations").vol.offset
 
         fd_generator = lsof.Lsof.list_fds(context, vmlinux.name, filter_func)
-        for _pid, _task_comm, task, fd_fields in fd_generator:
-            fd_num, filp, _full_path = fd_fields
+        for fd_internal in fd_generator:
+            fd_num, filp, _full_path = fd_internal.fd_fields
+            task = fd_internal.task
 
             if filp.f_op not in (sfop_addr, dfop_addr):
                 continue
@@ -617,8 +617,12 @@ class Sockstat(plugins.PluginInterface):
                 else NotAvailableValue()
             )
 
+            task_comm = utility.array_to_string(task.comm)
+
             fields = (
                 netns_id,
+                task_comm,
+                task.tgid,
                 task.pid,
                 fd_num,
                 format_hints.Hex(sock.vol.offset),
@@ -638,7 +642,9 @@ class Sockstat(plugins.PluginInterface):
 
         tree_grid_args = [
             ("NetNS", int),
-            ("Pid", int),
+            ("Process Name", str),
+            ("PID", int),
+            ("TID", int),
             ("FD", int),
             ("Sock Offset", format_hints.Hex),
             ("Family", str),
diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py
index eda0d7dca..9f6a7a9b8 100644
--- a/volatility3/framework/plugins/linux/vmayarascan.py
+++ b/volatility3/framework/plugins/linux/vmayarascan.py
@@ -2,6 +2,7 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
+import logging
 from typing import Iterable, List, Tuple
 
 from volatility3.framework import interfaces, renderers
@@ -10,12 +11,14 @@ from volatility3.framework.renderers import format_hints
 from volatility3.plugins import yarascan
 from volatility3.plugins.linux import pslist
 
+vollog = logging.getLogger(__name__)
+
 
 class VmaYaraScan(interfaces.plugins.PluginInterface):
     """Scans all virtual memory areas for tasks using yara."""
 
     _required_framework_version = (2, 4, 0)
-    _version = (1, 0, 0)
+    _version = (1, 0, 2)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -31,7 +34,7 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
                 name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
             ),
             requirements.PluginRequirement(
-                name="yarascan", plugin=yarascan.YaraScan, version=(1, 2, 0)
+                name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0)
             ),
             requirements.VersionRequirement(
                 name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0)
@@ -53,6 +56,8 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
         # use yarascan to parse the yara options provided and create the rules
         rules = yarascan.YaraScan.process_yara_options(dict(self.config))
 
+        sanity_check = 1024 * 1024 * 1024  # 1 GB
+
         # filter based on the pid option if provided
         filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
         for task in pslist.PsList.list_tasks(
@@ -69,19 +74,36 @@ class VmaYaraScan(interfaces.plugins.PluginInterface):
             # get the proc_layer object from the context
             proc_layer = self.context.layers[proc_layer_name]
 
-            # scan the process layer with the yarascanner
-            for offset, rule_name, name, value in proc_layer.scan(
-                context=self.context,
-                scanner=yarascan.YaraScanner(rules=rules),
-                sections=self.get_vma_maps(task),
-            ):
-                yield 0, (
-                    format_hints.Hex(offset),
-                    task.tgid,
-                    rule_name,
-                    name,
-                    value,
-                )
+            max_vma_size = 0
+            vma_maps_to_scan = []
+            for start, size in self.get_vma_maps(task):
+                if size > sanity_check:
+                    vollog.debug(
+                        f"VMA at 0x{start:x} over sanity-check size, not scanning"
+                    )
+                    continue
+                max_vma_size = max(max_vma_size, size)
+                vma_maps_to_scan.append((start, size))
+
+            if not vma_maps_to_scan:
+                vollog.warning(f"No VMAs were found for task {task.tgid}, not scanning")
+                continue
+
+            scanner = yarascan.YaraScanner(rules=rules)
+            scanner.chunk_size = max_vma_size
+
+            # scan the VMA data (in one contiguous block) with the yarascanner
+            for start, size in vma_maps_to_scan:
+                for offset, rule_name, name, value in scanner(
+                    proc_layer.read(start, size, pad=True), start
+                ):
+                    yield 0, (
+                        format_hints.Hex(offset),
+                        task.tgid,
+                        rule_name,
+                        name,
+                        value,
+                    )
 
     @staticmethod
     def get_vma_maps(
diff --git a/volatility3/framework/plugins/timeliner.py b/volatility3/framework/plugins/timeliner.py
index f657a2918..c754e43ef 100644
--- a/volatility3/framework/plugins/timeliner.py
+++ b/volatility3/framework/plugins/timeliner.py
@@ -45,6 +45,7 @@ class Timeliner(interfaces.plugins.PluginInterface):
     orders the results by time."""
 
     _required_framework_version = (2, 0, 0)
+    _version = (1, 1, 0)
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -65,7 +66,7 @@ class Timeliner(interfaces.plugins.PluginInterface):
         if selected_list:
 
             def filter_plugins(name: str, selected: List[str]) -> bool:
-                return any([s in name for s in selected])
+                return any(s in name for s in selected)
 
             filter_func = filter_plugins
         else:
@@ -198,9 +199,10 @@ class Timeliner(interfaces.plugins.PluginInterface):
                                     ),
                                 )
                             )
-            except Exception:
+            except Exception as e:
                 vollog.log(
-                    logging.INFO, f"Exception occurred running plugin: {plugin_name}"
+                    logging.INFO,
+                    f"Exception occurred running plugin: {plugin_name}: {e}",
                 )
                 vollog.log(logging.DEBUG, traceback.format_exc())
 
@@ -245,6 +247,16 @@ class Timeliner(interfaces.plugins.PluginInterface):
         filter_list = self.config["plugin-filter"]
         # Identify plugins that we can run which output datetimes
         for plugin_class in self.usable_plugins:
+            if not issubclass(plugin_class, TimeLinerInterface):
+                # get_usable_plugins() should filter this, but adding a safeguard just in case
+                continue
+
+            if filter_list and not any(
+                filter in plugin_class.__module__ + "." + plugin_class.__name__
+                for filter in filter_list
+            ):
+                continue
+
             try:
                 automagics = automagic.choose_automagic(self.automagics, plugin_class)
 
@@ -276,15 +288,8 @@ class Timeliner(interfaces.plugins.PluginInterface):
                                 config_value,
                             )
 
-                if isinstance(plugin, TimeLinerInterface):
-                    if not len(filter_list) or any(
-                        [
-                            filter
-                            in plugin.__module__ + "." + plugin.__class__.__name__
-                            for filter in filter_list
-                        ]
-                    ):
-                        plugins_to_run.append(plugin)
+                plugins_to_run.append(plugin)
+
             except exceptions.UnsatisfiedException as excp:
                 # Remove the failed plugin from the list and continue
                 vollog.debug(
diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py
new file mode 100644
index 000000000..1e918d61c
--- /dev/null
+++ b/volatility3/framework/plugins/windows/amcache.py
@@ -0,0 +1,650 @@
+# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+
+import dataclasses
+import datetime
+import enum
+import itertools
+import logging
+from typing import Dict, Iterable, Iterator, List, Optional, Tuple, Union
+
+from volatility3.framework import interfaces, renderers
+from volatility3.framework.configuration import requirements
+from volatility3.framework.layers import registry
+from volatility3.framework.renderers import conversion
+from volatility3.framework.symbols.windows.extensions import registry as reg_extensions
+from volatility3.plugins import timeliner
+from volatility3.plugins.windows.registry import hivelist
+
+vollog = logging.getLogger(__name__)
+
+#######################################################################
+# More information about the following enums can be found in the report
+# 'Analysis of the AmCache` by Blanche Lagny, 2019
+#######################################################################
+
+
+class Win8FileValName(enum.Enum):
+    """
+    An enumeration that creates a helpful mapping of opaque Windows 8 Amcache
+    'File' subkey value names to their human-readable equivalent.
+    """
+
+    ProgramID = "100"
+    SHA1Hash = "101"
+    Product = "0"
+    Company = "1"
+    Size = "6"
+    SizeOfImage = "7"
+    PEHeaderChecksum = "9"
+    LastModTime = "11"  # REG_QWORD FILETIME
+    CreateTime = "12"  # REG_QWORD FILETIME
+    Path = "15"
+    LastModTime2 = "17"  # REG_QWORD FILETIME
+    Version = "d"
+    CompileTime = "f"  # REG_QWORD UNIX EPOCH
+
+
+class Win8ProgramValName(enum.Enum):
+    """
+    An enumeration that creates a helpful mapping of opaque Windows 8 Amcache
+    'Program' subkey value names to their human-readable equivalent.
+    """
+
+    Product = "0"
+    Version = "1"
+    Publisher = "2"
+    InstallTime = "a"
+    MSIProductCode = "11"
+    MSIPackageCode = "12"
+    ProductCode = "f"
+    PackageCode = "10"
+
+
+class Win10InvAppFileValName(enum.Enum):
+    """
+    An enumeration containing the most useful Windows 10 Amcache
+    'InventoryApplicationFile' subkey value names.
+    """
+
+    FileId = "FileId"
+    LinkDate = "LinkDate"
+    LowerCaseLongPath = "LowerCaseLongPath"
+    ProductName = "ProductName"
+    ProductVersion = "ProductVersion"
+    ProgramID = "ProgramId"
+    Publisher = "Publisher"
+
+
+class Win10InvAppValName(enum.Enum):
+    """
+    An enumeration containing the most useful Windows 10 Amcache
+    'InventoryApplication' subkey value names.
+    """
+
+    InstallDate = "InstallDate"
+    Name = "Name"
+    Publisher = "Publisher"
+    RootDirPath = "RootDirPath"
+    Version = "Version"
+
+
+class Win10DriverBinaryValName(enum.Enum):
+    """
+    An enumeration containing the most useful Windows 10 Amcache
+    'InventoryDriverBinary' subkey value names.
+    """
+
+    DriverId = "DriverId"
+    DriverName = "DriverName"
+    DriverCompany = "DriverCompany"
+    Product = "Product"
+    Service = "Service"
+    DriverTimeStamp = "DriverTimeStamp"
+
+
+class AmcacheEntryType(enum.IntEnum):
+    Driver = 1
+    Program = 2
+    File = 3
+
+
+NullableString = Union[str, None, interfaces.renderers.BaseAbsentValue]
+NullableDatetime = Union[datetime.datetime, None, interfaces.renderers.BaseAbsentValue]
+
+
+@dataclasses.dataclass
+class _AmcacheEntry:
+    """
+    A class containing all information about an entry from the Amcache registry hive.
+    Because all values could potentially be paged out of memory or malformed, they are all
+    a union between their expected value and `interfaces.renderers.BaseAbsentValue`.
+    """
+
+    entry_type: str
+    path: NullableString = renderers.NotApplicableValue()
+    company: NullableString = renderers.NotApplicableValue()
+    last_modify_time: NullableDatetime = renderers.NotApplicableValue()
+    last_modify_time_2: NullableDatetime = renderers.NotApplicableValue()
+    install_time: NullableDatetime = renderers.NotApplicableValue()
+    compile_time: NullableDatetime = renderers.NotApplicableValue()
+    sha1_hash: NullableString = renderers.NotApplicableValue()
+    service: NullableString = renderers.NotApplicableValue()
+    product_name: NullableString = renderers.NotApplicableValue()
+    product_version: NullableString = renderers.NotApplicableValue()
+
+
+def _entry_sort_key(entry_tuple: Tuple[NullableString, _AmcacheEntry]) -> str:
+    """Sorts entries by program ID. This is broken out as a function here
+    to ensure consistency in sorting between the `group_by` and `sorted` function
+    invocations.
+    """
+    program_id, _ = entry_tuple
+    key = program_id if isinstance(program_id, str) else ""
+    return key
+
+
+def _get_string_value(
+    values: Dict[str, reg_extensions.CM_KEY_VALUE], name: str
+) -> NullableString:
+    try:
+        value = values[name]
+    except KeyError:
+        return renderers.NotAvailableValue()
+
+    data = value.decode_data()
+    if not isinstance(data, bytes):
+        return renderers.UnparsableValue()
+
+    return data.decode("utf-16le", errors="replace").rstrip("\u0000")
+
+
+def _get_datetime_filetime_value(
+    values: Dict[str, reg_extensions.CM_KEY_VALUE], name: str
+) -> NullableDatetime:
+    try:
+        value = values[name]
+    except KeyError:
+        return renderers.NotAvailableValue()
+
+    data = value.decode_data()
+    if not isinstance(data, int):
+        return renderers.UnparsableValue()
+
+    return conversion.wintime_to_datetime(data)
+
+
+def _get_datetime_utc_epoch_value(
+    values: Dict[str, reg_extensions.CM_KEY_VALUE], name: str
+) -> NullableDatetime:
+    try:
+        value = values[name]
+    except KeyError:
+        return renderers.NotAvailableValue()
+
+    data = value.decode_data()
+    if not isinstance(data, (int, float)):
+        return renderers.UnparsableValue()
+
+    try:
+        return datetime.datetime.fromtimestamp(float(data), datetime.timezone.utc)
+    except (ValueError, OverflowError, OSError):
+        return renderers.UnparsableValue()
+
+
+def _get_datetime_str_value(
+    values: Dict[str, reg_extensions.CM_KEY_VALUE], name: str
+) -> NullableDatetime:
+    try:
+        value = values[name]
+    except KeyError:
+        return renderers.NotAvailableValue()
+
+    data = value.decode_data()
+    if not isinstance(data, int):
+        return renderers.UnparsableValue()
+
+    if isinstance(data, str):
+        try:
+            return datetime.datetime.strptime(data, "%m/%d/%Y %H:%M:%S")
+        except ValueError:
+            return renderers.UnparsableValue()
+    else:
+        return renderers.UnparsableValue()
+
+
+class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
+    """Extract information on executed applications from the AmCache."""
+
+    _required_framework_version = (2, 0, 0)
+    _version = (1, 0, 0)
+
+    @classmethod
+    def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
+        # Since we're calling the plugin, make sure we have the plugin's requirements
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Windows kernel",
+                architectures=["Intel32", "Intel64"],
+            ),
+            requirements.PluginRequirement(
+                name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
+            ),
+        ]
+
+    def generate_timeline(
+        self,
+    ) -> Iterator[Tuple[str, timeliner.TimeLinerType, datetime.datetime]]:
+        for _, entry in self._generator():
+            if isinstance(entry.last_modify_time, datetime.datetime):
+                yield f"Amcache: {entry.entry_type} {entry.path} registry key modified", timeliner.TimeLinerType.MODIFIED, entry.last_modify_time
+            if isinstance(entry.last_modify_time_2, datetime.datetime):
+                yield f"Amcache: {entry.entry_type} {entry.path} STANDARD_INFORMATION create time", timeliner.TimeLinerType.CREATED, entry.last_modify_time_2
+            if isinstance(entry.install_time, datetime.datetime):
+                yield f"Amcache: {entry.entry_type} {entry.path} installed", timeliner.TimeLinerType.CREATED, entry.install_time
+            if isinstance(entry.compile_time, datetime.datetime):
+                yield f"Amcache: {entry.entry_type} {entry.path} compiled (PE metadata)", timeliner.TimeLinerType.MODIFIED, entry.compile_time
+
+    @classmethod
+    def get_amcache_hive(
+        cls,
+        context: interfaces.context.ContextInterface,
+        config_path: str,
+        kernel: interfaces.context.ModuleInterface,
+    ) -> Optional[registry.RegistryHive]:
+        """Retrieves the `Amcache.hve` registry hive from the kernel module, if it can be located."""
+        return next(
+            hivelist.HiveList.list_hives(
+                context=context,
+                base_config_path=interfaces.configuration.path_join(
+                    config_path, "hivelist"
+                ),
+                layer_name=kernel.layer_name,
+                symbol_table=kernel.symbol_table_name,
+                filter_string="amcache",
+            ),
+            None,
+        )
+
+    @classmethod
+    def parse_file_key(
+        cls, file_key: reg_extensions.CM_KEY_NODE
+    ) -> Iterator[Tuple[NullableString, _AmcacheEntry]]:
+        """Parses File entries from the Windows 8 `Root\\File` key.
+
+        :param programs_key: The `Root\\File` registry key.
+
+        :return: An iterator of tuples, where the first member is the program ID string for
+        correlating `Root\\Program` entries, and the second member is the `AmcacheEntry`.
+        """
+
+        val_enum = Win8FileValName
+
+        wanted_values = [key.value for key in val_enum]
+
+        for file_entry_key in itertools.chain(
+            *(key.get_subkeys() for key in file_key.get_subkeys())
+        ):
+            vollog.debug(f"Checking Win8 File key {file_entry_key.get_name()}")
+            values = {
+                str(value.get_name()): value
+                for value in file_entry_key.get_values()
+                if value.get_name() in wanted_values
+            }
+
+            program_id = _get_string_value(values, val_enum.ProgramID.value)
+            path = _get_string_value(values, val_enum.Path.value)
+            company = _get_string_value(values, val_enum.Company.value)
+            last_mod_time = _get_datetime_filetime_value(
+                values, val_enum.LastModTime.value
+            )
+            last_mod_time_2 = _get_datetime_filetime_value(
+                values, val_enum.LastModTime2.value
+            )
+            install_time = _get_datetime_filetime_value(
+                values, val_enum.CreateTime.value
+            )
+            compile_time = _get_datetime_utc_epoch_value(
+                values, val_enum.CompileTime.value
+            )
+            sha1_hash = _get_string_value(values, val_enum.SHA1Hash.value)
+            vollog.debug(f"Found sha1hash {sha1_hash}")
+            product_name = _get_string_value(values, val_enum.Product.value)
+
+            yield program_id, _AmcacheEntry(
+                AmcacheEntryType.File.name,
+                path=path,
+                company=company,
+                last_modify_time=last_mod_time,
+                last_modify_time_2=last_mod_time_2,
+                install_time=install_time,
+                compile_time=compile_time,
+                sha1_hash=(
+                    sha1_hash.lstrip("0000")
+                    if isinstance(sha1_hash, str)
+                    else sha1_hash
+                ),
+                product_name=product_name,
+            )
+
+    @classmethod
+    def parse_programs_key(
+        cls, programs_key: reg_extensions.CM_KEY_NODE
+    ) -> Iterator[Tuple[str, _AmcacheEntry]]:
+        """Parses Program entries from the Windows 8 `Root\\Programs` key.
+
+        :param programs_key: The `Root\\Programs` registry key.
+
+        :return: An iterator of tuples, where the first member is the program ID string for
+        correlating `Root\\File` entries, and the second member is the `AmcacheEntry`.
+        """
+        val_enum = Win8ProgramValName
+
+        wanted_values = [key.value for key in val_enum]
+        for program_key in programs_key.get_subkeys():
+            values = {
+                str(value.get_name()): value
+                for value in program_key.get_values()
+                if value.get_name() in wanted_values
+            }
+            vollog.debug(f"Parsing Win8 Program key {program_key.get_name()}")
+            program_id = program_key.get_name().strip().strip("\u0000")
+
+            product = _get_string_value(values, val_enum.Product.value)
+            company = _get_string_value(values, val_enum.Publisher.value)
+            install_time = _get_datetime_utc_epoch_value(
+                values, val_enum.InstallTime.value
+            )
+            version = _get_string_value(values, val_enum.Version.value)
+
+            yield program_id, _AmcacheEntry(
+                AmcacheEntryType.Program.name,
+                company=company,
+                last_modify_time=conversion.wintime_to_datetime(
+                    program_key.LastWriteTime.QuadPart
+                ),
+                install_time=install_time,
+                product_name=product,
+                product_version=version,
+            )
+
+    @classmethod
+    def parse_inventory_app_key(
+        cls, inv_app_key: reg_extensions.CM_KEY_NODE
+    ) -> Iterator[Tuple[str, _AmcacheEntry]]:
+        """Parses InventoryApplication entries from the Windows 10 `Root\\InventoryApplication` key.
+
+        :param programs_key: The `Root\\InventoryApplication` registry key.
+
+        :return: An iterator of tuples, where the first member is the program ID string for
+        correlating `Root\\InventoryApplicationFile` entries, and the second member is the `AmcacheEntry`.
+        """
+        val_enum = Win10InvAppValName
+
+        wanted_values = [key.value for key in val_enum]
+
+        for program_key in inv_app_key.get_subkeys():
+            program_id = program_key.get_name()
+
+            values = {
+                str(value.get_name()): value
+                for value in program_key.get_values()
+                if value.get_name() in wanted_values
+            }
+
+            name = _get_string_value(values, val_enum.Name.value)
+            version = _get_string_value(values, val_enum.Version.value)
+            publisher = _get_string_value(values, val_enum.Publisher.value)
+            path = _get_string_value(values, val_enum.RootDirPath.value)
+            install_date = _get_datetime_str_value(values, val_enum.InstallDate.value)
+            last_mod = conversion.wintime_to_datetime(
+                program_key.LastWriteTime.QuadPart
+            )
+
+            product: str = name if isinstance(name, str) else "UNKNOWN"  # type: ignore
+
+            yield program_id.strip().strip("\u0000"), _AmcacheEntry(
+                AmcacheEntryType.Program.name,
+                path=path,
+                last_modify_time=last_mod,
+                install_time=install_date,
+                product_name=product,
+                company=publisher,
+                product_version=version,
+            )
+
+    @classmethod
+    def parse_inventory_app_file_key(
+        cls, inv_app_file_key: reg_extensions.CM_KEY_NODE
+    ) -> Iterator[Tuple[NullableString, _AmcacheEntry]]:
+        """Parses executable file entries from the `Root\\InventoryApplicationFile` registry key.
+
+        :param inv_app_file_key: The `Root\\InventoryApplicationFile` registry key.
+        :return: An iterator of tuples, where the first member is the program ID string for correlating
+        with it's parent `InventoryApplication` program entry, and the second member is the `Amcache` entry.
+        """
+
+        val_enum = Win10InvAppFileValName
+
+        wanted_values = [key.value for key in val_enum]
+
+        for file_key in inv_app_file_key.get_subkeys():
+
+            vollog.debug(
+                f"Parsing Win10 InventoryApplicationFile key {file_key.get_name()}"
+            )
+
+            values = {
+                str(value.get_name()): value
+                for value in file_key.get_values()
+                if value.get_name() in wanted_values
+            }
+
+            last_mod = conversion.wintime_to_datetime(file_key.LastWriteTime.QuadPart)
+            path = _get_string_value(values, val_enum.LowerCaseLongPath.value)
+            linkdate = _get_datetime_str_value(values, val_enum.LinkDate.value)
+            sha1_hash = _get_string_value(values, val_enum.FileId.value)
+            publisher = _get_string_value(values, val_enum.Publisher.value)
+            prod_name = _get_string_value(values, val_enum.ProductName.value)
+            prod_ver = _get_string_value(values, val_enum.ProductVersion.value)
+            program_id = _get_string_value(values, val_enum.ProgramID.value)
+
+            yield program_id, _AmcacheEntry(
+                AmcacheEntryType.File.name,
+                path=path,
+                company=publisher,
+                last_modify_time=last_mod,
+                compile_time=linkdate,
+                sha1_hash=(
+                    sha1_hash.lstrip("0000")
+                    if isinstance(sha1_hash, str)
+                    else sha1_hash
+                ),
+                product_name=prod_name,
+                product_version=prod_ver,
+            )
+
+    @classmethod
+    def parse_driver_binary_key(
+        cls, driver_binary_key: reg_extensions.CM_KEY_NODE
+    ) -> Iterator[_AmcacheEntry]:
+        """Parses information about installed drivers from the `Root\\InventoryDriverBinary` registry key.
+
+        :param driver_binary_key: The `Root\\InventoryDriverBinary` registry key
+        :return: An iterator of `AmcacheEntry`s
+        """
+        val_enum = Win10DriverBinaryValName
+
+        wanted_values = [key.value for key in val_enum]
+
+        for binary_key in driver_binary_key.get_subkeys():
+
+            values = {
+                str(value.get_name()): value
+                for value in binary_key.get_values()
+                if value.get_name() in wanted_values
+            }
+
+            # Depending on the Windows version, the key name will be either the name
+            # of the driver, or its SHA1 hash.
+            if "/" in str(binary_key.get_name()):
+                driver_name = str(binary_key.get_name())
+                sha1_hash = _get_string_value(values, val_enum.DriverId.name)
+            else:
+                sha1_hash = str(binary_key.get_name())
+                driver_name = _get_string_value(values, val_enum.DriverName.name)
+
+            if isinstance(sha1_hash, str):
+                sha1_hash = sha1_hash[4:] if sha1_hash.startswith("0000") else sha1_hash
+
+            company, product, service, last_write_time, driver_timestamp = (
+                _get_string_value(values, val_enum.DriverCompany.name),
+                _get_string_value(values, val_enum.Product.name),
+                _get_string_value(values, val_enum.Service.name),
+                conversion.wintime_to_datetime(binary_key.LastWriteTime.QuadPart),
+                _get_datetime_utc_epoch_value(values, val_enum.DriverTimeStamp.name),
+            )
+
+            yield _AmcacheEntry(
+                entry_type=AmcacheEntryType.Driver.name,
+                path=driver_name,
+                company=company,
+                last_modify_time=last_write_time,
+                compile_time=driver_timestamp,
+                sha1_hash=(
+                    sha1_hash.lstrip("0000")
+                    if isinstance(sha1_hash, str)
+                    else sha1_hash
+                ),
+                service=service,
+                product_name=product,
+            )
+
+    def _generator(self) -> Iterator[Tuple[int, _AmcacheEntry]]:
+        kernel = self.context.modules[self.config["kernel"]]
+
+        def indented(
+            entry_gen: Iterable[_AmcacheEntry], indent: int = 0
+        ) -> Iterator[Tuple[int, _AmcacheEntry]]:
+            for item in entry_gen:
+                yield indent, item
+
+        # Building the dictionary ahead of time is much better for performance
+        # vs looking up each service's DLL individually.
+        amcache = self.get_amcache_hive(self.context, self.config_path, kernel)
+        if amcache is None:
+            return
+
+        try:
+            yield from indented(
+                self.parse_driver_binary_key(
+                    amcache.get_key("Root\\InventoryDriverBinary")  # type: ignore
+                )
+            )
+        except KeyError:
+            # Registry key not found
+            pass
+
+        try:
+            programs: Dict[str, _AmcacheEntry] = {
+                program_id: entry
+                for program_id, entry in self.parse_programs_key(
+                    amcache.get_key("Root\\Programs")
+                )  # type: ignore
+            }
+        except KeyError:
+            programs = {}
+
+        try:
+            files = sorted(
+                list(
+                    self.parse_file_key(amcache.get_key("Root\\File")),  # type: ignore
+                ),
+                key=_entry_sort_key,
+            )
+        except KeyError:
+            files = []
+
+        for program_id, file_entries in itertools.groupby(
+            files,
+            key=_entry_sort_key,
+        ):
+            files_indent = 0
+            if isinstance(program_id, str):
+                try:
+                    program_entry = programs.pop(program_id.strip().strip("\u0000"))
+                    yield (0, program_entry)
+
+                    files_indent = 1
+                except KeyError:
+                    # No parent program for this file entry
+                    pass
+            for _, entry in file_entries:
+                yield files_indent, entry
+
+        for empty_program in programs.values():
+            yield 0, empty_program
+
+        try:
+            programs: Dict[str, _AmcacheEntry] = dict(
+                self.parse_inventory_app_key(
+                    amcache.get_key("Root\\InventoryApplication")  # type: ignore
+                )
+            )
+        except KeyError:
+            programs = {}
+
+        try:
+            files = sorted(
+                list(
+                    self.parse_inventory_app_file_key(amcache.get_key("Root\\InventoryApplicationFile")),  # type: ignore
+                ),
+                key=_entry_sort_key,
+            )
+        except KeyError:
+            files = []
+
+        for program_id, file_entries in itertools.groupby(
+            files,
+            key=_entry_sort_key,
+        ):
+            files_indent = 0
+
+            if isinstance(program_id, str):
+                try:
+                    program_entry = programs.pop(program_id.strip().strip("\u0000"))
+                    yield (0, program_entry)
+                    files_indent = 1
+                except KeyError:
+                    # No parent program for this file entry
+                    pass
+
+            for _, entry in file_entries:
+                yield files_indent, entry
+
+        for empty_program in programs.values():
+            yield 0, empty_program
+
+    def run(self):
+
+        return renderers.TreeGrid(
+            [
+                ("EntryType", str),
+                ("Path", str),
+                ("Company", str),
+                ("LastModifyTime", datetime.datetime),
+                ("LastModifyTime2", datetime.datetime),
+                ("InstallTime", datetime.datetime),
+                ("CompileTime", datetime.datetime),
+                ("SHA1", str),
+                ("Service", str),
+                ("ProductName", str),
+                ("ProductVersion", str),
+            ],
+            (
+                (indent, dataclasses.astuple(entry))
+                for indent, entry in self._generator()
+            ),
+        )
diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py
index d5eeda1ea..562846def 100644
--- a/volatility3/framework/plugins/windows/callbacks.py
+++ b/volatility3/framework/plugins/windows/callbacks.py
@@ -248,8 +248,12 @@ class Callbacks(interfaces.plugins.PluginInterface):
             context, layer_name, nt_symbol_table, constraints
         ):
             try:
-                if hasattr(mem_object, "is_valid") and not mem_object.is_valid():
-                    continue
+                if isinstance(mem_object, callbacks._SHUTDOWN_PACKET):
+                    if not mem_object.is_parseable(type_map):
+                        continue
+                elif hasattr(mem_object, "is_valid"):
+                    if not mem_object.is_valid():
+                        continue
 
                 yield cls._process_scanned_callback(mem_object, type_map)
             except exceptions.InvalidAddressException:
diff --git a/volatility3/framework/plugins/windows/cmdscan.py b/volatility3/framework/plugins/windows/cmdscan.py
new file mode 100644
index 000000000..9645ee507
--- /dev/null
+++ b/volatility3/framework/plugins/windows/cmdscan.py
@@ -0,0 +1,381 @@
+# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+
+# This module attempts to locate windows console histories.
+
+import logging
+import struct
+from typing import Tuple, Generator, Set, Dict, Any, Optional
+
+from volatility3.framework import interfaces
+from volatility3.framework import renderers
+from volatility3.framework.configuration import requirements
+from volatility3.framework.layers import scanners
+from volatility3.framework.objects import utility
+from volatility3.framework.renderers import format_hints
+from volatility3.plugins.windows import pslist, consoles
+
+
+vollog = logging.getLogger(__name__)
+
+
+class CmdScan(interfaces.plugins.PluginInterface):
+    """Looks for Windows Command History lists"""
+
+    _required_framework_version = (2, 4, 0)
+    _version = (1, 0, 0)
+
+    @classmethod
+    def get_requirements(cls):
+        # Since we're calling the plugin, make sure we have the plugin's requirements
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Windows kernel",
+                architectures=["Intel32", "Intel64"],
+            ),
+            requirements.VersionRequirement(
+                name="pslist", component=pslist.PsList, version=(2, 0, 0)
+            ),
+            requirements.PluginRequirement(
+                name="consoles", plugin=consoles.Consoles, version=(1, 0, 0)
+            ),
+            requirements.BooleanRequirement(
+                name="no_registry",
+                description="Don't search the registry for possible values of CommandHistorySize",
+                optional=True,
+                default=False,
+            ),
+            requirements.ListRequirement(
+                name="max_history",
+                element_type=int,
+                description="CommandHistorySize values to search for.",
+                optional=True,
+                default=[50],
+            ),
+        ]
+
+    @classmethod
+    def get_filtered_vads(
+        cls,
+        conhost_proc: interfaces.context.ContextInterface,
+        size_filter: Optional[int] = 0x40000000,
+    ) -> Generator[Tuple[int, int], None, None]:
+        """
+        Returns vads of a process with size smaller than size_filter
+
+        Args:
+            conhost_proc: the process object for conhost.exe
+
+        Returns:
+            A list of tuples of:
+            vad_base: the base address
+            vad_size: the size of the VAD
+        """
+        for vad in conhost_proc.get_vad_root().traverse():
+            base = vad.get_start()
+            if vad.get_size() < size_filter:
+                yield (base, vad.get_size())
+
+    @classmethod
+    def get_command_history(
+        cls,
+        context: interfaces.context.ContextInterface,
+        kernel_layer_name: str,
+        kernel_symbol_table_name: str,
+        config_path: str,
+        procs: Generator[interfaces.objects.ObjectInterface, None, None],
+        max_history: Set[int],
+    ) -> Tuple[
+        interfaces.context.ContextInterface,
+        interfaces.context.ContextInterface,
+        Dict[str, Any],
+    ]:
+        """Gets the list of commands from each Command History structure
+
+        Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
+            kernel_layer_name: The name of the layer on which to operate
+            kernel_symbol_table_name: The name of the table containing the kernel symbols
+            config_path: The config path where to find symbol files
+            procs: list of process objects
+            max_history: an initial set of CommandHistorySize values
+
+        Returns:
+            The conhost process object, the command history structure, a dictionary of properties for
+            that command history structure.
+        """
+
+        conhost_symbol_table = None
+
+        for conhost_proc, proc_layer_name in consoles.Consoles.find_conhost_proc(procs):
+            if not conhost_proc:
+                vollog.info(
+                    "Unable to find a valid conhost.exe process in the process list. Analysis cannot proceed."
+                )
+                continue
+            vollog.debug(
+                f"Found conhost process {conhost_proc} with pid {conhost_proc.UniqueProcessId}"
+            )
+
+            conhostexe_base, conhostexe_size = consoles.Consoles.find_conhostexe(
+                conhost_proc
+            )
+            if not conhostexe_base:
+                vollog.info(
+                    "Unable to find the location of conhost.exe. Analysis cannot proceed."
+                )
+                continue
+            vollog.debug(f"Found conhost.exe base at {conhostexe_base:#x}")
+
+            proc_layer = context.layers[proc_layer_name]
+
+            if conhost_symbol_table is None:
+                conhost_symbol_table = consoles.Consoles.create_conhost_symbol_table(
+                    context,
+                    kernel_layer_name,
+                    kernel_symbol_table_name,
+                    config_path,
+                    proc_layer_name,
+                    conhostexe_base,
+                )
+
+            conhost_module = context.module(
+                conhost_symbol_table, proc_layer_name, offset=conhostexe_base
+            )
+            command_count_max_offset = conhost_module.get_type(
+                "_COMMAND_HISTORY"
+            ).relative_child_offset("CommandCountMax")
+
+            sections = cls.get_filtered_vads(conhost_proc)
+            found_history_for_proc = False
+            # scan for potential _COMMAND_HISTORY structures by using the CommandHistorySize
+            for max_history_value in max_history:
+                max_history_bytes = struct.pack("H", max_history_value)
+                vollog.debug(
+                    f"Scanning for CommandHistorySize value: {max_history_bytes}"
+                )
+                for address in proc_layer.scan(
+                    context,
+                    scanners.BytesScanner(max_history_bytes),
+                    sections=sections,
+                ):
+                    command_history = None
+                    command_history_properties = []
+
+                    try:
+                        command_history = conhost_module.object(
+                            "_COMMAND_HISTORY",
+                            offset=address - command_count_max_offset,
+                            absolute=True,
+                        )
+
+                        if not command_history.is_valid(max_history_value):
+                            continue
+
+                        vollog.debug(
+                            f"Getting Command History properties for {command_history}"
+                        )
+                        command_history_properties.append(
+                            {
+                                "level": 0,
+                                "name": "_COMMAND_HISTORY",
+                                "address": command_history.vol.offset,
+                                "data": None,
+                            }
+                        )
+                        command_history_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_COMMAND_HISTORY.Application",
+                                "address": command_history.Application.vol.offset,
+                                "data": command_history.get_application(),
+                            }
+                        )
+                        command_history_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_COMMAND_HISTORY.ProcessHandle",
+                                "address": command_history.ConsoleProcessHandle.ProcessHandle.vol.offset,
+                                "data": hex(
+                                    command_history.ConsoleProcessHandle.ProcessHandle
+                                ),
+                            }
+                        )
+                        command_history_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_COMMAND_HISTORY.CommandCount",
+                                "address": None,
+                                "data": command_history.CommandCount,
+                            }
+                        )
+                        command_history_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_COMMAND_HISTORY.LastDisplayed",
+                                "address": command_history.LastDisplayed.vol.offset,
+                                "data": command_history.LastDisplayed,
+                            }
+                        )
+                        command_history_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_COMMAND_HISTORY.CommandCountMax",
+                                "address": command_history.CommandCountMax.vol.offset,
+                                "data": command_history.CommandCountMax,
+                            }
+                        )
+
+                        command_history_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_COMMAND_HISTORY.CommandBucket",
+                                "address": command_history.CommandBucket.vol.offset,
+                                "data": "",
+                            }
+                        )
+                        for (
+                            cmd_index,
+                            bucket_cmd,
+                        ) in command_history.scan_command_bucket():
+                            try:
+                                command_history_properties.append(
+                                    {
+                                        "level": 2,
+                                        "name": f"_COMMAND_HISTORY.CommandBucket_Command_{cmd_index}",
+                                        "address": bucket_cmd.vol.offset,
+                                        "data": bucket_cmd.get_command_string(),
+                                    }
+                                )
+                            except Exception as e:
+                                vollog.debug(
+                                    f"reading {bucket_cmd} encountered exception {e}"
+                                )
+                    except Exception as e:
+                        vollog.debug(
+                            f"reading {command_history} encountered exception {e}"
+                        )
+
+                    if command_history and command_history_properties:
+                        found_history_for_proc = True
+                        yield conhost_proc, command_history, command_history_properties
+
+            # if found_history_for_proc is still False, then none of the scanned locations found
+            # a valid _COMMAND_HISTORY for the process, so yield the process and some empty data
+            # so the process can at least be reported that it was found with no history
+            if not found_history_for_proc:
+                yield conhost_proc, command_history or None, []
+
+    def _generator(
+        self, procs: Generator[interfaces.objects.ObjectInterface, None, None]
+    ):
+        """
+        Generates the command history to use in rendering
+
+        Args:
+            procs: the process list filtered to conhost.exe instances
+        """
+
+        kernel = self.context.modules[self.config["kernel"]]
+
+        max_history = set(self.config.get("max_history", [50]))
+        no_registry = self.config.get("no_registry")
+
+        if no_registry is False:
+            max_history, _ = consoles.Consoles.get_console_settings_from_registry(
+                self.context,
+                self.config_path,
+                kernel.layer_name,
+                kernel.symbol_table_name,
+                max_history,
+                [],
+            )
+
+        vollog.debug(f"Possible CommandHistorySize values: {max_history}")
+
+        proc = None
+        for (
+            proc,
+            command_history,
+            command_history_properties,
+        ) in self.get_command_history(
+            self.context,
+            kernel.layer_name,
+            kernel.symbol_table_name,
+            self.config_path,
+            procs,
+            max_history,
+        ):
+            process_name = utility.array_to_string(proc.ImageFileName)
+            process_pid = proc.UniqueProcessId
+
+            if command_history and command_history_properties:
+                for command_history_property in command_history_properties:
+                    yield (
+                        command_history_property["level"],
+                        (
+                            process_pid,
+                            process_name,
+                            format_hints.Hex(command_history.vol.offset),
+                            command_history_property["name"],
+                            (
+                                renderers.NotApplicableValue()
+                                if command_history_property["address"] is None
+                                else format_hints.Hex(
+                                    command_history_property["address"]
+                                )
+                            ),
+                            str(command_history_property["data"]),
+                        ),
+                    )
+            else:
+                yield (
+                    0,
+                    (
+                        process_pid,
+                        process_name,
+                        (
+                            format_hints.Hex(command_history.vol.offset)
+                            if command_history
+                            else renderers.NotApplicableValue()
+                        ),
+                        "_COMMAND_HISTORY",
+                        renderers.NotApplicableValue(),
+                        "History Not Found",
+                    ),
+                )
+
+        if proc is None:
+            vollog.warn("No conhost.exe processes found.")
+
+    def _conhost_proc_filter(self, proc: interfaces.objects.ObjectInterface):
+        """
+        Used to filter to only conhost.exe processes
+        """
+        process_name = utility.array_to_string(proc.ImageFileName)
+
+        return process_name != "conhost.exe"
+
+    def run(self):
+        kernel = self.context.modules[self.config["kernel"]]
+
+        return renderers.TreeGrid(
+            [
+                ("PID", int),
+                ("Process", str),
+                ("ConsoleInfo", format_hints.Hex),
+                ("Property", str),
+                ("Address", format_hints.Hex),
+                ("Data", str),
+            ],
+            self._generator(
+                pslist.PsList.list_processes(
+                    context=self.context,
+                    layer_name=kernel.layer_name,
+                    symbol_table=kernel.symbol_table_name,
+                    filter_func=self._conhost_proc_filter,
+                )
+            ),
+        )
diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py
new file mode 100644
index 000000000..ad1c9d4bd
--- /dev/null
+++ b/volatility3/framework/plugins/windows/consoles.py
@@ -0,0 +1,953 @@
+# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+
+# This module attempts to locate windows console histories.
+
+import logging
+import os
+import struct
+from typing import Tuple, Generator, Set, Dict, Any, Type
+
+from volatility3.framework import interfaces, symbols, exceptions
+from volatility3.framework import renderers
+from volatility3.framework.interfaces import configuration
+from volatility3.framework.configuration import requirements
+from volatility3.framework.layers import scanners
+from volatility3.framework.objects import utility
+from volatility3.framework.renderers import format_hints
+from volatility3.framework.symbols import intermed
+from volatility3.framework.symbols.windows.extensions import pe, consoles
+from volatility3.plugins.windows import pslist, info, verinfo
+from volatility3.plugins.windows.registry import hivelist
+
+
+vollog = logging.getLogger(__name__)
+
+
+class Consoles(interfaces.plugins.PluginInterface):
+    """Looks for Windows console buffers"""
+
+    _required_framework_version = (2, 4, 0)
+    _version = (1, 0, 0)
+
+    @classmethod
+    def get_requirements(cls):
+        # Since we're calling the plugin, make sure we have the plugin's requirements
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Windows kernel",
+                architectures=["Intel32", "Intel64"],
+            ),
+            requirements.VersionRequirement(
+                name="pslist", component=pslist.PsList, version=(2, 0, 0)
+            ),
+            requirements.VersionRequirement(
+                name="verinfo", component=verinfo.VerInfo, version=(1, 0, 0)
+            ),
+            requirements.PluginRequirement(
+                name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
+            ),
+            requirements.BooleanRequirement(
+                name="no_registry",
+                description="Don't search the registry for possible values of CommandHistorySize and HistoryBufferMax",
+                optional=True,
+                default=False,
+            ),
+            requirements.ListRequirement(
+                name="max_history",
+                element_type=int,
+                description="CommandHistorySize values to search for.",
+                optional=True,
+                default=[50],
+            ),
+            requirements.ListRequirement(
+                name="max_buffers",
+                element_type=int,
+                description="HistoryBufferMax values to search for.",
+                optional=True,
+                default=[4],
+            ),
+        ]
+
+    @classmethod
+    def find_conhost_proc(
+        cls, proc_list: Generator[interfaces.objects.ObjectInterface, None, None]
+    ) -> Tuple[interfaces.context.ContextInterface, str]:
+        """
+        Walks the process list and returns the conhost instances.
+
+        Args:
+            proc_list: The process list generator
+
+        Return:
+            The process object and layer name for conhost
+        """
+
+        for proc in proc_list:
+            if utility.array_to_string(proc.ImageFileName).lower() == "conhost.exe":
+                try:
+                    proc_id = proc.UniqueProcessId
+                    proc_layer_name = proc.add_process_layer()
+
+                    yield proc, proc_layer_name
+
+                except exceptions.InvalidAddressException as excp:
+                    vollog.debug(
+                        "Process {}: invalid address {} in layer {}".format(
+                            proc_id, excp.invalid_address, excp.layer_name
+                        )
+                    )
+
+    @classmethod
+    def find_conhostexe(
+        cls, conhost_proc: interfaces.context.ContextInterface
+    ) -> Tuple[int, int]:
+        """
+        Finds the base address of conhost.exe
+
+        Args:
+            conhost_proc: the process object for conhost.exe
+
+        Returns:
+            A tuple of:
+            conhostexe_base: the base address of conhost.exe
+            conhostexe_size: the size of the VAD for conhost.exe
+        """
+        for vad in conhost_proc.get_vad_root().traverse():
+            filename = vad.get_file_name()
+            if isinstance(filename, str) and filename.lower().endswith("conhost.exe"):
+                base = vad.get_start()
+                return base, vad.get_size()
+
+        return None, None
+
+    @classmethod
+    def determine_conhost_version(
+        cls,
+        context: interfaces.context.ContextInterface,
+        layer_name: str,
+        nt_symbol_table: str,
+        config_path: str,
+        conhost_layer_name: str,
+        conhost_base: int,
+    ) -> Tuple[str, Type]:
+        """Tries to determine which symbol filename to use for the image's console information. This is similar to the
+        netstat plugin.
+
+        Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
+            layer_name: The name of the layer on which to operate
+            nt_symbol_table: The name of the table containing the kernel symbols
+            config_path: The config path where to find symbol files
+            conhost_layer_name: The name of the conhot process memory layer
+            conhost_base: the base address of conhost.exe
+
+        Returns:
+            The filename of the symbol table to use and the associated class types.
+        """
+
+        is_64bit = symbols.symbol_table_is_64bit(context, nt_symbol_table)
+
+        if is_64bit:
+            arch = "x64"
+        else:
+            arch = "x86"
+
+        vers = info.Info.get_version_structure(context, layer_name, nt_symbol_table)
+
+        kuser = info.Info.get_kuser_structure(context, layer_name, nt_symbol_table)
+
+        try:
+            vers_minor_version = int(vers.MinorVersion)
+            nt_major_version = int(kuser.NtMajorVersion)
+            nt_minor_version = int(kuser.NtMinorVersion)
+        except ValueError:
+            # vers struct exists, but is not an int anymore?
+            raise NotImplementedError(
+                "Kernel Debug Structure version format not supported!"
+            )
+        except Exception:
+            # unsure what to raise here. Also, it might be useful to add some kind of fallback,
+            # either to a user-provided version or to another method to determine conhost.exe's version
+            raise exceptions.VolatilityException(
+                "Kernel Debug Structure missing VERSION/KUSER structure, unable to determine Windows version!"
+            )
+
+        vollog.debug(
+            "Determined OS Version: {}.{} {}.{}".format(
+                kuser.NtMajorVersion,
+                kuser.NtMinorVersion,
+                vers.MajorVersion,
+                vers.MinorVersion,
+            )
+        )
+
+        if nt_major_version == 10 and arch == "x64":
+            # win10 x64 has an additional class type we have to include.
+            class_types = consoles.win10_x64_class_types
+        else:
+            # default to general class types
+            class_types = consoles.class_types
+
+        # these versions are listed explicitly because symbol files differ based on
+        # version *and* architecture. this is currently the clearest way to show
+        # the differences, even if it introduces a fair bit of redundancy.
+        # furthermore, it is easy to append new versions.
+        if arch == "x86":
+            version_dict = {}
+        else:
+            version_dict = {
+                (10, 0, 17763, 1): "consoles-win10-17763-x64",
+                (10, 0, 17763, 3232): "consoles-win10-17763-3232-x64",
+                (10, 0, 18362, 0): "consoles-win10-18362-x64",
+                (10, 0, 19041, 0): "consoles-win10-19041-x64",
+                (10, 0, 20348, 1): "consoles-win10-20348-x64",
+                (10, 0, 20348, 1970): "consoles-win10-20348-1970-x64",
+                (10, 0, 20348, 2461): "consoles-win10-20348-2461-x64",
+                (10, 0, 20348, 2520): "consoles-win10-20348-2461-x64",
+                (10, 0, 22000, 0): "consoles-win10-22000-x64",
+                (10, 0, 22621, 1): "consoles-win10-22621-x64",
+                (10, 0, 22621, 3527): "consoles-win10-22621-3527-x64",
+                (10, 0, 25398, 0): "consoles-win10-22000-x64",
+            }
+
+        # we do not need to check for conhost's specific FileVersion in every case
+        conhost_mod_version = 0  # keep it 0 as a default
+
+        # we need to define additional version numbers (which are then found via conhost.exe's FileVersion header) in case there is
+        # ambiguity _within_ an OS version. If such a version number (last number of the tuple) is defined for the current OS
+        # we need to inspect conhost.exe's headers to see if we can grab the precise version
+        if [
+            (a, b, c, d)
+            for a, b, c, d in version_dict
+            if (a, b, c) == (nt_major_version, nt_minor_version, vers_minor_version)
+            and d != 0
+        ]:
+            vollog.debug(
+                "Requiring further version inspection due to OS version by checking conhost.exe's FileVersion header"
+            )
+
+            pe_table_name = intermed.IntermediateSymbolTable.create(
+                context,
+                configuration.path_join(config_path, "conhost"),
+                "windows",
+                "pe",
+                class_types=pe.class_types,
+            )
+
+            try:
+                (major, minor, product, build) = (
+                    verinfo.VerInfo.get_version_information(
+                        context, pe_table_name, conhost_layer_name, conhost_base
+                    )
+                )
+                conhost_mod_version = build
+                vollog.debug(
+                    f"Found conhost.exe version {major}.{minor}.{product}.{build} in {conhost_layer_name} at base {conhost_base:#x}"
+                )
+            except (exceptions.InvalidAddressException, TypeError, AttributeError):
+                # the following is IntelLayer specific and might need to be adapted to other architectures.
+                physical_layer_name = context.layers[layer_name].config.get(
+                    "memory_layer", None
+                )
+                if physical_layer_name:
+                    ver = verinfo.VerInfo.find_version_info(
+                        context, physical_layer_name, "CONHOST.EXE"
+                    )
+
+                    if ver:
+                        conhost_mod_version = ver[3]
+                        vollog.debug(
+                            "Determined conhost.exe's FileVersion: {}".format(
+                                conhost_mod_version
+                            )
+                        )
+                    else:
+                        vollog.debug("Could not determine conhost.exe's FileVersion.")
+            else:
+                vollog.debug(
+                    "Unable to retrieve physical memory layer, skipping FileVersion check."
+                )
+
+        # when determining the symbol file we have to consider the following cases:
+        # the determined version's symbol file is found by intermed.create -> proceed
+        # the determined version's symbol file is not found by intermed -> intermed will throw an exc and abort
+        # the determined version has no mapped symbol file -> if win10 use latest, otherwise throw exc
+        # windows version cannot be determined -> throw exc
+
+        filename = version_dict.get(
+            (
+                nt_major_version,
+                nt_minor_version,
+                vers_minor_version,
+                conhost_mod_version,
+            )
+        )
+
+        if not filename:
+            # no match on filename means that we possibly have a version newer than those listed here.
+            # try to grab the latest supported version of the current image NT version. If that symbol
+            # version does not work, support has to be added manually.
+            current_versions = [
+                (nt_maj, nt_min, vers_min, conhost_ver)
+                for nt_maj, nt_min, vers_min, conhost_ver in version_dict
+                if nt_maj == nt_major_version
+                and nt_min == nt_minor_version
+                and vers_min <= vers_minor_version
+                and conhost_ver <= conhost_mod_version
+            ]
+            current_versions.sort()
+
+            if current_versions:
+                latest_version = current_versions[-1]
+
+                filename = version_dict.get(latest_version)
+
+                vollog.debug(
+                    f"Unable to find exact matching symbol file, going with latest: {filename}"
+                )
+
+            else:
+                raise NotImplementedError(
+                    "This version of Windows is not supported: {}.{} {}.{}!".format(
+                        nt_major_version,
+                        nt_minor_version,
+                        vers.MajorVersion,
+                        vers_minor_version,
+                    )
+                )
+
+        vollog.debug(f"Determined symbol filename: {filename}")
+
+        return filename, class_types
+
+    @classmethod
+    def create_conhost_symbol_table(
+        cls,
+        context: interfaces.context.ContextInterface,
+        layer_name: str,
+        nt_symbol_table: str,
+        config_path: str,
+        conhost_layer_name: str,
+        conhost_base: int,
+    ) -> str:
+        """Creates a symbol table for conhost structures.
+
+        Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
+            layer_name: The name of the layer on which to operate
+            nt_symbol_table: The name of the table containing the kernel symbols
+            config_path: The config path where to find symbol files
+
+        Returns:
+            The name of the constructed symbol table
+        """
+        table_mapping = {"nt_symbols": nt_symbol_table}
+
+        symbol_filename, class_types = cls.determine_conhost_version(
+            context,
+            layer_name,
+            nt_symbol_table,
+            config_path,
+            conhost_layer_name,
+            conhost_base,
+        )
+
+        vollog.debug(f"Using symbol file '{symbol_filename}' and types {class_types}")
+
+        return intermed.IntermediateSymbolTable.create(
+            context,
+            configuration.path_join(config_path, "conhost"),
+            os.path.join("windows", "consoles"),
+            symbol_filename,
+            class_types=class_types,
+            table_mapping=table_mapping,
+        )
+
+    @classmethod
+    def get_console_info(
+        cls,
+        context: interfaces.context.ContextInterface,
+        kernel_layer_name: str,
+        kernel_table_name: str,
+        config_path: str,
+        procs: Generator[interfaces.objects.ObjectInterface, None, None],
+        max_history: Set[int],
+        max_buffers: Set[int],
+    ) -> Tuple[
+        interfaces.context.ContextInterface,
+        interfaces.context.ContextInterface,
+        Dict[str, Any],
+    ]:
+        """Gets the Console Information structure and its related properties for each conhost process
+
+        Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
+            kernel_layer_name: The name of the layer on which to operate
+            kernel_table_name: The name of the table containing the kernel symbols
+            config_path: The config path where to find symbol files
+            procs: list of process objects
+            max_history: an initial set of CommandHistorySize values
+            max_buffers: an initial list of HistoryBufferMax values
+
+        Returns:
+            The conhost process object, the console information structure, a dictionary of properties for
+            that console information structure.
+        """
+
+        conhost_symbol_table = None
+
+        for conhost_proc, proc_layer_name in cls.find_conhost_proc(procs):
+            if not conhost_proc:
+                vollog.info(
+                    "Unable to find a valid conhost.exe process in the process list. Analysis cannot proceed."
+                )
+                continue
+            vollog.debug(
+                f"Found conhost process {conhost_proc} with pid {conhost_proc.UniqueProcessId}"
+            )
+
+            conhostexe_base, conhostexe_size = cls.find_conhostexe(conhost_proc)
+            if not conhostexe_base:
+                vollog.info(
+                    "Unable to find the location of conhost.exe. Analysis cannot proceed."
+                )
+                continue
+            vollog.debug(f"Found conhost.exe base at {conhostexe_base:#x}")
+
+            proc_layer = context.layers[proc_layer_name]
+
+            if conhost_symbol_table is None:
+                conhost_symbol_table = cls.create_conhost_symbol_table(
+                    context,
+                    kernel_layer_name,
+                    kernel_table_name,
+                    config_path,
+                    proc_layer_name,
+                    conhostexe_base,
+                )
+
+            conhost_module = context.module(
+                conhost_symbol_table, proc_layer_name, offset=conhostexe_base
+            )
+
+            found_console_info_for_proc = False
+            # scan for potential _CONSOLE_INFORMATION structures by using the CommandHistorySize
+            for max_history_value in max_history:
+                max_history_bytes = struct.pack("H", max_history_value)
+                vollog.debug(
+                    f"Scanning for CommandHistorySize value: {max_history_bytes}"
+                )
+                for address in proc_layer.scan(
+                    context,
+                    scanners.BytesScanner(max_history_bytes),
+                    sections=[(conhostexe_base, conhostexe_size)],
+                ):
+
+                    console_properties = []
+
+                    try:
+                        console_info = conhost_module.object(
+                            "_CONSOLE_INFORMATION",
+                            offset=address
+                            - conhost_module.get_type(
+                                "_CONSOLE_INFORMATION"
+                            ).relative_child_offset("CommandHistorySize"),
+                            absolute=True,
+                        )
+
+                        if not any(
+                            [
+                                console_info.is_valid(max_buffer)
+                                for max_buffer in max_buffers
+                            ]
+                        ):
+                            continue
+
+                        vollog.debug(
+                            f"Getting Console Information properties for {console_info}"
+                        )
+                        console_properties.append(
+                            {
+                                "level": 0,
+                                "name": "_CONSOLE_INFORMATION",
+                                "address": console_info.vol.offset,
+                                "data": "",
+                            }
+                        )
+                        console_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_CONSOLE_INFORMATION.ScreenX",
+                                "address": console_info.ScreenX.vol.offset,
+                                "data": console_info.ScreenX,
+                            }
+                        )
+                        console_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_CONSOLE_INFORMATION.ScreenY",
+                                "address": console_info.ScreenY.vol.offset,
+                                "data": console_info.ScreenY,
+                            }
+                        )
+                        console_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_CONSOLE_INFORMATION.CommandHistorySize",
+                                "address": console_info.CommandHistorySize.vol.offset,
+                                "data": console_info.CommandHistorySize,
+                            }
+                        )
+                        console_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_CONSOLE_INFORMATION.HistoryBufferCount",
+                                "address": console_info.HistoryBufferCount.vol.offset,
+                                "data": console_info.HistoryBufferCount,
+                            }
+                        )
+                        console_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_CONSOLE_INFORMATION.HistoryBufferMax",
+                                "address": console_info.HistoryBufferMax.vol.offset,
+                                "data": console_info.HistoryBufferMax,
+                            }
+                        )
+                        console_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_CONSOLE_INFORMATION.Title",
+                                "address": console_info.Title.vol.offset,
+                                "data": console_info.get_title(),
+                            }
+                        )
+                        console_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_CONSOLE_INFORMATION.OriginalTitle",
+                                "address": console_info.OriginalTitle.vol.offset,
+                                "data": console_info.get_original_title(),
+                            }
+                        )
+
+                        vollog.debug(
+                            f"Getting ConsoleProcessList entries for {console_info.ConsoleProcessList}"
+                        )
+                        console_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_CONSOLE_INFORMATION.ProcessCount",
+                                "address": console_info.ProcessCount.vol.offset,
+                                "data": console_info.ProcessCount,
+                            }
+                        )
+                        console_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_CONSOLE_INFORMATION.ConsoleProcessList",
+                                "address": console_info.ConsoleProcessList.vol.offset,
+                                "data": "",
+                            }
+                        )
+                        for index, attached_proc in enumerate(
+                            console_info.get_processes()
+                        ):
+                            console_properties.append(
+                                {
+                                    "level": 2,
+                                    "name": f"_CONSOLE_INFORMATION.ConsoleProcessList.ConsoleProcess_{index}",
+                                    "address": attached_proc.ConsoleProcess.dereference().vol.offset,
+                                    "data": "",
+                                }
+                            )
+                            console_properties.append(
+                                {
+                                    "level": 2,
+                                    "name": f"_CONSOLE_INFORMATION.ConsoleProcessList.ConsoleProcess_{index}_ProcessId",
+                                    "address": attached_proc.ConsoleProcess.ProcessId.vol.offset,
+                                    "data": attached_proc.ConsoleProcess.ProcessId,
+                                }
+                            )
+                            console_properties.append(
+                                {
+                                    "level": 2,
+                                    "name": f"_CONSOLE_INFORMATION.ConsoleProcessList.ConsoleProcess_{index}_ProcessHandle",
+                                    "address": attached_proc.ConsoleProcess.ProcessHandle.vol.offset,
+                                    "data": hex(
+                                        attached_proc.ConsoleProcess.ProcessHandle
+                                    ),
+                                }
+                            )
+
+                        vollog.debug(
+                            f"Getting ExeAliasList entries for {console_info.ExeAliasList}"
+                        )
+                        console_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_CONSOLE_INFORMATION.ExeAliasList",
+                                "address": console_info.ExeAliasList.vol.offset,
+                                "data": "",
+                            }
+                        )
+                        if console_info.ExeAliasList:
+                            for index, exe_alias_list in enumerate(
+                                console_info.get_exe_aliases()
+                            ):
+                                try:
+                                    console_properties.append(
+                                        {
+                                            "level": 2,
+                                            "name": f"_CONSOLE_INFORMATION.ExeAliasList.AliasList_{index}",
+                                            "address": exe_alias_list.vol.offset,
+                                            "data": "",
+                                        }
+                                    )
+                                    console_properties.append(
+                                        {
+                                            "level": 2,
+                                            "name": f"_CONSOLE_INFORMATION.ExeAliasList.AliasList_{index}.ExeName",
+                                            "address": exe_alias_list.ExeName.vol.offset,
+                                            "data": exe_alias_list.get_exename(),
+                                        }
+                                    )
+                                    for alias_index, alias in enumerate(
+                                        exe_alias_list.get_aliases()
+                                    ):
+                                        console_properties.append(
+                                            {
+                                                "level": 3,
+                                                "name": f"_CONSOLE_INFORMATION.ExeAliasList.AliasList_{index}.Alias_{alias_index}.Source",
+                                                "address": alias.Source.vol.offset,
+                                                "data": alias.get_source(),
+                                            }
+                                        )
+                                        console_properties.append(
+                                            {
+                                                "level": 3,
+                                                "name": f"_CONSOLE_INFORMATION.ExeAliasList.AliasList_{index}.Alias_{alias_index}.Target",
+                                                "address": alias.Target.vol.offset,
+                                                "data": alias.get_target(),
+                                            }
+                                        )
+                                except Exception as e:
+                                    vollog.debug(
+                                        f"reading {exe_alias_list} encountered exception {e}"
+                                    )
+
+                        vollog.debug(
+                            f"Getting HistoryList entries for {console_info.HistoryList}"
+                        )
+                        console_properties.append(
+                            {
+                                "level": 1,
+                                "name": "_CONSOLE_INFORMATION.HistoryList",
+                                "address": console_info.HistoryList.vol.offset,
+                                "data": "",
+                            }
+                        )
+                        for index, command_history in enumerate(
+                            console_info.get_histories()
+                        ):
+                            try:
+                                console_properties.append(
+                                    {
+                                        "level": 2,
+                                        "name": f"_CONSOLE_INFORMATION.HistoryList.CommandHistory_{index}",
+                                        "address": command_history.vol.offset,
+                                        "data": "",
+                                    }
+                                )
+                                console_properties.append(
+                                    {
+                                        "level": 2,
+                                        "name": f"_CONSOLE_INFORMATION.HistoryList.CommandHistory_{index}_Application",
+                                        "address": command_history.Application.vol.offset,
+                                        "data": command_history.get_application(),
+                                    }
+                                )
+                                console_properties.append(
+                                    {
+                                        "level": 2,
+                                        "name": f"_CONSOLE_INFORMATION.HistoryList.CommandHistory_{index}_ProcessHandle",
+                                        "address": command_history.ConsoleProcessHandle.ProcessHandle.vol.offset,
+                                        "data": hex(
+                                            command_history.ConsoleProcessHandle.ProcessHandle
+                                        ),
+                                    }
+                                )
+                                console_properties.append(
+                                    {
+                                        "level": 2,
+                                        "name": f"_CONSOLE_INFORMATION.HistoryList.CommandHistory_{index}_CommandCount",
+                                        "address": None,
+                                        "data": command_history.CommandCount,
+                                    }
+                                )
+                                console_properties.append(
+                                    {
+                                        "level": 2,
+                                        "name": f"_CONSOLE_INFORMATION.HistoryList.CommandHistory_{index}_LastDisplayed",
+                                        "address": command_history.LastDisplayed.vol.offset,
+                                        "data": command_history.LastDisplayed,
+                                    }
+                                )
+                                for (
+                                    cmd_index,
+                                    bucket_cmd,
+                                ) in command_history.get_commands():
+                                    try:
+                                        console_properties.append(
+                                            {
+                                                "level": 3,
+                                                "name": f"_CONSOLE_INFORMATION.HistoryList.CommandHistory_{index}_Command_{cmd_index}",
+                                                "address": bucket_cmd.vol.offset,
+                                                "data": bucket_cmd.get_command_string(),
+                                            }
+                                        )
+                                    except Exception as e:
+                                        vollog.debug(
+                                            f"reading {bucket_cmd} encountered exception {e}"
+                                        )
+                            except Exception as e:
+                                vollog.debug(
+                                    f"reading {command_history} encountered exception {e}"
+                                )
+
+                        try:
+                            vollog.debug(
+                                f"Getting ScreenBuffer entries for {console_info}"
+                            )
+                            console_properties.append(
+                                {
+                                    "level": 1,
+                                    "name": "_CONSOLE_INFORMATION.CurrentScreenBuffer",
+                                    "address": console_info.CurrentScreenBuffer.vol.offset,
+                                    "data": "",
+                                }
+                            )
+                            for screen_index, screen_info in enumerate(
+                                console_info.get_screens()
+                            ):
+                                try:
+                                    console_properties.append(
+                                        {
+                                            "level": 2,
+                                            "name": f"_CONSOLE_INFORMATION.ScreenBuffer_{screen_index}",
+                                            "address": screen_info,
+                                            "data": "",
+                                        }
+                                    )
+                                    console_properties.append(
+                                        {
+                                            "level": 2,
+                                            "name": f"_CONSOLE_INFORMATION.ScreenBuffer_{screen_index}.ScreenX",
+                                            "address": None,
+                                            "data": screen_info.ScreenX,
+                                        }
+                                    )
+                                    console_properties.append(
+                                        {
+                                            "level": 2,
+                                            "name": f"_CONSOLE_INFORMATION.ScreenBuffer_{screen_index}.ScreenY",
+                                            "address": None,
+                                            "data": screen_info.ScreenY,
+                                        }
+                                    )
+                                    console_properties.append(
+                                        {
+                                            "level": 2,
+                                            "name": f"_CONSOLE_INFORMATION.ScreenBuffer_{screen_index}.Dump",
+                                            "address": None,
+                                            "data": "\n".join(screen_info.get_buffer()),
+                                        }
+                                    )
+                                except Exception as e:
+                                    vollog.debug(
+                                        f"reading {screen_info} encountered exception {e}"
+                                    )
+                        except Exception as e:
+                            vollog.debug(
+                                f"reading _CONSOLE_INFORMATION.CurrentScreenBuffer encountered exception {e}"
+                            )
+
+                    except exceptions.PagedInvalidAddressException as exp:
+                        vollog.debug(
+                            f"Required memory at {exp.invalid_address:#x} is not valid"
+                        )
+                        continue
+
+                    if console_info and console_properties:
+                        found_console_info_for_proc = True
+                        yield conhost_proc, console_info, console_properties
+
+            if not found_console_info_for_proc:
+                yield conhost_proc, console_info or None, []
+
+    @classmethod
+    def get_console_settings_from_registry(
+        cls,
+        context: interfaces.context.ContextInterface,
+        config_path: str,
+        kernel_layer_name: str,
+        kernel_symbol_table_name: str,
+        max_history: Set[int],
+        max_buffers: Set[int],
+    ) -> Tuple[Set[int], Set[int]]:
+        """
+        Walks the Registry user hives and extracts any CommandHistorySize and HistoryBufferMax values
+        for scanning
+
+        Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
+            config_path: The config path where to find symbol files
+            kernel_layer_name: The name of the layer on which to operate
+            kernel_symbol_table_name: The name of the table containing the kernel symbols
+            max_history: an initial set of CommandHistorySize values
+            max_buffers: an initial list of HistoryBufferMax values
+
+        Returns:
+            The updated max_history and max_buffers sets.
+        """
+        vollog.debug(
+            f"Possible CommandHistorySize values before checking Registry: {max_history}"
+        )
+        vollog.debug(
+            f"Possible HistoryBufferMax values before checking Registry: {max_buffers}"
+        )
+
+        for hive in hivelist.HiveList.list_hives(
+            context=context,
+            base_config_path=config_path,
+            layer_name=kernel_layer_name,
+            symbol_table=kernel_symbol_table_name,
+            hive_offsets=None,
+        ):
+            try:
+                for value in hive.get_key("Console").get_values():
+                    val_name = str(value.get_name())
+                    if val_name == "HistoryBufferSize":
+                        max_history.add(value.decode_data())
+                    elif val_name == "NumberOfHistoryBuffers":
+                        max_buffers.add(value.decode_data())
+            except Exception:
+                continue
+
+        return max_history, max_buffers
+
+    def _generator(
+        self, procs: Generator[interfaces.objects.ObjectInterface, None, None]
+    ):
+        """
+        Generates the console information to use in rendering
+
+        Args:
+            procs: the process list filtered to conhost.exe instances
+        """
+
+        kernel = self.context.modules[self.config["kernel"]]
+
+        max_history = set(self.config.get("max_history", [50]))
+        max_buffers = set(self.config.get("max_buffers", [4]))
+        no_registry = self.config.get("no_registry")
+
+        if no_registry is False:
+            max_history, max_buffers = self.get_console_settings_from_registry(
+                self.context,
+                self.config_path,
+                kernel.layer_name,
+                kernel.symbol_table_name,
+                max_history,
+                max_buffers,
+            )
+
+        vollog.debug(f"Possible CommandHistorySize values: {max_history}")
+        vollog.debug(f"Possible HistoryBufferMax values: {max_buffers}")
+
+        proc = None
+        for proc, console_info, console_properties in self.get_console_info(
+            self.context,
+            kernel.layer_name,
+            kernel.symbol_table_name,
+            self.config_path,
+            procs,
+            max_history,
+            max_buffers,
+        ):
+            process_name = utility.array_to_string(proc.ImageFileName)
+            process_pid = proc.UniqueProcessId
+
+            if console_info and console_properties:
+                for console_property in console_properties:
+                    yield (
+                        console_property["level"],
+                        (
+                            process_pid,
+                            process_name,
+                            format_hints.Hex(console_info.vol.offset),
+                            console_property["name"],
+                            (
+                                renderers.NotApplicableValue()
+                                if console_property["address"] is None
+                                else format_hints.Hex(console_property["address"])
+                            ),
+                            (
+                                str(console_property["data"])
+                                if console_property["data"]
+                                else renderers.NotAvailableValue()
+                            ),
+                        ),
+                    )
+            else:
+                yield (
+                    0,
+                    (
+                        process_pid,
+                        process_name,
+                        (
+                            format_hints.Hex(console_info.vol.offset)
+                            if console_info
+                            else renderers.NotApplicableValue()
+                        ),
+                        "_CONSOLE_INFORMATION",
+                        renderers.NotApplicableValue(),
+                        "Console Information Not Found",
+                    ),
+                )
+
+        if proc is None:
+            vollog.warn("No conhost.exe processes found.")
+
+    def _conhost_proc_filter(self, proc: interfaces.objects.ObjectInterface) -> bool:
+        """
+        Used to filter to only conhost.exe processes
+        """
+        process_name = utility.array_to_string(proc.ImageFileName)
+
+        return process_name.lower() != "conhost.exe"
+
+    def run(self):
+        kernel = self.context.modules[self.config["kernel"]]
+
+        return renderers.TreeGrid(
+            [
+                ("PID", int),
+                ("Process", str),
+                ("ConsoleInfo", format_hints.Hex),
+                ("Property", str),
+                ("Address", format_hints.Hex),
+                ("Data", str),
+            ],
+            self._generator(
+                pslist.PsList.list_processes(
+                    context=self.context,
+                    layer_name=kernel.layer_name,
+                    symbol_table=kernel.symbol_table_name,
+                    filter_func=self._conhost_proc_filter,
+                )
+            ),
+        )
diff --git a/volatility3/framework/plugins/windows/debugregisters.py b/volatility3/framework/plugins/windows/debugregisters.py
new file mode 100644
index 000000000..57dd1822c
--- /dev/null
+++ b/volatility3/framework/plugins/windows/debugregisters.py
@@ -0,0 +1,211 @@
+# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+
+# Full details on the techniques used in these plugins to detect EDR-evading malware
+# can be found in our 20 page whitepaper submitted to DEFCON along with the presentation
+# https://www.volexity.com/wp-content/uploads/2024/08/Defcon24_EDR_Evasion_Detection_White-Paper_Andrew-Case.pdf
+
+import logging
+
+from typing import Tuple, Optional, Generator, List, Dict
+
+from functools import partial
+
+from volatility3.framework import renderers, interfaces, exceptions
+from volatility3.framework.configuration import requirements
+from volatility3.framework.renderers import format_hints
+import volatility3.plugins.windows.pslist as pslist
+import volatility3.plugins.windows.threads as threads
+import volatility3.plugins.windows.pe_symbols as pe_symbols
+
+vollog = logging.getLogger(__name__)
+
+
+class DebugRegisters(interfaces.plugins.PluginInterface):
+    # version 2.6.0 adds support for scanning for 'Ethread' structures by pool tags
+    _required_framework_version = (2, 6, 0)
+    _version = (1, 0, 0)
+
+    @classmethod
+    def get_requirements(cls) -> List:
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Windows kernel",
+                architectures=["Intel32", "Intel64"],
+            ),
+            requirements.VersionRequirement(
+                name="pslist", component=pslist.PsList, version=(2, 0, 0)
+            ),
+            requirements.VersionRequirement(
+                name="pe_symbols", component=pe_symbols.PESymbols, version=(1, 0, 0)
+            ),
+        ]
+
+    @staticmethod
+    def _get_debug_info(
+        ethread: interfaces.objects.ObjectInterface,
+    ) -> Optional[Tuple[interfaces.objects.ObjectInterface, int, int, int, int, int]]:
+        """
+        Gathers information related to the debug registers for the given thread
+        Args:
+            ethread: the thread (_ETHREAD) to examine
+        Returns:
+            Tuple[interfaces.objects.ObjectInterface, int, int, int, int, int]: The owner process of the thread and the values for dr7, dr0, dr1, dr2, dr3
+        """
+        try:
+            dr7 = ethread.Tcb.TrapFrame.Dr7
+            state = ethread.Tcb.State
+        except exceptions.InvalidAddressException:
+            return None
+
+        # 0 = debug registers not active
+        # 4 = terminated
+        if dr7 == 0 or state == 4:
+            return None
+
+        try:
+            owner_proc = ethread.owning_process()
+        except (AttributeError, exceptions.InvalidAddressException):
+            return None
+
+        dr0 = ethread.Tcb.TrapFrame.Dr0
+        dr1 = ethread.Tcb.TrapFrame.Dr1
+        dr2 = ethread.Tcb.TrapFrame.Dr2
+        dr3 = ethread.Tcb.TrapFrame.Dr3
+
+        # bail if all are 0
+        if not (dr0 or dr1 or dr2 or dr3):
+            return None
+
+        return owner_proc, dr7, dr0, dr1, dr2, dr3
+
+    def _generator(
+        self,
+    ) -> Generator[
+        Tuple[
+            int,
+            Tuple[
+                str,
+                int,
+                int,
+                int,
+                int,
+                format_hints.Hex,
+                str,
+                str,
+                format_hints.Hex,
+                str,
+                str,
+                format_hints.Hex,
+                str,
+                str,
+                format_hints.Hex,
+                str,
+                str,
+            ],
+        ],
+        None,
+        None,
+    ]:
+        kernel = self.context.modules[self.config["kernel"]]
+
+        vads_cache: Dict[int, pe_symbols.ranges_type] = {}
+
+        proc_modules = None
+
+        procs = pslist.PsList.list_processes(
+            context=self.context,
+            layer_name=kernel.layer_name,
+            symbol_table=kernel.symbol_table_name,
+        )
+
+        for proc in procs:
+            for thread in threads.Threads.list_threads(kernel, proc):
+                debug_info = self._get_debug_info(thread)
+                if not debug_info:
+                    continue
+
+                owner_proc, dr7, dr0, dr1, dr2, dr3 = debug_info
+
+                vads = pe_symbols.PESymbols.get_vads_for_process_cache(
+                    vads_cache, owner_proc
+                )
+                if not vads:
+                    continue
+
+                # this lookup takes a while, so only perform if we need to
+                if not proc_modules:
+                    proc_modules = pe_symbols.PESymbols.get_process_modules(
+                        self.context, kernel.layer_name, kernel.symbol_table_name, None
+                    )
+                    path_and_symbol = partial(
+                        pe_symbols.PESymbols.path_and_symbol_for_address,
+                        self.context,
+                        self.config_path,
+                        proc_modules,
+                    )
+
+                file0, sym0 = path_and_symbol(vads, dr0)
+                file1, sym1 = path_and_symbol(vads, dr1)
+                file2, sym2 = path_and_symbol(vads, dr2)
+                file3, sym3 = path_and_symbol(vads, dr3)
+
+                # if none map to an actual file VAD then bail
+                if not (file0 or file1 or file2 or file3):
+                    continue
+
+                process_name = owner_proc.ImageFileName.cast(
+                    "string",
+                    max_length=owner_proc.ImageFileName.vol.count,
+                    errors="replace",
+                )
+
+                thread_tid = thread.Cid.UniqueThread
+
+                yield (
+                    0,
+                    (
+                        process_name,
+                        owner_proc.UniqueProcessId,
+                        thread_tid,
+                        thread.Tcb.State,
+                        dr7,
+                        format_hints.Hex(dr0),
+                        file0 or renderers.NotApplicableValue(),
+                        sym0 or renderers.NotApplicableValue(),
+                        format_hints.Hex(dr1),
+                        file1 or renderers.NotApplicableValue(),
+                        sym1 or renderers.NotApplicableValue(),
+                        format_hints.Hex(dr2),
+                        file2 or renderers.NotApplicableValue(),
+                        sym2 or renderers.NotApplicableValue(),
+                        format_hints.Hex(dr3),
+                        file3 or renderers.NotApplicableValue(),
+                        sym3 or renderers.NotApplicableValue(),
+                    ),
+                )
+
+    def run(self) -> renderers.TreeGrid:
+        return renderers.TreeGrid(
+            [
+                ("Process", str),
+                ("PID", int),
+                ("TID", int),
+                ("State", int),
+                ("Dr7", int),
+                ("Dr0", format_hints.Hex),
+                ("Range0", str),
+                ("Symbol0", str),
+                ("Dr1", format_hints.Hex),
+                ("Range1", str),
+                ("Symbol1", str),
+                ("Dr2", format_hints.Hex),
+                ("Range2", str),
+                ("Symbol2", str),
+                ("Dr3", format_hints.Hex),
+                ("Range3", str),
+                ("Symbol3", str),
+            ],
+            self._generator(),
+        )
diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py
index 079274d69..1df090b5b 100644
--- a/volatility3/framework/plugins/windows/malfind.py
+++ b/volatility3/framework/plugins/windows/malfind.py
@@ -122,10 +122,30 @@ class Malfind(interfaces.plugins.PluginInterface):
                 vadinfo.winnt_protections,
             )
             write_exec = "EXECUTE" in protection_string and "WRITE" in protection_string
+            dirty_page_check = False
 
-            # the write/exec check applies to everything
             if not write_exec:
-                continue
+                """
+                # Inspect "PAGE_EXECUTE_READ" VAD pages to detect
+                # non writable memory regions having been injected
+                # using elevated WriteProcessMemory().
+                """
+                if "EXECUTE" in protection_string:
+                    for page in range(
+                        vad.get_start(), vad.get_end(), proc_layer.page_size
+                    ):
+                        try:
+                            # If we have a dirty page in a non writable "EXECUTE" region, it is suspicious.
+                            if proc_layer.is_dirty(page):
+                                dirty_page_check = True
+                                break
+                        except exceptions.InvalidAddressException:
+                            # Abort as it is likely that other addresses in the same range will also fail.
+                            break
+                    if not dirty_page_check:
+                        continue
+                else:
+                    continue
 
             if (vad.get_private_memory() == 1 and vad.get_tag() == "VadS") or (
                 vad.get_private_memory() == 0
@@ -134,6 +154,11 @@ class Malfind(interfaces.plugins.PluginInterface):
                 if cls.is_vad_empty(proc_layer, vad):
                     continue
 
+                if dirty_page_check:
+                    # Useful information to investigate the page content with volshell afterwards.
+                    vollog.warning(
+                        f"[proc_id {proc_id}] Found suspicious DIRTY + {protection_string} page at {hex(page)}",
+                    )
                 data = proc_layer.read(vad.get_start(), 64, pad=True)
                 yield vad, data
 
diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py
index 1b1a1b45e..9e6585345 100644
--- a/volatility3/framework/plugins/windows/mftscan.py
+++ b/volatility3/framework/plugins/windows/mftscan.py
@@ -29,7 +29,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
                 architectures=["Intel32", "Intel64"],
             ),
             requirements.VersionRequirement(
-                name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0)
+                name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0)
             ),
         ]
 
@@ -38,7 +38,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
 
         # Yara Rule to scan for MFT Header Signatures
         rules = yarascan.YaraScan.process_yara_options(
-            {"yara_rules": "/FILE0|FILE\\*|BAAD/"}
+            {"yara_string": "/FILE0|FILE\\*|BAAD/"}
         )
 
         # Read in the Symbol File
@@ -197,7 +197,7 @@ class ADS(interfaces.plugins.PluginInterface):
 
         # Yara Rule to scan for MFT Header Signatures
         rules = yarascan.YaraScan.process_yara_options(
-            {"yara_rules": "/FILE0|FILE\\*|BAAD/"}
+            {"yara_string": "/FILE0|FILE\\*|BAAD/"}
         )
 
         # Read in the Symbol File
diff --git a/volatility3/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py
index 868bd8bcd..66a24da5a 100644
--- a/volatility3/framework/plugins/windows/netscan.py
+++ b/volatility3/framework/plugins/windows/netscan.py
@@ -76,7 +76,7 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
 
         # ~ vollog.debug("Using pool size constraints: TcpL {}, TcpE {}, UdpA {}".format(tcpl_size, tcpe_size, udpa_size))
 
-        return [
+        constraints = [
             # TCP listener
             poolscanner.PoolConstraint(
                 b"TcpL",
@@ -100,6 +100,19 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
             ),
         ]
 
+        if symbol_table.startswith("netscan-win10-20348"):
+            vollog.debug("Adding additional pool constraint for `TTcb` tags")
+            constraints.append(
+                poolscanner.PoolConstraint(
+                    b"TTcb",
+                    type_name=symbol_table + constants.BANG + "_TCP_ENDPOINT",
+                    size=(tcpe_size, None),
+                    page_type=poolscanner.PoolType.NONPAGED | poolscanner.PoolType.FREE,
+                )
+            )
+
+        return constraints
+
     @classmethod
     def determine_tcpip_version(
         cls,
diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py
new file mode 100644
index 000000000..f4901dc8c
--- /dev/null
+++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py
@@ -0,0 +1,96 @@
+# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+
+import logging
+from typing import List, Generator
+
+from volatility3.framework import interfaces, symbols
+from volatility3.framework.configuration import requirements
+from volatility3.plugins.windows import thrdscan, ssdt
+
+vollog = logging.getLogger(__name__)
+
+
+class Threads(thrdscan.ThrdScan):
+    """Lists process threads"""
+
+    _required_framework_version = (2, 4, 0)
+    _version = (1, 0, 0)
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.implementation = self.list_orphan_kernel_threads
+
+    @classmethod
+    def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
+        # Since we're calling the plugin, make sure we have the plugin's requirements
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Windows kernel",
+                architectures=["Intel32", "Intel64"],
+            ),
+            requirements.PluginRequirement(
+                name="thrdscan", plugin=thrdscan.ThrdScan, version=(1, 1, 0)
+            ),
+            requirements.PluginRequirement(
+                name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0)
+            ),
+        ]
+
+    @classmethod
+    def list_orphan_kernel_threads(
+        cls,
+        context: interfaces.context.ContextInterface,
+        module_name: str,
+    ) -> Generator[interfaces.objects.ObjectInterface, None, None]:
+        """Yields thread objects of kernel threads that do not map to a module
+
+        Args:
+            cls
+            context: the context to operate upon
+            module_name: name of the module to use for scanning
+        Returns:
+            A generator of thread objects of orphaned threads
+        """
+        module = context.modules[module_name]
+        layer_name = module.layer_name
+        symbol_table = module.symbol_table_name
+
+        collection = ssdt.SSDT.build_module_collection(
+            context, layer_name, symbol_table
+        )
+
+        # FIXME - use a proper constant once established
+        # used to filter out smeared pointers
+        if symbols.symbol_table_is_64bit(context, symbol_table):
+            kernel_start = 0xFFFFF80000000000
+        else:
+            kernel_start = 0x80000000
+
+        for thread in thrdscan.ThrdScan.scan_threads(context, module_name):
+            # we don't want smeared or terminated threads
+            try:
+                proc = thread.owning_process()
+            except AttributeError:
+                continue
+
+            # we only care about kernel threads, 4 = System
+            # previous methods for determining if a thread was a kernel thread
+            # such as bit fields and flags are not stable in Win10+
+            # so we check if the thread is from the kernel itself or one its child
+            # kernel processes (MemCompression, Regsitry, ...)
+            if proc.UniqueProcessId != 4 and proc.InheritedFromUniqueProcessId != 4:
+                continue
+
+            if thread.StartAddress < kernel_start:
+                continue
+
+            module_symbols = list(
+                collection.get_module_symbols_by_absolute_location(thread.StartAddress)
+            )
+
+            # alert on threads that do not map to a module
+            if not module_symbols:
+                yield thread
diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py
new file mode 100644
index 000000000..955098d6b
--- /dev/null
+++ b/volatility3/framework/plugins/windows/pe_symbols.py
@@ -0,0 +1,1017 @@
+# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+
+import copy
+import io
+import logging
+import ntpath
+
+from typing import Dict, Tuple, Optional, List, Generator, Union, Callable
+
+import pefile
+
+from volatility3.framework import interfaces, exceptions
+from volatility3.framework import renderers, constants
+from volatility3.framework.configuration import requirements
+from volatility3.framework.renderers import format_hints
+from volatility3.framework.symbols import intermed
+from volatility3.framework.symbols.windows import pdbutil
+from volatility3.framework.symbols.windows.extensions import pe
+from volatility3.plugins.windows import pslist, modules
+from volatility3.framework.constants.windows import KERNEL_MODULE_NAMES
+
+vollog = logging.getLogger(__name__)
+
+# keys for specifying wanted names and/or addresses
+# used for consistent access between the API and plugins
+wanted_names_identifier = "names"
+wanted_addresses_identifier = "addresses"
+
+# how wanted modules/symbols are specified, such as:
+# {"ntdll.dll" : {wanted_addresses : [42, 43, 43]}}
+# {"ntdll.dll" : {wanted_names : ["NtCreateThread"]}}
+filter_module_info = Union[Dict[str, List[str]], Dict[str, List[int]]]
+filter_modules_type = Dict[str, filter_module_info]
+
+# holds resolved symbols
+# {"ntdll.dll": [("Bob", 123), ("Alice", 456)]}
+found_symbols_module = List[Tuple[str, int]]
+found_symbols_type = Dict[str, found_symbols_module]
+
+# used to hold informatin about a range (VAD or kernel module)
+# (start address, size, file path)
+range_type = Tuple[int, int, str]
+ranges_type = List[range_type]
+
+# collected_modules are modules and their symbols found when walking vads or kernel modules
+# Tuple of (process or kernel layer name, range start, range size)
+collected_module_instance = Tuple[str, int, int]
+collected_modules_info = List[collected_module_instance]
+collected_modules_type = Dict[str, collected_modules_info]
+
+PESymbolFinders = Union[interfaces.context.ModuleInterface, pefile.ExportDirData]
+
+
+class PESymbolFinder:
+    """
+    Interface for PE symbol finding classes
+    This interface provides a standard way for the calling code to
+    lookup symbols by name or address
+    """
+
+    cached_str_dict = Dict[str, Optional[str]]
+
+    cached_int_dict = Dict[str, Optional[int]]
+
+    cached_value = Union[int, str, None]
+    cached_module_lists = Union[Dict[str, List[str]], Dict[str, List[int]]]
+    cached_value_dict = Dict[str, cached_module_lists]
+
+    def __init__(
+        self,
+        layer_name: str,
+        mod_name: str,
+        module_start: int,
+        symbol_module: PESymbolFinders,
+    ):
+        self._layer_name = layer_name
+        self._mod_name = mod_name
+        self._module_start = module_start
+        self._symbol_module = symbol_module
+
+        self._address_cache: PESymbolFinder.cached_int_dict = {}
+        self._name_cache: PESymbolFinder.cached_str_dict = {}
+
+    def _get_cache_key(self, value: cached_value) -> str:
+        """
+        Maintain a cache for symbol lookups to avoid re-walking of PDB symbols or export tables
+        within the same module for the same address in the same layer
+
+        Args:
+            value: The value (address or name) being cached
+
+        Returns:
+            str: The constructed cache key that includes the layer and module name
+        """
+        return f"{self._layer_name}|{self._mod_name}|{value}"
+
+    def get_name_for_address(self, address: int) -> Optional[str]:
+        """
+        Returns the name for the given address within the particular layer and module
+
+        Args:
+            address: the address to resolve within the module
+
+        Returns:
+            str: the name of the symbol, if found
+        """
+        cached_key = self._get_cache_key(address)
+        if cached_key not in self._name_cache:
+            name = self._do_get_name(address)
+            self._name_cache[cached_key] = name
+
+        return self._name_cache[cached_key]
+
+    def get_address_for_name(self, name: str) -> Optional[int]:
+        """
+        Returns the name for the given address within the particular layer and module
+
+        Args:
+            str: the name of the symbol to resolve
+
+        Returns:
+            address: the address of the symbol, if found
+        """
+        cached_key = self._get_cache_key(name)
+        if cached_key not in self._address_cache:
+            address = self._do_get_address(name)
+            self._address_cache[cached_key] = address
+
+        return self._address_cache[cached_key]
+
+    def _do_get_name(self, address: int) -> Optional[str]:
+        """
+        Returns the name for the given address within the particular layer and module.
+        This method must be overwritten by sub classes.
+
+        Args:
+            address: the address to resolve within the module
+
+        Returns:
+            str: the name of the symbol, if found
+        """
+        raise NotImplementedError("_do_get_name must be overwritten")
+
+    def _do_get_address(self, name: str) -> Optional[int]:
+        """
+        Returns the name for the given address within the particular layer and module
+        This method must be overwritten by sub classes.
+
+        Args:
+            str: the name of the symbol to resolve
+
+        Returns:
+            address: the address of the symbol, if found
+        """
+        raise NotImplementedError("_do_get_address must be overwritten")
+
+
+class PDBSymbolFinder(PESymbolFinder):
+    """
+    PESymbolFinder implementation for  PDB modules
+    """
+
+    def _do_get_address(self, name: str) -> Optional[int]:
+        """
+        _do_get_address implementation for PDBSymbolFinder
+
+        Args:
+            str: the name of the symbol to resolve
+
+        Returns:
+            address: the address of the symbol, if found
+        """
+        try:
+            return self._symbol_module.get_absolute_symbol_address(name)
+        except exceptions.SymbolError:
+            return None
+
+    def _do_get_name(self, address: int) -> Optional[str]:
+        """
+        _do_get_name  implementation for PDBSymbolFinder
+
+        Args:
+            address: the address to resolve within the module
+
+        Returns:
+            str: the name of the symbol, if found
+        """
+        try:
+            name = self._symbol_module.get_symbols_by_absolute_location(address)[0]
+            return name.split(constants.BANG)[1]
+        except (exceptions.SymbolError, IndexError):
+            return None
+
+
+class ExportSymbolFinder(PESymbolFinder):
+    """
+    PESymbolFinder implementation for  PDB modules
+    """
+
+    def _get_name(self, export: pefile.ExportData) -> Optional[str]:
+        # AttributeError throws on empty or ordinal-only exports
+        try:
+            return export.name.decode("ascii")
+        except AttributeError:
+            return None
+
+    def _do_get_name(self, address: int) -> Optional[str]:
+        """
+        _do_get_name  implementation for ExportSymbolFinder
+
+        Args:
+            address: the address to resolve within the module
+
+        Returns:
+            str: the name of the symbol, if found
+        """
+        for export in self._symbol_module:
+            if export.address + self._module_start == address:
+                return self._get_name(export)
+
+        return None
+
+    def _do_get_address(self, name: str) -> Optional[int]:
+        """
+        _do_get_address implementation for ExportSymbolFinder
+        Args:
+            str: the name of the symbol to resolve
+
+        Returns:
+            address: the address of the symbol, if found
+        """
+
+        for export in self._symbol_module:
+            sym_name = self._get_name(export)
+            if sym_name and sym_name == name:
+                return self._module_start + export.address
+
+        return None
+
+
+class PESymbols(interfaces.plugins.PluginInterface):
+    """Prints symbols in PE files in process and kernel memory"""
+
+    _required_framework_version = (2, 7, 0)
+
+    _version = (1, 0, 0)
+
+    # used for special handling of the kernel PDB file. See later notes
+    os_module_name = "ntoskrnl.exe"
+
+    @classmethod
+    def get_requirements(cls) -> List:
+        # Since we're calling the plugin, make sure we have the plugin's requirements
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Windows kernel",
+                architectures=["Intel32", "Intel64"],
+            ),
+            requirements.VersionRequirement(
+                name="pslist", component=pslist.PsList, version=(2, 0, 0)
+            ),
+            requirements.VersionRequirement(
+                name="modules", component=modules.Modules, version=(2, 0, 0)
+            ),
+            requirements.VersionRequirement(
+                name="pdbutil", component=pdbutil.PDBUtility, version=(1, 0, 0)
+            ),
+            requirements.ChoiceRequirement(
+                name="source",
+                description="Where to resolve symbols.",
+                choices=["kernel", "processes"],
+                optional=False,
+            ),
+            requirements.StringRequirement(
+                name="module",
+                description='Module in which to resolve symbols. Use "ntoskrnl.exe" to resolve in the base kernel executable.',
+                optional=False,
+            ),
+            requirements.ListRequirement(
+                name="symbols",
+                element_type=str,
+                description="Symbol name to resolve",
+                optional=True,
+            ),
+            requirements.ListRequirement(
+                name="addresses",
+                element_type=int,
+                description="Address of symbol to resolve",
+                optional=True,
+            ),
+        ]
+
+    @staticmethod
+    def _get_pefile_obj(
+        context: interfaces.context.ContextInterface,
+        pe_table_name: str,
+        layer_name: str,
+        base_address: int,
+    ) -> Optional[pefile.PE]:
+        """
+        Attempts to pefile object from the bytes of the PE file
+
+        Args:
+            pe_table_name: name of the pe types table
+            layer_name: name of the process layer
+            base_address: base address of the module
+
+        Returns:
+            the constructed pefile object
+        """
+        pe_data = io.BytesIO()
+
+        try:
+            dos_header = context.object(
+                pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER",
+                offset=base_address,
+                layer_name=layer_name,
+            )
+
+            for offset, data in dos_header.reconstruct():
+                pe_data.seek(offset)
+                pe_data.write(data)
+
+            pe_ret = pefile.PE(data=pe_data.getvalue(), fast_load=True)
+
+        except exceptions.InvalidAddressException:
+            pe_ret = None
+
+        return pe_ret
+
+    @staticmethod
+    def range_info_for_address(
+        ranges: ranges_type, address: int
+    ) -> Optional[range_type]:
+        """
+        Helper for getting the range information for an address.
+        Finds the range holding the `address` parameter
+
+        Args:
+            address: the address to find the range for
+
+        Returns:
+            Tuple[int, int, str]: The starting address, size, and file path of the range
+
+        """
+        for start, size, filepath in ranges:
+            if start <= address < start + size:
+                return start, size, filepath
+
+        return None
+
+    @staticmethod
+    def filepath_for_address(ranges: ranges_type, address: int) -> Optional[str]:
+        """
+        Helper to get the file path for an address
+
+        Args:
+            ranges: The set of VADs with mapped files to find the address
+            address: The address to find inside of the VADs set
+
+        Returns:
+            str: The full path of the file, if found and present
+        """
+        info = PESymbols.range_info_for_address(ranges, address)
+        if info:
+            return info[2]
+
+        return None
+
+    @staticmethod
+    def filename_for_path(filepath: str) -> str:
+        """
+        Consistent way to get the filename regardless of platform
+
+        Args:
+            str: the file path from `filepath_for_address`
+
+        Returns:
+            str: the bsae file name of the full path
+        """
+        return ntpath.basename(filepath).lower()
+
+    @staticmethod
+    def addresses_for_process_symbols(
+        context: interfaces.context.ContextInterface,
+        config_path: str,
+        layer_name: str,
+        symbol_table_name: str,
+        symbols: filter_modules_type,
+    ) -> found_symbols_type:
+        """
+        Used to easily resolve the  addresses of names inside of modules.
+
+        See the usage of this function for system call resolution in  unhooked_system_calls.py
+        for an easy to understand example.
+
+        Args:
+            symbols: The dictionary of symbols requested by the caller
+
+        Returns:
+            found_symbols_type: The dictionary of symbols that were resolved
+        """
+        collected_modules = PESymbols.get_process_modules(
+            context, layer_name, symbol_table_name, symbols
+        )
+
+        found_symbols, missing_symbols = PESymbols.find_symbols(
+            context, config_path, symbols, collected_modules
+        )
+
+        for mod_name, unresolved_symbols in missing_symbols.items():
+            for symbol in unresolved_symbols:
+                vollog.debug(f"Unable to resolve symbol {symbol} in module {mod_name}")
+
+        return found_symbols
+
+    @staticmethod
+    def path_and_symbol_for_address(
+        context: interfaces.context.ContextInterface,
+        config_path: str,
+        collected_modules: collected_modules_type,
+        ranges: ranges_type,
+        address: int,
+    ) -> Tuple[Optional[str], Optional[str]]:
+        """
+        Method for plugins to determine the file path and symbol name for a given address
+
+        See debugregisters.py for an example of how this function is used along with get_vads_for_process_cache
+        for resolving symbols in processes.
+
+        Args:
+            collected_modules: return value from `get_kernel_modules` or `get_process_modules`
+            ranges: the memory ranges to examine in this layer.
+            address: address to resolve to its symbol name
+        Returns:
+            Tuple[str|renderers.NotApplicableValue|renderers.NotAvailableValue, str|renderers.NotApplicableValue|renderers.NotAvailableValue]
+        """
+        if not address:
+            return None, None
+
+        filepath = PESymbols.filepath_for_address(ranges, address)
+
+        if not filepath:
+            return None, None
+
+        filename = PESymbols.filename_for_path(filepath).lower()
+
+        # setup to resolve the address
+        filter_module: filter_modules_type = {
+            filename: {wanted_addresses_identifier: [address]}
+        }
+
+        found_symbols, _missing_symbols = PESymbols.find_symbols(
+            context, config_path, filter_module, collected_modules
+        )
+
+        if not found_symbols or filename not in found_symbols:
+            return filepath, None
+
+        return filepath, found_symbols[filename][0][0]
+
+    @staticmethod
+    def _get_exported_symbols(
+        context: interfaces.context.ContextInterface,
+        pe_table_name: str,
+        mod_name: str,
+        module_info: collected_module_instance,
+    ) -> Optional[ExportSymbolFinder]:
+        """
+        Attempts to locate symbols based on export analysis
+
+        Args:
+            mod_name: lower case name of the module to resolve symbols in
+            module_info: (layer_name, module_start, module_size) of the module to examine
+
+        Returns:
+            Optional[ExportSymbolFinder]: If the export table can be resolved, then the ExportSymbolFinder
+            instance for it
+        """
+
+        layer_name = module_info[0]
+        module_start = module_info[1]
+
+        # we need a valid PE with an export table
+        pe_module = PESymbols._get_pefile_obj(
+            context, pe_table_name, layer_name, module_start
+        )
+        if not pe_module:
+            return None
+
+        pe_module.parse_data_directories(
+            directories=[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_EXPORT"]]
+        )
+        if not hasattr(pe_module, "DIRECTORY_ENTRY_EXPORT"):
+            return None
+
+        return ExportSymbolFinder(
+            layer_name,
+            mod_name.lower(),
+            module_start,
+            pe_module.DIRECTORY_ENTRY_EXPORT.symbols,
+        )
+
+    @staticmethod
+    def _get_pdb_module(
+        context: interfaces.context.ContextInterface,
+        config_path: str,
+        mod_name: str,
+        module_info: collected_module_instance,
+    ) -> Optional[PDBSymbolFinder]:
+        """
+        Attempts to locate symbols based on PDB analysis through each layer where the mod_name module was found
+
+        Args:
+            mod_name: lower case name of the module to resolve symbols in
+            module_info: (layer_name, module_start, module_size) of the module to examine
+
+        Returns:
+            Optional[PDBSymbolFinder]: If the export table can be resolved, then the ExportSymbolFinder
+        """
+
+        mod_symbols = None
+
+        layer_name, module_start, module_size = module_info
+
+        # the PDB name of the kernel file is not consistent for an exe, for example,
+        # a `ntoskrnl.exe` can have an internal PDB name of any of the ones in the following list
+        # The code attempts to find all possible PDBs to ensure the best chance of recovery
+        if mod_name == PESymbols.os_module_name:
+            pdb_names = [fn + ".pdb" for fn in KERNEL_MODULE_NAMES]
+
+        # for non-kernel files, replace the exe, sys, or dll extension with pdb
+        else:
+            # in testing we found where some DLLs, such amsi.dll, have its PDB string as Amsi.dll
+            # in certain Windows versions
+            mod_name = mod_name[:-3] + "pdb"
+            first_upper = mod_name[0].upper() + mod_name[1:]
+            pdb_names = [mod_name, first_upper]
+
+        # loop through each PDB name (all the kernel names or the dll name as lower() + first char upper case)
+        for pdb_name in pdb_names:
+            try:
+                mod_symbols = pdbutil.PDBUtility.symbol_table_from_pdb(
+                    context,
+                    interfaces.configuration.path_join(config_path, mod_name),
+                    layer_name,
+                    pdb_name,
+                    module_start,
+                    module_size,
+                )
+
+                if mod_symbols:
+                    break
+
+            # this exception is expected when the PDB can't be found or downloaded
+            except exceptions.VolatilityException:
+                continue
+
+            # this is not expected - it means pdbconv broke when parsing the PDB
+            except TypeError as e:
+                vollog.error(
+                    f"Unable to parse PDB file for module {pdb_name} -> {e}. Please file a bug on the GitHub issue tracker."
+                )
+
+        # cannot do anything without the symbols
+        if not mod_symbols:
+            return None
+
+        pdb_module = context.module(
+            mod_symbols, layer_name=layer_name, offset=module_start
+        )
+
+        return PDBSymbolFinder(layer_name, mod_name, module_start, pdb_module)
+
+    @staticmethod
+    def _find_symbols_through_pdb(
+        context: interfaces.context.ContextInterface,
+        config_path: str,
+        module_instances: collected_modules_info,
+        mod_name: str,
+    ) -> Generator[PDBSymbolFinder, None, None]:
+        """
+        Attempts to resolve the symbols in `mod_name` through PDB analysis
+
+        Args:
+            module_instances: the set of layers in which the module was found
+            mod_name: name of the module to resolve symbols in
+        Returns:
+            Generator[PDBSymbolFinder]: a PDBSymbolFinder instance for each layer in which the module was found
+        """
+        for module_info in module_instances:
+            mod_module = PESymbols._get_pdb_module(
+                context, config_path, mod_name, module_info
+            )
+            if mod_module:
+                yield mod_module
+
+    @staticmethod
+    def _find_symbols_through_exports(
+        context: interfaces.context.ContextInterface,
+        config_path: str,
+        module_instances: collected_modules_info,
+        mod_name: str,
+    ) -> Generator[ExportSymbolFinder, None, None]:
+        """
+        Attempts to resolve the symbols in `mod_name` through export analysis
+
+        Args:
+            module_instances: the set of layers in which the module was found
+            mod_name: name of the module to resolve symbols in
+        Returns:
+            Generator[ExportSymbolFinder]: an ExportSymbolFinder instance for each layer in which the module was found
+        """
+        pe_table_name = intermed.IntermediateSymbolTable.create(
+            context, config_path, "windows", "pe", class_types=pe.class_types
+        )
+
+        # for each process layer and VAD, construct a PE and examine the export table
+        for module_info in module_instances:
+            exported_symbols = PESymbols._get_exported_symbols(
+                context, pe_table_name, mod_name, module_info
+            )
+            if exported_symbols:
+                yield exported_symbols
+
+    @staticmethod
+    def _get_symbol_value(
+        wanted_symbols: filter_module_info,
+        symbol_resolver: PESymbolFinder,
+    ) -> Generator[Tuple[str, int, str, int], None, None]:
+        """
+        Enumerates the symbols specified as wanted by the calling plugin
+
+        Args:
+            wanted_symbols: the set of symbols for a particular module
+            symbol_resolver: method in a layer to resolve the symbols
+
+        Returns:
+            Tuple[str, int, str, int]: the index and value of the found symbol in the wanted list, and the name and address of resolved symbol
+        """
+        if (
+            wanted_names_identifier not in wanted_symbols
+            and wanted_addresses_identifier not in wanted_symbols
+        ):
+            vollog.warning(
+                f"Invalid `wanted_symbols` sent to `find_symbols`. addresses and names keys both misssing."
+            )
+            return
+
+        symbol_keys: List[Tuple[str, Callable]] = [
+            (wanted_names_identifier, symbol_resolver.get_address_for_name),
+            (wanted_addresses_identifier, symbol_resolver.get_name_for_address),
+        ]
+
+        for symbol_key, symbol_getter in symbol_keys:
+            # address or name
+            if symbol_key in wanted_symbols:
+                # walk each wanted address or name
+                for value_index, wanted_value in enumerate(wanted_symbols[symbol_key]):
+                    symbol_value = symbol_getter(wanted_value)
+
+                    if symbol_value:
+                        # yield out deleteion key, deletion index, symbol name, symbol address
+                        if symbol_key == wanted_names_identifier:
+                            yield symbol_key, value_index, wanted_value, symbol_value  # type: ignore
+                        else:
+                            yield symbol_key, value_index, symbol_value, wanted_value  # type: ignore
+
+    @staticmethod
+    def _resolve_symbols_through_methods(
+        context: interfaces.context.ContextInterface,
+        config_path: str,
+        module_instances: collected_modules_info,
+        wanted_modules: PESymbolFinder.cached_value_dict,
+        mod_name: str,
+    ) -> Tuple[found_symbols_module, PESymbolFinder.cached_module_lists]:
+        """
+        Attempts to resolve every wanted symbol in `mod_name`
+        Every layer is enumerated for maximum chance of recovery
+
+        Args:
+            module_instances: the set of layers in which the module was found
+            wanted_modules: The symbols to resolve tied to their module names
+            mod_name: name of the module to resolve symbols in
+        Returns:
+            Tuple[found_symbols_module, PESymbolFinder.cached_module_lists]: The set of found symbols and the ones that could not be resolved
+        """
+        symbol_resolving_methods = [
+            PESymbols._find_symbols_through_pdb,
+            PESymbols._find_symbols_through_exports,
+        ]
+
+        found: found_symbols_module = []
+
+        # the symbols wanted from this module by the caller
+        wanted = wanted_modules[mod_name]
+
+        # make a copy to remove from inside this function for returning to the caller
+        remaining = copy.deepcopy(wanted)
+
+        done_processing = False
+
+        for method in symbol_resolving_methods:
+            # every layer where this module was found through the given method
+            for symbol_resolver in method(
+                context, config_path, module_instances, mod_name
+            ):
+                vollog.debug(f"Have resolver for method {method}")
+                for (
+                    symbol_key,
+                    value_index,
+                    symbol_name,
+                    symbol_address,
+                ) in PESymbols._get_symbol_value(remaining, symbol_resolver):
+                    found.append((symbol_name, symbol_address))
+                    del remaining[symbol_key][value_index]
+
+                    # everything was resolved, stop this resolver
+                    # remove this key from the remaining symbols to resolve
+                    if not remaining[symbol_key]:
+                        del remaining[symbol_key]
+                        done_processing = True
+                        break
+
+                if done_processing:
+                    break
+
+            # stop all resolving
+            if done_processing:
+                break
+
+        return found, remaining
+
+    @staticmethod
+    def find_symbols(
+        context: interfaces.context.ContextInterface,
+        config_path: str,
+        wanted_modules: PESymbolFinder.cached_value_dict,
+        collected_modules: collected_modules_type,
+    ) -> Tuple[found_symbols_type, PESymbolFinder.cached_value_dict]:
+        """
+        Loops through each method of symbol analysis until each wanted symbol is found
+        Returns the resolved symbols as a dictionary that includes the name and runtime address
+
+        Args:
+            wanted_modules: the dictionary of modules and symbols to resolve. Modified to remove symbols as they are resolved.
+            collected_modules: return value from `get_kernel_modules` or `get_process_modules`
+        Returns:
+            Tuple[found_symbols_type, PESymbolFinder.cached_value_dict]: The set of found symbols but the ones that could not be resolved
+        """
+        found_symbols: found_symbols_type = {}
+        missing_symbols: PESymbolFinder.cached_value_dict = {}
+
+        for mod_name in wanted_modules:
+            if mod_name not in collected_modules:
+                continue
+
+            module_instances = collected_modules[mod_name]
+
+            # try to resolve the symbols for `mod_name` through each method (PDB and export table currently)
+            (
+                found_in_module,
+                missing_in_module,
+            ) = PESymbols._resolve_symbols_through_methods(
+                context, config_path, module_instances, wanted_modules, mod_name
+            )
+
+            if found_in_module:
+                found_symbols[mod_name] = found_in_module
+
+            if missing_in_module:
+                missing_symbols[mod_name] = missing_in_module
+
+        return found_symbols, missing_symbols
+
+    @staticmethod
+    def get_kernel_modules(
+        context: interfaces.context.ContextInterface,
+        layer_name: str,
+        symbol_table: str,
+        filter_modules: Optional[filter_modules_type],
+    ) -> collected_modules_type:
+        """
+        Walks the kernel module list and finds the session layer, base, and size of each wanted module
+
+        Args:
+            filter_modules: The modules to filter the gathering to. If left as None, all kernel modules are gathered.
+        Returns:
+            collected_modules_type: The collection of modules found with at least one layer present
+        """
+        found_modules: collected_modules_type = {}
+
+        if filter_modules:
+            # create a tuple of module names for use with `endswith`
+            filter_modules_check = tuple([key.lower() for key in filter_modules.keys()])
+        else:
+            filter_modules_check = None
+
+        session_layers = list(
+            modules.Modules.get_session_layers(context, layer_name, symbol_table)
+        )
+
+        # special handling for the kernel
+        gather_kernel = (
+            filter_modules_check and PESymbols.os_module_name in filter_modules_check
+        )
+
+        for index, mod in enumerate(
+            modules.Modules.list_modules(context, layer_name, symbol_table)
+        ):
+            try:
+                mod_name = str(mod.BaseDllName.get_string().lower())
+            except exceptions.InvalidAddressException:
+                continue
+
+            # to analyze, it must either be the kernel or a wanted module
+            if not filter_modules_check or (gather_kernel and index == 0):
+                mod_name = PESymbols.os_module_name
+            elif filter_modules_check and not mod_name.endswith(filter_modules_check):
+                continue
+
+            # we won't find symbol information if we can't analyze the module
+            session_layer_name = modules.Modules.find_session_layer(
+                context, session_layers, mod.DllBase
+            )
+            if not session_layer_name:
+                continue
+
+            if mod_name not in found_modules:
+                found_modules[mod_name] = []
+
+            found_modules[mod_name].append(
+                (session_layer_name, mod.DllBase, mod.SizeOfImage)
+            )
+
+        return found_modules
+
+    @staticmethod
+    def get_vads_for_process_cache(
+        vads_cache: Dict[int, ranges_type],
+        owner_proc: interfaces.objects.ObjectInterface,
+    ) -> Optional[ranges_type]:
+        """
+        Creates and utilizes a cache of a process' VADs for efficient lookups
+
+        Returns the vad information of the VAD hosting the address, if found
+
+        Args:
+            vads_cache: The existing cache of VADs
+            owner_proc: The process being inspected
+        Returns:
+            Optional[ranges_type]: The range holding the address, if found
+        """
+        if owner_proc.vol.offset in vads_cache:
+            vads = vads_cache[owner_proc.vol.offset]
+        else:
+            vads = PESymbols.get_proc_vads_with_file_paths(owner_proc)
+            vads_cache[owner_proc.vol.offset] = vads
+
+        # smear or terminated process
+        if len(vads) == 0:
+            return None
+
+        return vads
+
+    @staticmethod
+    def get_proc_vads_with_file_paths(
+        proc: interfaces.objects.ObjectInterface,
+    ) -> ranges_type:
+        """
+        Returns a list of the process' vads that map a file
+
+        Args:
+            proc: The process to gather the VADs for
+
+        Returns:
+            ranges_type: The list of VADs for this process that map a file
+        """
+        vads: ranges_type = []
+
+        try:
+            vad_root = proc.get_vad_root()
+        except exceptions.InvalidAddressException:
+            return vads
+
+        for vad in vad_root.traverse():
+            filepath = vad.get_file_name()
+
+            if not isinstance(filepath, str) or filepath.count("\\") == 0:
+                continue
+
+            vads.append((vad.get_start(), vad.get_size(), filepath))
+
+        return vads
+
+    @classmethod
+    def get_all_vads_with_file_paths(
+        cls,
+        context: interfaces.context.ContextInterface,
+        layer_name: str,
+        symbol_table_name: str,
+    ) -> Generator[
+        Tuple[interfaces.objects.ObjectInterface, str, ranges_type],
+        None,
+        None,
+    ]:
+        """
+        Yields each set of vads for a process that have a file mapped, along with the process itself and its layer
+
+        Args:
+            Generator[Tuple[interfaces.objects.ObjectInterface, str, ranges_type]]: Yields tuple of process objects, layers, and VADs mapping files
+        """
+        procs = pslist.PsList.list_processes(
+            context=context,
+            layer_name=layer_name,
+            symbol_table=symbol_table_name,
+        )
+
+        for proc in procs:
+            try:
+                proc_layer_name = proc.add_process_layer()
+            except exceptions.InvalidAddressException:
+                continue
+
+            vads = cls.get_proc_vads_with_file_paths(proc)
+
+            yield proc, proc_layer_name, vads
+
+    @staticmethod
+    def get_process_modules(
+        context: interfaces.context.ContextInterface,
+        layer_name: str,
+        symbol_table: str,
+        filter_modules: Optional[filter_modules_type],
+    ) -> collected_modules_type:
+        """
+        Walks the process list and each process' VAD to determine the base address and size of wanted modules
+
+        Args:
+            filter_modules: The modules to filter the gathering to. If left as None, all process modules are gathered.
+        Returns:
+            collected_modules_type: The collection of modules found with at least one layer present
+        """
+        proc_modules: collected_modules_type = {}
+
+        if filter_modules:
+            # create a tuple of module names for use with `endswith`
+            filter_modules_check = tuple([key.lower() for key in filter_modules.keys()])
+        else:
+            filter_modules_check = None
+
+        for _proc, proc_layer_name, vads in PESymbols.get_all_vads_with_file_paths(
+            context, layer_name, symbol_table
+        ):
+            for vad_start, vad_size, filepath in vads:
+                filename = PESymbols.filename_for_path(filepath)
+
+                if filter_modules_check and not filename.endswith(filter_modules_check):
+                    continue
+
+                # track each module along with the process layer and range to find it
+                if filename not in proc_modules:
+                    proc_modules[filename] = []
+
+                proc_modules[filename].append((proc_layer_name, vad_start, vad_size))
+
+        return proc_modules
+
+    def _generator(self) -> Generator[Tuple[int, Tuple[str, str, int]], None, None]:
+        kernel = self.context.modules[self.config["kernel"]]
+
+        if self.config["symbols"]:
+            filter_module = {
+                self.config["module"].lower(): {
+                    wanted_names_identifier: self.config["symbols"]
+                }
+            }
+
+        elif self.config["addresses"]:
+            filter_module = {
+                self.config["module"].lower(): {
+                    wanted_addresses_identifier: self.config["addresses"]
+                }
+            }
+
+        else:
+            vollog.error("--address or --symbol must be specified")
+            return
+
+        if self.config["source"] == "kernel":
+            module_resolver = self.get_kernel_modules
+        else:
+            module_resolver = self.get_process_modules
+
+        collected_modules = module_resolver(
+            self.context, kernel.layer_name, kernel.symbol_table_name, filter_module
+        )
+
+        found_symbols, _missing_symbols = PESymbols.find_symbols(
+            self.context, self.config_path, filter_module, collected_modules
+        )
+
+        for module, symbols in found_symbols.items():
+            for symbol, address in symbols:
+                yield (0, (module, symbol, format_hints.Hex(address)))
+
+    def run(self) -> renderers.TreeGrid:
+        return renderers.TreeGrid(
+            [
+                ("Module", str),
+                ("Symbol", str),
+                ("Address", format_hints.Hex),
+            ],
+            self._generator(),
+        )
diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py
index 8234b210f..478cc8b1b 100644
--- a/volatility3/framework/plugins/windows/pslist.py
+++ b/volatility3/framework/plugins/windows/pslist.py
@@ -4,7 +4,7 @@
 
 import datetime
 import logging
-from typing import Callable, Iterable, List, Type
+from typing import Callable, Iterator, List, Type
 
 from volatility3.framework import renderers, interfaces, layers, exceptions, constants
 from volatility3.framework.configuration import requirements
@@ -12,6 +12,7 @@ from volatility3.framework.objects import utility
 from volatility3.framework.renderers import format_hints
 from volatility3.framework.symbols import intermed
 from volatility3.framework.symbols.windows.extensions import pe
+from volatility3.framework.symbols.windows import extensions
 from volatility3.plugins import timeliner
 
 vollog = logging.getLogger(__name__)
@@ -197,7 +198,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
         filter_func: Callable[
             [interfaces.objects.ObjectInterface], bool
         ] = lambda _: False,
-    ) -> Iterable[interfaces.objects.ObjectInterface]:
+    ) -> Iterator["extensions.EPROCESS"]:
         """Lists all the processes in the primary layer that are in the pid
         config option.
 
diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py
index 71919c410..a8d185a2c 100644
--- a/volatility3/framework/plugins/windows/psxview.py
+++ b/volatility3/framework/plugins/windows/psxview.py
@@ -1,9 +1,14 @@
-import datetime, logging, string
+import datetime
+import logging
+import string
+from itertools import chain
+from typing import Dict, Iterable, List
 
 from volatility3.framework import constants, exceptions
-from volatility3.framework.interfaces import plugins
 from volatility3.framework.configuration import requirements
-from volatility3.framework.renderers import format_hints, TreeGrid
+from volatility3.framework.interfaces import plugins
+from volatility3.framework.renderers import TreeGrid, format_hints
+from volatility3.framework.symbols.windows import extensions
 from volatility3.plugins.windows import (
     handles,
     info,
@@ -71,20 +76,19 @@ class PsXView(plugins.PluginInterface):
             "string", max_length=proc.ImageFileName.vol.count, errors="replace"
         )
 
-    def _is_valid_proc_name(self, str):
-        for c in str:
-            if not c in self.valid_proc_name_chars:
-                return False
-        return True
+    def _is_valid_proc_name(self, string: str) -> bool:
+        return all(c in self.valid_proc_name_chars for c in string)
 
-    def _filter_garbage_procs(self, proc_list):
+    def _filter_garbage_procs(
+        self, proc_list: Iterable[extensions.EPROCESS]
+    ) -> List[extensions.EPROCESS]:
         return [
             p
             for p in proc_list
             if p.is_valid() and self._is_valid_proc_name(self._proc_name_to_string(p))
         ]
 
-    def _translate_offset(self, offset):
+    def _translate_offset(self, offset: int) -> int:
         if not self.config["physical-offsets"]:
             return offset
 
@@ -100,21 +104,25 @@ class PsXView(plugins.PluginInterface):
 
         return offset
 
-    def _proc_list_to_dict(self, tasks):
+    def _proc_list_to_dict(
+        self, tasks: Iterable[extensions.EPROCESS]
+    ) -> Dict[int, extensions.EPROCESS]:
         tasks = self._filter_garbage_procs(tasks)
         return {self._translate_offset(proc.vol.offset): proc for proc in tasks}
 
     def _check_pslist(self, tasks):
         return self._proc_list_to_dict(tasks)
 
-    def _check_psscan(self, layer_name, symbol_table):
+    def _check_psscan(
+        self, layer_name: str, symbol_table: str
+    ) -> Dict[int, extensions.EPROCESS]:
         res = psscan.PsScan.scan_processes(
             context=self.context, layer_name=layer_name, symbol_table=symbol_table
         )
 
         return self._proc_list_to_dict(res)
 
-    def _check_thrdscan(self):
+    def _check_thrdscan(self) -> Dict[int, extensions.EPROCESS]:
         ret = []
 
         for ethread in thrdscan.ThrdScan.scan_threads(
@@ -135,33 +143,38 @@ class PsXView(plugins.PluginInterface):
 
         return self._proc_list_to_dict(ret)
 
-    def _check_csrss_handles(self, tasks, layer_name, symbol_table):
-        ret = []
+    def _check_csrss_handles(
+        self, tasks: Iterable[extensions.EPROCESS], layer_name: str, symbol_table: str
+    ) -> Dict[int, extensions.EPROCESS]:
+        ret: List[extensions.EPROCESS] = []
+
+        handles_plugin = handles.Handles(
+            context=self.context, config_path=self.config_path
+        )
+
+        type_map = handles_plugin.get_type_map(self.context, layer_name, symbol_table)
+
+        cookie = handles_plugin.find_cookie(
+            context=self.context,
+            layer_name=layer_name,
+            symbol_table=symbol_table,
+        )
 
         for p in tasks:
             name = self._proc_name_to_string(p)
-            if name == "csrss.exe":
-                try:
-                    if p.has_member("ObjectTable"):
-                        handles_plugin = handles.Handles(
-                            context=self.context, config_path=self.config_path
-                        )
-                        hndls = list(handles_plugin.handles(p.ObjectTable))
-                        for h in hndls:
-                            if (
-                                h.get_object_type(
-                                    handles_plugin.get_type_map(
-                                        self.context, layer_name, symbol_table
-                                    )
-                                )
-                                == "Process"
-                            ):
-                                ret.append(h.Body.cast("_EPROCESS"))
+            if name != "csrss.exe":
+                continue
 
-                except exceptions.InvalidAddressException:
-                    vollog.log(
-                        constants.LOGLEVEL_VVV, "Cannot access eprocess object table"
-                    )
+            try:
+                ret += [
+                    handle.Body.cast("_EPROCESS")
+                    for handle in handles_plugin.handles(p.ObjectTable)
+                    if handle.get_object_type(type_map, cookie) == "Process"
+                ]
+            except exceptions.InvalidAddressException:
+                vollog.log(
+                    constants.LOGLEVEL_VVV, "Cannot access eprocess object table"
+                )
 
         return self._proc_list_to_dict(ret)
 
@@ -178,7 +191,7 @@ class PsXView(plugins.PluginInterface):
         )
 
         # get processes from each source
-        processes = {}
+        processes: Dict[str, Dict[int, extensions.EPROCESS]] = {}
 
         processes["pslist"] = self._check_pslist(kdbg_list_processes)
         processes["psscan"] = self._check_psscan(layer_name, symbol_table)
@@ -187,27 +200,20 @@ class PsXView(plugins.PluginInterface):
             kdbg_list_processes, layer_name, symbol_table
         )
 
-        # print results
-
-        # list of lists of offsets
-        offsets = [list(processes[source].keys()) for source in processes]
-
-        # flatten to one list
-        offsets = sum(offsets, [])
-
-        # remove duplicates
-        offsets = set(offsets)
+        # Unique set of all offsets from all sources
+        offsets = set(chain(*(mapping.keys() for mapping in processes.values())))
 
         for offset in offsets:
-            proc = None
+            # We know there will be at least one process mapped to each offset
+            proc: extensions.EPROCESS = next(
+                mapping[offset] for mapping in processes.values() if offset in mapping
+            )
 
             in_sources = {src: False for src in processes}
 
-            for source in processes:
-                if offset in processes[source]:
+            for source, process_mapping in processes.items():
+                if offset in process_mapping:
                     in_sources[source] = True
-                    if not proc:
-                        proc = processes[source][offset]
 
             pid = proc.UniqueProcessId
             name = self._proc_name_to_string(proc)
diff --git a/volatility3/framework/plugins/windows/registry/hivelist.py b/volatility3/framework/plugins/windows/registry/hivelist.py
index 1cc76dad6..ddc9c1855 100644
--- a/volatility3/framework/plugins/windows/registry/hivelist.py
+++ b/volatility3/framework/plugins/windows/registry/hivelist.py
@@ -2,9 +2,9 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 import logging
-from typing import Iterator, List, Tuple, Iterable, Optional
+from typing import Iterator, List, Optional, Tuple
 
-from volatility3.framework import renderers, interfaces, exceptions
+from volatility3.framework import exceptions, interfaces, renderers
 from volatility3.framework.configuration import requirements
 from volatility3.framework.layers import registry
 from volatility3.framework.renderers import format_hints
@@ -140,8 +140,8 @@ class HiveList(interfaces.plugins.PluginInterface):
         layer_name: str,
         symbol_table: str,
         filter_string: Optional[str] = None,
-        hive_offsets: List[int] = None,
-    ) -> Iterable[registry.RegistryHive]:
+        hive_offsets: Optional[List[int]] = None,
+    ) -> Iterator[registry.RegistryHive]:
         """Walks through a registry, hive by hive returning the constructed
         registry layer name.
 
@@ -200,7 +200,7 @@ class HiveList(interfaces.plugins.PluginInterface):
         context: interfaces.context.ContextInterface,
         layer_name: str,
         symbol_table: str,
-        filter_string: str = None,
+        filter_string: Optional[str] = None,
     ) -> Iterator[interfaces.objects.ObjectInterface]:
         """Lists all the hives in the primary layer.
 
diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py
index 180f8f9d9..4fe3f97fb 100644
--- a/volatility3/framework/plugins/windows/registry/printkey.py
+++ b/volatility3/framework/plugins/windows/registry/printkey.py
@@ -20,7 +20,7 @@ class PrintKey(interfaces.plugins.PluginInterface):
     """Lists the registry keys under a hive or specific key value."""
 
     _required_framework_version = (2, 0, 0)
-    _version = (1, 0, 0)
+    _version = (1, 1, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -282,7 +282,7 @@ class PrintKey(interfaces.plugins.PluginInterface):
                         renderers.UnreadableValue(),
                         format_hints.Hex(hive.hive_offset),
                         "Key",
-                        "?\\" + (key or ""),
+                        f"{hive.get_name()}\\" + (key or ""),
                         renderers.UnreadableValue(),
                         renderers.UnreadableValue(),
                         renderers.UnreadableValue(),
diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py
new file mode 100644
index 000000000..277a0d856
--- /dev/null
+++ b/volatility3/framework/plugins/windows/scheduled_tasks.py
@@ -0,0 +1,1408 @@
+# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+
+import base64
+import binascii
+import dataclasses
+import datetime
+import enum
+import io
+import itertools
+import logging
+import struct
+from typing import Dict, Iterator, List, Optional, Tuple, Union
+
+from volatility3.framework import exceptions, interfaces, renderers
+from volatility3.framework.configuration import requirements
+from volatility3.framework.layers import registry
+from volatility3.framework.renderers import conversion
+from volatility3.framework.symbols.windows.extensions import registry as reg_extensions
+from volatility3.plugins import timeliner
+from volatility3.plugins.windows.registry import hivelist
+
+vollog = logging.getLogger(__name__)
+
+# Reference: https://cyber.wtf/2022/06/01/windows-registry-analysis-todays-episode-tasks/
+
+
+class TimeMode(enum.Enum):
+    """
+    Enumeration containing the different time modes that a 'Time' trigger can be configured to run in.
+    """
+
+    Once = "Once"
+
+    # run at <start_boundary> and repeat every <data1> days
+    Daily = "Daily"
+
+    # run on days of week <(data2 as day_of_week bitmap)> every <data1> weeks starting at <start_boundary>
+    Weekly = "Weekly"
+
+    # run in months <(data3 as months bitmap> on days <(data2:data1 as day in month bitmap)>
+    # starting at <start_boundary>
+    DaysInMonths = "Days In Months"
+
+    # run in months <(data3 as months bitmap> in weeks <(data2 as week bitmap)>
+    # on days <(data1 as day_of_week bitmap)> starting at <start_boundary>
+    DaysInWeeksInMonths = "Days In Weeks in Months"
+
+    Unknown = "Unknown"
+
+
+TIME_MODE_DESCRIPTION = {
+    TimeMode.Once: "Once",
+    TimeMode.Daily: "Daily",
+    TimeMode.Weekly: "Weekly",
+    TimeMode.DaysInMonths: "Days In Months",
+    TimeMode.DaysInWeeksInMonths: "Days In Weeks In Months",
+    TimeMode.Unknown: "Unknown",
+}
+
+
+class ActionType(enum.Enum):
+    """
+    Enumeration that maps action types to their magic number encodings
+    """
+
+    Exe = 0x6666
+    ComHandler = 0x7777
+    Email = 0x8888
+    MessageBox = 0x9999
+
+
+class TriggerType(enum.Enum):
+    """
+    Enumeration that maps trigger types to their magic number encodings
+    """
+
+    WindowsNotificationFacility = 0x6666
+    Session = 0x7777
+    Registration = 0x8888
+    Logon = 0xAAAA
+    Event = 0xCCCC
+    Time = 0xDDDD
+    Idle = 0xEEEE
+    Boot = 0xFFFF
+
+
+class Weekday(enum.Enum):
+    """
+    Enumeration that contains bitwise values for days of the week.
+    """
+
+    Sunday = 0x1
+    Monday = 0x2
+    Tuesday = 0x4
+    Wednesday = 0x8
+    Thursday = 0x10
+    Friday = 0x20
+    Saturday = 0x40
+
+
+class Months(enum.Enum):
+    """
+    Enumeration that contains bitwise values for months of the year.
+    """
+
+    January = 0x1
+    February = 0x2
+    March = 0x4
+    April = 0x8
+    May = 0x10
+    June = 0x20
+    July = 0x40
+    August = 0x80
+    September = 0x100
+    October = 0x200
+    November = 0x400
+    December = 0x800
+
+
+class SidType(enum.Enum):
+    """
+    Enumeration that maps SID types to their encoded integer values
+    """
+
+    User = 1
+    Group = 2
+    Domain = 3
+    Alias = 4
+    WellKnownGroup = 5
+    DeletedAccount = 6
+    Invalid = 7
+    Unknown = 8
+    Computer = 9
+    Label = 10
+    LogonSession = 11
+
+
+@dataclasses.dataclass
+class TaskSchedulerTimePeriod:
+    """
+    Class containing information delimiting time periods within scheduled tasks.
+    """
+
+    years: int
+    months: int
+    weeks: int
+    days: int
+    hours: int
+    minutes: int
+    seconds: int
+
+
+JOB_BUCKET_FLAGS = {
+    0x2: "Run only if idle",
+    0x4: "Restart on idle",
+    0x8: "Stop on idle end",
+    0x10: "Disallow start if on batteries",
+    0x20: "Stop if going on batteries",
+    0x40: "Start when available",
+    0x80: "Run only if network available",
+    0x100: "Allow start on demand",
+    0x200: "Wake to run",
+    0x400: "Execute parallel",
+    0x800: "Execute stop existing",
+    0x1000: "Execute queue",
+    0x2000: "Execute ignore new",
+    0x4000: "Logon type s4u",
+    0x10000: "Logon type InteractiveToken",
+    0x40000: "Logon type Password",
+    0x80000: "Logon type InteractiveTokenOrPassword",
+    0x400000: "Enabled",
+    0x800000: "Hidden",
+    0x1000000: "Runlevel highest available",
+    0x2000000: "Task",
+    0x4000000: "Version",
+    0x8000000: "Token SID type none",
+    0x10000000: "Token SID type unrestricted",
+    0x20000000: "Interval",
+    0x40000000: "Allow hard terminate",
+}
+
+NULL = "\u0000"
+
+
+class _ScheduledTasksReader(io.BytesIO):
+
+    def read_task_scheduler_time(self) -> Optional[datetime.datetime]:
+        _ = bool(self.read_aligned_u1())  # is_localized
+        filetime = self.decode_filetime()
+        if filetime is None:
+            return None
+
+        return filetime
+
+    def read_bool(self, aligned=False) -> Optional[bool]:
+        try:
+            val = struct.unpack("?", self.read(1))[0]
+            if aligned:
+                self.seek(7)
+            return val
+        except struct.error:
+            return None
+
+    def decode_filetime(self) -> Optional[datetime.datetime]:
+        filetime = self.read_u8()
+        if filetime is None:
+            return None
+
+        if filetime == 0 or filetime == 0xFFFFFFFFFFFFFFFF:
+            return None
+        filetime = conversion.wintime_to_datetime(filetime)
+        if isinstance(filetime, datetime.datetime):
+            return filetime
+        else:
+            return None
+
+    def _read_uint(
+        self, size: int, format: str, aligned: bool = False
+    ) -> Optional[int]:
+        try:
+            val = struct.unpack(format, self.read(size))[0]
+            if aligned:
+                self.seek(8 - size, io.SEEK_CUR)
+            return val
+        except struct.error:
+            return None
+
+    def read_aligned_u1(self) -> Optional[int]:
+        return self._read_uint(1, "B", True)
+
+    def read_u2(self) -> Optional[int]:
+        return self._read_uint(2, "<H")
+
+    def read_aligned_u2(self) -> Optional[int]:
+        return self._read_uint(2, "<H", True)
+
+    def read_u4(self) -> Optional[int]:
+        return self._read_uint(4, "<I")
+
+    def read_u8(self) -> Optional[int]:
+        return self._read_uint(8, "<Q")
+
+    def read_aligned_u4(self) -> Optional[int]:
+        return self._read_uint(4, "<I", True)
+
+    def read_buffer(self, aligned=False) -> Optional[bytes]:
+        count = self.read_u4() if not aligned else self.read_aligned_u4()
+        if count is None:
+            return None
+        data = self.read(count)
+        if aligned:
+            self.seek((8 - (count % 8)) % 8, io.SEEK_CUR)
+        return data
+
+    def read_bstring(self, aligned=False) -> Optional[str]:
+        size = self.read_u4() if not aligned else self.read_aligned_u4()
+        if size is None:
+            return None
+        try:
+            raw = self.read(size)
+            val = raw.decode("utf-16le", errors="replace").rstrip(NULL) or None
+        except UnicodeDecodeError:
+            val = None
+
+        if aligned:
+            self.seek((8 - (size % 8)) % 8, io.SEEK_CUR)
+
+        return val
+
+    def read_aligned_bstring_expand_sz(self) -> Optional[str]:
+        # type: () -> Optional[str]
+        sz = self.read_aligned_u4()
+        if sz is None:
+            return None
+        byte_count = sz * 2 + 2
+
+        if sz == 0:
+            return None
+
+        try:
+            content = self.read(byte_count).decode("utf-16le")
+        except UnicodeDecodeError:
+            content = None
+
+        self.seek((8 - (byte_count % 8)) % 8, io.SEEK_CUR)
+        return content.rstrip("\x00") if content is not None else None
+
+    def read_tstimeperiod(self) -> Optional[TaskSchedulerTimePeriod]:
+        values = (
+            self.read_u2(),
+            self.read_u2(),
+            self.read_u2(),
+            self.read_u2(),
+            self.read_u2(),
+            self.read_u2(),
+            self.read_u2(),
+        )
+
+        if any(value is None for value in values):
+            return None
+
+        return TaskSchedulerTimePeriod(*values)
+
+
+def _build_guid_name_map(key: reg_extensions.CM_KEY_NODE) -> Dict[str, str]:
+    mapping = {}
+    task_id_value = None
+    for value in key.get_values():
+        try:
+            if value.get_name() == "Id":
+                task_id_value = value
+                break
+        except exceptions.InvalidAddressException:
+            continue
+
+    if (
+        task_id_value is not None
+        and task_id_value.get_type() == reg_extensions.RegValueTypes.REG_SZ
+    ):
+        try:
+            id_str = task_id_value.decode_data()
+        except exceptions.InvalidAddressException:
+            id_str = None
+
+        if isinstance(id_str, bytes):
+            mapping[id_str.decode("utf-16le", errors="replace").rstrip(NULL)] = str(
+                key.get_name()
+            )
+
+    for subkey in key.get_subkeys():
+        mapping.update(_build_guid_name_map(subkey))
+    return mapping
+
+
+@dataclasses.dataclass
+class TaskAction:
+    action_type: ActionType
+    action: str
+    action_args: Optional[str]
+    working_directory: Optional[str]
+
+    @classmethod
+    def decode_messagebox_action(
+        cls, reader: _ScheduledTasksReader
+    ) -> Optional["TaskAction"]:
+        caption, content = reader.read_bstring(), reader.read_bstring()
+        return cls(
+            ActionType.MessageBox,
+            f'"{caption or "<Unknown>"}": {content or "<Unknown>"}',
+            None,
+            None,
+        )
+
+    @classmethod
+    def _decode_exe_action(
+        cls, reader: _ScheduledTasksReader, version: int
+    ) -> Optional["TaskAction"]:
+        command = reader.read_bstring()
+        args = reader.read_bstring()
+        if command is None or args is None:
+            return None
+
+        workdir = reader.read_bstring()
+        if version == 3:
+            _flags = reader.read_u2()
+
+        return cls(ActionType.Exe, command, args, workdir)
+
+    @classmethod
+    def _decode_email_action(
+        cls, reader: _ScheduledTasksReader
+    ) -> Optional["TaskAction"]:
+        props = {
+            "From": reader.read_bstring(),
+            "To": reader.read_bstring(),
+            "Cc": reader.read_bstring(),
+            "Bcc": reader.read_bstring(),
+            "Reply_to": reader.read_bstring(),
+            "Server": reader.read_bstring(),
+            "Subject": reader.read_bstring(),
+            "Body": reader.read_bstring(),
+        }
+
+        num_attachment_filenames = reader.read_u4()
+        if num_attachment_filenames is not None:
+
+            attachment_filenames = [
+                reader.read_bstring() for _ in range(num_attachment_filenames)
+            ]
+
+            props["Attachments"] = (
+                "<"
+                + ", ".join(
+                    filename
+                    for filename in attachment_filenames
+                    if filename is not None
+                )
+                + ">"
+            )
+
+        num_headers = reader.read_u4()
+        if num_headers is not None:
+            headers = [
+                (reader.read_bstring(), reader.read_bstring())
+                for _ in range(num_headers)
+            ]
+
+            props["Headers"] = (
+                "<"
+                + ", ".join(
+                    f"{field}: {value}"
+                    for field, value in headers
+                    if field is not None and value is not None
+                )
+                + ">"
+            )
+
+        cls(
+            ActionType.Email,
+            ", ".join(
+                f"{key}: {value}" for key, value in props.items() if value is not None
+            ),
+            None,
+            None,
+        )
+
+    @classmethod
+    def _decode_comhandler_action(
+        cls, reader: _ScheduledTasksReader
+    ) -> Optional["TaskAction"]:
+        guid_raw = reader.read(16)
+        if not guid_raw and len(guid_raw) == 16:
+            return None
+        clsid = conversion.windows_bytes_to_guid(guid_raw)
+        args = reader.read_bstring()
+
+        return cls(ActionType.ComHandler, clsid, args, None)
+
+
+@dataclasses.dataclass
+class _ScheduledTaskEntry:
+    name: Union[str, interfaces.renderers.BaseAbsentValue]
+    principal_id: Union[str, interfaces.renderers.BaseAbsentValue]
+    display_name: Union[str, interfaces.renderers.BaseAbsentValue]
+    enabled: Union[bool, interfaces.renderers.BaseAbsentValue]
+    creation_time: Union[datetime.datetime, interfaces.renderers.BaseAbsentValue]
+    last_run_time: Union[datetime.datetime, interfaces.renderers.BaseAbsentValue]
+    last_successful_run_time: Union[
+        datetime.datetime, interfaces.renderers.BaseAbsentValue
+    ]
+    trigger_type: Union[str, interfaces.renderers.BaseAbsentValue]
+    trigger_description: Union[str, interfaces.renderers.BaseAbsentValue]
+    action_type: Union[str, interfaces.renderers.BaseAbsentValue]
+    action_description: Union[str, interfaces.renderers.BaseAbsentValue]
+    action_args: Union[str, interfaces.renderers.BaseAbsentValue]
+    action_context: Union[str, interfaces.renderers.BaseAbsentValue]
+    working_directory: Union[str, interfaces.renderers.BaseAbsentValue]
+    guid: str
+
+
+@dataclasses.dataclass
+class _JobSchedule:
+    start_boundary: Optional[datetime.datetime]
+    end_boundary: Optional[datetime.datetime]
+    repetition_interval_secs: Optional[int]
+    repetition_duration_secs: Optional[int]
+    execution_time_limit_secs: Optional[int]
+    mode: Optional[TimeMode]
+    data1: Optional[int]
+    data2: Optional[int]
+    data3: Optional[int]
+    stop_tasks_at_duration_end: Optional[int]
+    is_enabled: Optional[bool]
+    max_delay_seconds: Optional[int]
+
+    def get_description(self) -> Optional[str]:
+        if self.mode == TimeMode.Once:
+            return "Run one time starting at {}".format(
+                self.start_boundary.isoformat()
+                if self.start_boundary is not None
+                else "<UNKNOWN>"
+            )
+
+        elif self.mode == TimeMode.Daily:
+            if self.data1 is None:
+                return None
+            return "Run at {} and repeat every {} days".format(
+                (
+                    self.start_boundary.isoformat()
+                    if self.start_boundary is not None
+                    else "<UNKNOWN>"
+                ),
+                self.data1,
+            )
+
+        elif self.mode == TimeMode.Weekly:
+            if self.data2 is None:
+                return None
+
+            days = [k.name for k in Weekday if k.value & self.data2]
+            return "Run on {} every {} weeks starting at {}".format(
+                ", ".join(days),
+                self.data1,
+                (
+                    self.start_boundary.isoformat()
+                    if self.start_boundary is not None
+                    else "<UNKNOWN>"
+                ),
+            )
+        elif self.mode == TimeMode.DaysInMonths:
+            if self.data2 is None or self.data1 is None or self.data3 is None:
+                return None
+            months = [month.name for month in Months if month.value & self.data3]
+            days_bitmap = (self.data2 << 16) + self.data1
+            days = [str(v + 1) for v in range(31) if (1 << v) & days_bitmap]
+            return "Run in months {} on days {} starting at {}".format(
+                ", ".join(months),
+                ", ".join(days),
+                (
+                    self.start_boundary.isoformat()
+                    if self.start_boundary is not None
+                    else "<UNKNOWN>"
+                ),
+            )
+        elif self.mode == TimeMode.DaysInWeeksInMonths:
+            if self.data1 is None or self.data2 is None or self.data3 is None:
+                return None
+
+            months = [month.name for month in Months if month.value & self.data3]
+            weeks = [str(v + 1) for v in range(5) if (v << 1) & self.data2]
+            days = [day.name for day in Weekday if day.value & self.data1]
+            return "Run in months {} in weeks {} on days {} starting at {}".format(
+                ", ".join(months),
+                ", ".join(weeks),
+                ", ".join(days),
+                (
+                    self.start_boundary.isoformat()
+                    if self.start_boundary is not None
+                    else "<UNKNOWN>"
+                ),
+            )
+        else:
+            return None
+
+    @classmethod
+    def decode(cls, reader: _ScheduledTasksReader) -> Optional["_JobSchedule"]:
+        start_boundary = reader.read_task_scheduler_time()
+        end_boundary = reader.read_task_scheduler_time()
+
+        _ = reader.read_task_scheduler_time()
+        repetition_interval_secs = reader.read_u4()
+        repetition_duration_secs = reader.read_u4()
+        execution_time_limit_secs = reader.read_u4()
+        mode_index = reader.read_u4()
+        if mode_index is not None:
+            try:
+                mode = TimeMode(mode_index)
+            except ValueError:
+                mode = TimeMode.Unknown
+        else:
+            mode = None
+
+        data1 = reader.read_u2()
+        data2 = reader.read_u2()
+        data3 = reader.read_u2()
+
+        reader.seek(2, io.SEEK_CUR)  # pad
+        stop_tasks_at_duration_end = reader.read_bool()
+        is_enabled = reader.read_bool()
+        reader.seek(6, io.SEEK_CUR)  # pad (2) + unknown (4)
+        max_delay_seconds = reader.read_u4()
+        reader.seek(4, io.SEEK_CUR)  # pad
+
+        return cls(
+            start_boundary,
+            end_boundary,
+            repetition_interval_secs,
+            repetition_duration_secs,
+            execution_time_limit_secs,
+            mode,
+            data1,
+            data2,
+            data3,
+            stop_tasks_at_duration_end,
+            is_enabled,
+            max_delay_seconds,
+        )
+
+
+def decode_sid(data: bytes) -> Optional[str]:
+    """
+    Decodes a windows SID from variable-length raw bytes
+
+    Returns the string representation of the SID if decoding was successful, or None
+    if the data could not be parsed due to an insufficent number of bytes.
+    """
+    try:
+        revision, subid_count, id_authority = struct.unpack(
+            ">BBQ", data[:2] + b"\x00\x00" + data[2:8]
+        )
+        subauthorities = struct.unpack(
+            "<" + "I" * subid_count, data[8 : 8 + subid_count * 4]
+        )
+        sid_string = "S-" + "-".join(
+            [str(item) for item in [revision, id_authority] + list(subauthorities)]
+        )
+    except struct.error:
+        return None
+
+    return sid_string
+
+
+@dataclasses.dataclass
+class UserInfo:
+    sid_type: Optional[SidType]
+    sid: Optional[str]
+    username: Optional[str]
+
+    @classmethod
+    def _decode(cls, reader: _ScheduledTasksReader) -> Optional["UserInfo"]:
+        skip_user = reader.read_aligned_u1() != 0
+        if not skip_user:
+            skip_sid = reader.read_aligned_u1() != 0
+        else:
+            skip_sid = None
+
+        sid_type = None
+        sid = None
+        if not skip_user and not skip_sid:
+            try:
+                sid_type = SidType(reader.read_aligned_u4())
+            except ValueError:
+                sid_type = SidType.Unknown
+
+            sid_raw = reader.read_buffer(aligned=True)
+            if sid_raw is None:
+                return None
+            sid = decode_sid(sid_raw)
+
+        username = reader.read_bstring(aligned=True) if not skip_user else None
+
+        return UserInfo(sid_type, sid, username)
+
+
+@dataclasses.dataclass
+class OptionalSettings:
+    IdleDurationSeconds: int
+    idleWaitTimeoutSeconds: int
+    ExecutionTimeLimitSeconds: int
+    DeleteExpiredTaskAfter: int
+    Priority: int
+    RestartOnFailureDelay: int
+    RestartOnFailureRetries: int
+    NetworkId: bytes
+    Privileges: Optional[List[str]]
+    Periodicity: Optional[TaskSchedulerTimePeriod]
+    Deadline: Optional[TaskSchedulerTimePeriod]
+    Exclusive: Optional[bool]
+
+    @classmethod
+    def _decode(cls, reader: _ScheduledTasksReader) -> Optional["OptionalSettings"]:
+        LEN_WITH_PRIVILEGES = 0x38
+        LEN_WITH_TIME_PERIODS = 0x58
+        length = reader.read_aligned_u4()
+        if length == 0:
+            return None
+
+        base_values = (
+            reader.read_u4(),
+            reader.read_u4(),
+            reader.read_u4(),
+            reader.read_u4(),
+            reader.read_u4(),
+            reader.read_u4(),
+            reader.read_u4(),
+            binascii.hexlify(reader.read(16)),
+        )
+
+        if any(value is None for value in base_values):
+            return None
+
+        reader.seek(4, io.SEEK_CUR)  # padding
+
+        privileges = None
+        periodicity = None
+        deadline = None
+        exclusive = None
+        if length == LEN_WITH_PRIVILEGES or length == LEN_WITH_TIME_PERIODS:
+            privileges_raw = reader.read_u8()
+            if privileges_raw is None:
+                return None
+            privileges = [
+                priv.name for priv in Privileges if priv.value & privileges_raw
+            ]
+        if length == LEN_WITH_TIME_PERIODS:
+            periodicity = reader.read_tstimeperiod()
+            deadline = reader.read_tstimeperiod()
+            exclusive = reader.read_bool()
+            reader.seek(3, io.SEEK_CUR)  # padding
+
+        return OptionalSettings(
+            *base_values, privileges, periodicity, deadline, exclusive
+        )
+
+
+@dataclasses.dataclass
+class JobBucket:
+    flags: List[str]
+    crc32: int
+    principal_id: Optional[str]
+    display_name: Optional[str]
+    user_info: Optional[UserInfo]
+    optional_settings: Optional[OptionalSettings]
+
+    @classmethod
+    def _decode(
+        cls, reader: _ScheduledTasksReader, version: int
+    ) -> Optional["JobBucket"]:
+        flags_raw = reader.read_aligned_u4()
+        if flags_raw is None:
+            return None
+        flags = [y for x, y in JOB_BUCKET_FLAGS.items() if x & flags_raw]
+        crc32 = reader.read_aligned_u4()
+        if crc32 is None:
+            return None
+
+        principal_id = None
+        display_name = None
+        if version >= 0x16:
+            principal_id = reader.read_bstring(aligned=True)
+        if version >= 0x17:
+            display_name = reader.read_bstring(aligned=True)
+
+        user_info = UserInfo._decode(reader)
+        optional_settings = OptionalSettings._decode(reader)
+
+        return JobBucket(
+            flags, crc32, principal_id, display_name, user_info, optional_settings
+        )
+
+
+class Privileges(enum.Enum):
+    SeCreateTokenPrivilege = 0x4
+    SeAssignPrimaryTokenPrivilege = 0x8
+    SeLockMemoryPrivilege = 0x10
+    SeIncreaseQuotaPrivilege = 0x20
+    SeMachineAccountPrivilege = 0x40
+    SeTcbPrivilege = 0x80
+    SeSecurityPrivilege = 0x100
+    SeTakeOwnershipPrivilege = 0x200
+    SeLoadDriverPrivilege = 0x400
+    SeSystemProfilePrivilege = 0x800
+    SeSystemtimePrivilege = 0x1000
+    SeProfileSingleProcessPrivilege = 0x2000
+    SeIncreaseBasePriorityPrivilege = 0x4000
+    SeCreatePagefilePrivilege = 0x8000
+    SeCreatePermanentPrivilege = 0x10000
+    SeBackupPrivilege = 0x20000
+    SeRestorePrivilege = 0x40000
+    SeShutdownPrivilege = 0x80000
+    SeDebugPrivilege = 0x100000
+    SeAuditPrivilege = 0x200000
+    SeSystemEnvironmentPrivilege = 0x400000
+    SeChangeNotifyPrivilege = 0x800000
+    SeRemoteShutdownPrivilege = 0x1000000
+    SeUndockPrivilege = 0x2000000
+    SeSyncAgentPrivilege = 0x4000000
+    SeEnableDelegationPrivilege = 0x8000000
+    SeManageVolumePrivilege = 0x10000000
+    SeImpersonatePrivilege = 0x20000000
+    SeCreateGlobalPrivilege = 0x40000000
+    SeTrustedCredManAccessPrivilege = 0x80000000
+    SeRelabelPrivilege = 0x100000000
+    SeIncreaseWorkingSetPrivilege = 0x200000000
+    SeTimeZonePrivilege = 0x400000000
+    SeCreateSymbolicLinkPrivilege = 0x800000000
+    SeDelegateSessionUserImpersonatePrivilege = 0x1000000000
+
+
+class SessionState(enum.Enum):
+    ConsoleConnect = 1
+    ConsoleDisconnect = 2
+    RemoteConnect = 3
+    RemoteDisconnect = 4
+    SessionLock = 5
+    SessionUnlock = 6
+    Unknown = "Unknown"
+
+
+@dataclasses.dataclass
+class TaskTrigger:
+    start_boundary: Optional[datetime.datetime]
+    end_boundary: Optional[datetime.datetime]
+    repetition_interval_seconds: Optional[int]
+    enabled: Optional[bool]
+    trigger_type: TriggerType
+    description: Optional[str]
+
+    @classmethod
+    def _decode_generic_trigger(
+        cls, reader: _ScheduledTasksReader, version: int, trigger_type: TriggerType
+    ) -> Optional["TaskTrigger"]:
+        start_boundary = reader.read_task_scheduler_time()
+        end_boundary = reader.read_task_scheduler_time()
+
+        _ = reader.read_u4()  # delay seconds
+        _ = reader.read_u4()  # timeout seconds
+
+        repetition_interval_secs = reader.read_u4()
+        _ = reader.read_u4()  # reptition duration seconds
+        _ = reader.read_u4()  # repetition duration seconds 2
+
+        _ = reader.read_bool()  # stop at duration end
+        reader.seek(3, io.SEEK_CUR)
+        trigger_enabled = bool(reader.read_aligned_u1())
+        reader.seek(8, io.SEEK_CUR)  # unknown field
+
+        if version >= 0x16:
+            cur = reader.tell()
+            _ = reader.read_bstring()  # trigger id
+            reader.seek((8 - (reader.tell() - cur)) % 8, io.SEEK_CUR)  # pad to block
+
+        return cls(
+            start_boundary,
+            end_boundary,
+            repetition_interval_secs,
+            trigger_enabled,
+            trigger_type,
+            f"{trigger_type.name} trigger",
+        )
+
+    @classmethod
+    def _decode_logon_trigger(
+        cls, reader: _ScheduledTasksReader, version: int
+    ) -> Optional["TaskTrigger"]:
+        base = cls._decode_generic_trigger(reader, version, TriggerType.Logon)
+        if base is None:
+            return None
+
+        user = UserInfo._decode(reader)
+        if user is not None and user.username is not None:
+            base.description = f"{user.username}: {user.sid} ({user.sid_type})"
+
+        return base
+
+    @classmethod
+    def _decode_session_trigger(
+        cls, reader: _ScheduledTasksReader, version: int
+    ) -> Optional["TaskTrigger"]:
+        base = cls._decode_generic_trigger(reader, version, TriggerType.Session)
+        if base is None:
+            return None
+        session_type_raw = reader.read_u4()
+        reader.seek(4, io.SEEK_CUR)
+
+        try:
+            session_type = SessionState(session_type_raw)
+        except ValueError:
+            session_type = SessionState.Unknown
+
+        user_info = UserInfo._decode(reader)
+        if user_info is not None and user_info.username is not None:
+            base.description = f"{session_type.name} for user {user_info.username}"
+        else:
+            base.description = session_type.name
+
+        return base
+
+    @classmethod
+    def _decode_time_trigger(
+        cls, reader: _ScheduledTasksReader, version: int
+    ) -> Optional["TaskTrigger"]:
+        job_schedule = _JobSchedule.decode(reader)
+        if job_schedule is None:
+            return None
+
+        if version >= 0x16:
+            cur = reader.tell()
+            _ = reader.read_bstring()  # trigger id
+            reader.seek((8 - (reader.tell() - cur)) % 8, io.SEEK_CUR)  # pad to block
+
+        return cls(
+            job_schedule.start_boundary,
+            job_schedule.end_boundary,
+            job_schedule.repetition_interval_secs,
+            job_schedule.is_enabled,
+            TriggerType.Time,
+            job_schedule.get_description() or None,
+        )
+
+    @classmethod
+    def _decode_event_trigger(
+        cls, reader: _ScheduledTasksReader, version: int
+    ) -> Optional["TaskTrigger"]:
+        base = cls._decode_generic_trigger(reader, version, TriggerType.Event)
+        if base is None:
+            return base
+
+        subscription = reader.read_aligned_bstring_expand_sz()
+        reader.seek(8, io.SEEK_CUR)  # 2 4-byte unknown fields
+        reader.read_aligned_bstring_expand_sz()  # another unknown field
+        len_value_queries = reader.read_aligned_u4()
+
+        if len_value_queries is None:
+            return base
+
+        queries = [
+            (
+                reader.read_aligned_bstring_expand_sz(),
+                reader.read_aligned_bstring_expand_sz(),
+            )
+            for _ in range(len_value_queries)
+        ]
+        valid = [(k, v) for (k, v) in queries if k is not None and v is not None]
+        if base.description is None:
+            base.description = "Event Trigger"
+        base.description += f": Subscription: {subscription}, Queries: {str(valid)}"
+        return base
+
+    @classmethod
+    def _decode_boot_trigger(
+        cls, reader: _ScheduledTasksReader, version: int
+    ) -> Optional["TaskTrigger"]:
+        return cls._decode_generic_trigger(reader, version, TriggerType.Boot)
+
+    @classmethod
+    def _decode_wnf_trigger(
+        cls, reader: _ScheduledTasksReader, version: int
+    ) -> Optional["TaskTrigger"]:
+        base = cls._decode_generic_trigger(
+            reader, version, TriggerType.WindowsNotificationFacility
+        )
+        if base is None:
+            return None
+
+        state_name = binascii.hexlify(reader.read(8)).decode("ascii")
+        datalen = reader.read_aligned_u4()
+        _ = base64.b64encode(reader.read(datalen))  # state binary data
+        base.description = f"WNF state {state_name}"
+        return base
+
+    @classmethod
+    def _decode_idle_trigger(
+        cls, reader: _ScheduledTasksReader, version: int
+    ) -> Optional["TaskTrigger"]:
+        return cls._decode_generic_trigger(reader, version, TriggerType.Logon)
+
+    @classmethod
+    def _decode_registration_trigger(
+        cls, reader: _ScheduledTasksReader, version: int
+    ) -> Optional["TaskTrigger"]:
+        return cls._decode_generic_trigger(reader, version, TriggerType.Logon)
+
+
+@dataclasses.dataclass
+class TriggerSet:
+    job_bucket: JobBucket
+    triggers: List[TaskTrigger]
+
+    @classmethod
+    def decode(cls, data) -> Optional["TriggerSet"]:
+        reader = _ScheduledTasksReader(data)
+
+        version = reader.read_aligned_u1()
+        _ = reader.read_task_scheduler_time()  # start boundary
+        _ = reader.read_task_scheduler_time()  # end_boundary
+
+        if version is None:
+            return None
+
+        job_bucket = JobBucket._decode(reader, version)
+        if job_bucket is None:
+            return None
+
+        triggers = []
+
+        while True:
+            magic = reader.read_aligned_u4()
+            if magic is None:
+                break
+            try:
+                trigger_type = TriggerType(magic)
+            except ValueError:
+                vollog.warning(f"Invalid trigger magic {hex(magic)}")
+                break
+
+            if trigger_type == TriggerType.Logon:
+                trigger = TaskTrigger._decode_logon_trigger(reader, version)
+            elif trigger_type == TriggerType.Session:
+                trigger = TaskTrigger._decode_session_trigger(reader, version)
+            elif trigger_type == TriggerType.WindowsNotificationFacility:
+                trigger = TaskTrigger._decode_wnf_trigger(reader, version)
+            elif trigger_type == TriggerType.Boot:
+                trigger = TaskTrigger._decode_boot_trigger(reader, version)
+            elif trigger_type == TriggerType.Registration:
+                trigger = TaskTrigger._decode_registration_trigger(reader, version)
+            elif trigger_type == TriggerType.Event:
+                trigger = TaskTrigger._decode_event_trigger(reader, version)
+            elif trigger_type == TriggerType.Idle:
+                trigger = TaskTrigger._decode_idle_trigger(reader, version)
+            elif trigger_type == TriggerType.Time:
+                trigger = TaskTrigger._decode_time_trigger(reader, version)
+            else:
+                vollog.warning(
+                    f"Invalid trigger magic {hex(magic)} encountered at offset {hex(reader.tell() - 8)}, stopping parsing"
+                )
+                break
+            triggers.append(trigger)
+
+        return cls(job_bucket, triggers)
+
+
+@dataclasses.dataclass
+class ActionSet:
+    actions: List[TaskAction]
+    context: Optional[str]
+
+    @classmethod
+    def decode(cls, data: bytes) -> Optional["ActionSet"]:
+        reader = _ScheduledTasksReader(data)
+        actions = []
+
+        version = reader.read_u2()
+        if version is None:
+            return None
+
+        if version in [2, 3]:
+            action_context = reader.read_bstring()
+        else:
+            action_context = None
+
+        while True:
+            magic = reader.read_u2()
+            if magic is None:
+                break
+
+            _ = (
+                reader.read_bstring()
+            )  # action identifier, usually (but not always) empty
+
+            if magic == ActionType.Email.value:
+                action = TaskAction._decode_email_action(reader)
+            elif magic == ActionType.Exe.value:
+                action = TaskAction._decode_exe_action(reader, version)
+            elif magic == ActionType.ComHandler.value:
+                action = TaskAction._decode_comhandler_action(reader)
+            elif magic == ActionType.MessageBox.value:
+                action = TaskAction.decode_messagebox_action(reader)
+            else:
+                break
+            actions.append(action)
+
+        return cls(actions, action_context)
+
+
+@dataclasses.dataclass
+class DynamicInfo:
+    """
+    Contains information about execution history for this task,
+    including timestamps and the last error code
+    """
+
+    creation_time: Optional[datetime.datetime]
+    last_run_time: Optional[datetime.datetime]
+    last_successful_run_time: Optional[datetime.datetime]
+    last_error_code: Optional[int]
+
+    @classmethod
+    def decode(cls, data: bytes) -> Optional["DynamicInfo"]:
+        """
+        Decodes a DynamicInfo structure from RegBin value data.
+        Raises a `ScheduledTaskDecodingError` if the magic bytes are invalid, but otherwise
+        attempts to decode as much as possible without returning an error.
+        """
+        DYNAMICINFO_MAGIC = 3
+
+        reader = _ScheduledTasksReader(data)
+        magic = reader.read_u4()
+        if magic != DYNAMICINFO_MAGIC:
+            return None
+
+        creation_time = reader.decode_filetime()
+        last_run_time = reader.decode_filetime()
+
+        reader.seek(4, io.SEEK_CUR)  # deprecated field 'TaskState'
+
+        last_error_code = reader.read_u4()
+        last_success_time = reader.decode_filetime()
+
+        vollog.debug((creation_time, last_run_time, last_success_time))
+
+        return cls(
+            last_run_time,
+            creation_time,
+            last_success_time,
+            last_error_code,
+        )
+
+
+class ScheduledTasks(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
+    """Decodes scheduled task information from the Windows registry, including
+    information about triggers, actions, run times, and creation times.
+    """
+
+    _required_framework_version = (2, 11, 0)
+    _version = (1, 0, 0)
+
+    @classmethod
+    def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
+        # Since we're calling the plugin, make sure we have the plugin's requirements
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Windows kernel",
+                architectures=["Intel33", "Intel64"],
+            ),
+            requirements.PluginRequirement(
+                name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
+            ),
+        ]
+
+    def generate_timeline(
+        self,
+    ) -> Iterator[Tuple[str, timeliner.TimeLinerType, datetime.datetime]]:
+        for _, task in self._generator():
+            if isinstance(task.last_run_time, datetime.datetime):
+                yield f"ScheduledTasks: task action {task.action_description} with trigger {task.trigger_description} ran", timeliner.TimeLinerType.ACCESSED, task.last_run_time
+            if isinstance(task.last_successful_run_time, datetime.datetime):
+                yield f"ScheduledTasks: task action {task.action_description} with trigger {task.trigger_description} ran successfully", timeliner.TimeLinerType.ACCESSED, task.last_successful_run_time
+            if isinstance(task.creation_time, datetime.datetime):
+                yield f"ScheduledTasks: Creation Time for task {task.guid} with trigger {task.trigger_description or '<UNKNOWN>'}", timeliner.TimeLinerType.CREATED, task.creation_time
+
+    @classmethod
+    def get_software_hive(
+        cls,
+        context: interfaces.context.ContextInterface,
+        config_path: str,
+        kernel: interfaces.context.ModuleInterface,
+    ) -> Optional[registry.RegistryHive]:
+        """Retrieves the `Amcache.hve` registry hive from the kernel module, if it can be located."""
+        return next(
+            hivelist.HiveList.list_hives(
+                context=context,
+                base_config_path=interfaces.configuration.path_join(
+                    config_path, "hivelist"
+                ),
+                layer_name=kernel.layer_name,
+                symbol_table=kernel.symbol_table_name,
+                filter_string="SOFTWARE",
+            ),
+            None,
+        )
+
+    @classmethod
+    def parse_actions_value(
+        cls, actions_value: reg_extensions.CM_KEY_VALUE
+    ) -> Optional[ActionSet]:
+        """Parses File entries from the Windows 8 `Root\\File` key.
+
+        :param programs_key: The `Root\\File` registry key.
+
+        :return: An iterator of tuples, where the first member is the program ID string for
+        correlating `Root\\Program` entries, and the second member is the `AmcacheEntry`.
+        """
+        try:
+            data = actions_value.decode_data()
+        except exceptions.InvalidAddressException:
+            data = None
+
+        if not isinstance(data, bytes):
+            return None
+
+        return ActionSet.decode(data)
+
+    @classmethod
+    def parse_triggers_value(
+        cls, triggers_value: reg_extensions.CM_KEY_VALUE
+    ) -> Optional[TriggerSet]:
+        try:
+            data = triggers_value.decode_data()
+        except exceptions.InvalidAddressException:
+            data = None
+
+        if not isinstance(data, bytes):
+            return None
+
+        return TriggerSet.decode(data)
+
+    @classmethod
+    def parse_dynamic_info_value(
+        cls, dyn_info_value: reg_extensions.CM_KEY_VALUE
+    ) -> Optional[DynamicInfo]:
+
+        try:
+            data = dyn_info_value.decode_data()
+        except exceptions.InvalidAddressException:
+            data = None
+
+        if not isinstance(data, bytes):
+            return None
+
+        return DynamicInfo.decode(data)
+
+    @classmethod
+    def _get_task_keys(
+        cls, software_hive: reg_extensions.RegistryHive
+    ) -> Tuple[
+        Optional[reg_extensions.CM_KEY_NODE], Optional[reg_extensions.CM_KEY_NODE]
+    ]:
+        try:
+            task_key = software_hive.get_key(
+                "Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks"
+            )
+        except (KeyError, registry.RegistryFormatException):
+            task_key = None
+
+        try:
+            task_tree = software_hive.get_key(
+                "Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree"
+            )
+        except (KeyError, registry.RegistryFormatException):
+            task_tree = None
+
+        return (task_key, task_tree)  # type: ignore
+
+    @classmethod
+    def _parse_task_key(
+        cls, key: reg_extensions.CM_KEY_NODE, guid_mapping: Dict[str, str]
+    ) -> Iterator[_ScheduledTaskEntry]:
+        values = {}
+        for value in key.get_values():
+            try:
+                name = str(value.get_name())
+            except exceptions.InvalidAddressException:
+                continue
+
+            if name in ["Actions", "Triggers", "DynamicInfo"]:
+                values[name] = value
+
+        task_name = guid_mapping.get(str(key.get_name()), renderers.NotAvailableValue())
+
+        try:
+            action_set = cls.parse_actions_value(values["Actions"])
+        except KeyError:
+            vollog.debug("Failed to get Actions value")
+            action_set = None
+
+        try:
+            triggers_value = values["Triggers"]
+            trigger_set = cls.parse_triggers_value(triggers_value)
+        except KeyError:
+            vollog.debug("Failed to get Triggers value")
+            trigger_set = None
+
+        if trigger_set is not None:
+            vollog.debug("Parsed triggers successfully")
+
+            principal_id = (
+                trigger_set.job_bucket.principal_id or renderers.NotAvailableValue()
+            )
+            display_name = (
+                trigger_set.job_bucket.display_name or renderers.NotAvailableValue()
+            )
+        else:
+            vollog.debug("Failed to parse triggers")
+
+            principal_id = renderers.NotAvailableValue()
+            display_name = renderers.NotAvailableValue()
+
+        try:
+            dynamic_info = cls.parse_dynamic_info_value(values["DynamicInfo"])
+        except KeyError:
+            vollog.debug("DynamicInfo value not found")
+            dynamic_info = None
+
+        vollog.debug(dynamic_info)
+
+        creation_time = dynamic_info.creation_time if dynamic_info is not None else None
+        last_run_time = dynamic_info.last_run_time if dynamic_info is not None else None
+        last_successful_run_time = (
+            dynamic_info.last_successful_run_time if dynamic_info is not None else None
+        )
+
+        all_triggers = (
+            trigger_set.triggers or [None] if trigger_set is not None else [None]
+        )
+
+        all_actions = action_set.actions or [None] if action_set is not None else [None]
+
+        for action, trigger in itertools.product(all_actions, all_triggers):
+
+            if action is not None:
+                if action.action_type in (
+                    ActionType.Exe,
+                    ActionType.ComHandler,
+                ):
+                    if action.action_args is None:
+                        args = renderers.NotAvailableValue()
+                    else:
+                        args = action.action_args
+                else:
+                    args = renderers.NotApplicableValue()
+
+                if action.action_type == ActionType.Exe:
+                    working_directory = (
+                        action.working_directory or renderers.NotAvailableValue()
+                    )
+                else:
+                    working_directory = renderers.NotApplicableValue()
+
+            else:
+                args = renderers.NotAvailableValue()
+                working_directory = renderers.NotAvailableValue()
+
+            if trigger is not None and trigger.enabled is not None:
+                enabled = trigger.enabled
+            else:
+                enabled = renderers.NotAvailableValue()
+
+            yield _ScheduledTaskEntry(
+                task_name,
+                principal_id,
+                display_name,
+                enabled,
+                creation_time or renderers.NotAvailableValue(),
+                last_run_time or renderers.NotAvailableValue(),
+                last_successful_run_time or renderers.NotAvailableValue(),
+                (
+                    trigger.trigger_type.name
+                    if trigger is not None
+                    else renderers.NotAvailableValue()
+                ),
+                (
+                    trigger.description or renderers.NotAvailableValue()
+                    if trigger is not None
+                    else renderers.NotAvailableValue()
+                ),
+                (
+                    action.action_type.name
+                    if action is not None
+                    else renderers.NotAvailableValue()
+                ),
+                (
+                    action.action
+                    if action is not None
+                    else renderers.NotAvailableValue()
+                ),
+                args,
+                (
+                    action_set.context
+                    if action_set is not None
+                    else renderers.NotAvailableValue()
+                ),
+                working_directory,
+                str(key.get_name()),
+            )
+
+    def _generator(self) -> Iterator[Tuple[int, _ScheduledTaskEntry]]:
+        kernel = self.context.modules[self.config["kernel"]]
+
+        # Building the dictionary ahead of time is much better for performance
+        # vs looking up each service's DLL individually.
+        software_hive = self.get_software_hive(self.context, self.config_path, kernel)
+        if software_hive is None:
+            vollog.warning("Failed to get SOFTWARE hive")
+            return
+
+        task_key_root, task_tree = self._get_task_keys(software_hive)
+        if task_key_root is None:
+            vollog.warning("Failed to get 'Tasks' key")
+            return
+
+        if task_tree is not None:
+            task_name_map = _build_guid_name_map(task_tree)
+        else:
+            vollog.info("'Tree' key not found, can't map GUIDs to task names")
+            task_name_map = {}
+
+        for key in task_key_root.get_subkeys():
+            for task in self._parse_task_key(key, task_name_map):
+                yield 0, task
+
+    def run(self):
+        return renderers.TreeGrid(
+            [
+                ("Task Name", str),
+                ("Principal ID", str),
+                ("Display Name", str),
+                ("Enabled", bool),
+                ("Creation Time", datetime.datetime),
+                ("Last Run Time", datetime.datetime),
+                ("Last Successful Run Time", datetime.datetime),
+                ("Trigger Type", str),
+                ("Trigger Description", str),
+                ("Action Type", str),
+                ("Action", str),
+                ("Action Arguments", str),
+                ("Action Context", str),
+                ("Working Directory", str),
+                ("Key Name", str),
+            ],
+            (
+                (indent, dataclasses.astuple(entry))
+                for indent, entry in self._generator()
+            ),
+        )
diff --git a/volatility3/framework/plugins/windows/ssdt.py b/volatility3/framework/plugins/windows/ssdt.py
index 6a47c36e9..1fcb6cc91 100644
--- a/volatility3/framework/plugins/windows/ssdt.py
+++ b/volatility3/framework/plugins/windows/ssdt.py
@@ -30,7 +30,7 @@ class SSDT(plugins.PluginInterface):
                 architectures=["Intel32", "Intel64"],
             ),
             requirements.PluginRequirement(
-                name="modules", plugin=modules.Modules, version=(1, 0, 0)
+                name="modules", plugin=modules.Modules, version=(2, 0, 0)
             ),
         ]
 
diff --git a/volatility3/framework/plugins/windows/suspicious_threads.py b/volatility3/framework/plugins/windows/suspicious_threads.py
index 2679b191a..4bfb6baa5 100644
--- a/volatility3/framework/plugins/windows/suspicious_threads.py
+++ b/volatility3/framework/plugins/windows/suspicious_threads.py
@@ -13,11 +13,11 @@ from volatility3.plugins.windows import pslist, threads, vadinfo, thrdscan
 vollog = logging.getLogger(__name__)
 
 
-class SupsiciousThreads(interfaces.plugins.PluginInterface):
+class SuspiciousThreads(interfaces.plugins.PluginInterface):
     """Lists suspicious userland process threads"""
 
     _required_framework_version = (2, 4, 0)
-    _version = (2, 0, 0)
+    _version = (2, 0, 1)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py
index 52ed5e759..ca390561f 100644
--- a/volatility3/framework/plugins/windows/svcscan.py
+++ b/volatility3/framework/plugins/windows/svcscan.py
@@ -20,7 +20,7 @@ from volatility3.framework.renderers import format_hints
 from volatility3.framework.symbols import intermed
 from volatility3.framework.symbols.windows import versions
 from volatility3.framework.symbols.windows.extensions import services as services_types
-from volatility3.plugins.windows import poolscanner, pslist, vadyarascan
+from volatility3.plugins.windows import poolscanner, pslist
 from volatility3.plugins.windows.registry import hivelist
 
 vollog = logging.getLogger(__name__)
@@ -39,7 +39,7 @@ class SvcScan(interfaces.plugins.PluginInterface):
     """Scans for windows services."""
 
     _required_framework_version = (2, 0, 0)
-    _version = (3, 0, 0)
+    _version = (3, 0, 1)
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -60,9 +60,6 @@ class SvcScan(interfaces.plugins.PluginInterface):
             requirements.PluginRequirement(
                 name="poolscanner", plugin=poolscanner.PoolScanner, version=(1, 0, 0)
             ),
-            requirements.PluginRequirement(
-                name="vadyarascan", plugin=vadyarascan.VadYaraScan, version=(1, 0, 0)
-            ),
             requirements.PluginRequirement(
                 name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0)
             ),
@@ -317,10 +314,17 @@ class SvcScan(interfaces.plugins.PluginInterface):
 
             layer = context.layers[proc_layer_name]
 
+            # get process sections for scanning
+            sections = []
+            for vad in task.get_vad_root().traverse():
+                base = vad.get_start()
+                if vad.get_size():
+                    sections.append((base, vad.get_size()))
+
             for offset in layer.scan(
                 context=context,
                 scanner=scanners.BytesScanner(needle=service_tag),
-                sections=vadyarascan.VadYaraScan.get_vad_maps(task),
+                sections=sections,
             ):
                 if not is_vista_or_later:
                     service_record = context.object(
diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py
index 6e664e052..b812a15ff 100644
--- a/volatility3/framework/plugins/windows/thrdscan.py
+++ b/volatility3/framework/plugins/windows/thrdscan.py
@@ -22,8 +22,8 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface)
     _version = (1, 1, 0)
 
     def __init__(self, *args, **kwargs):
-        self.implementation = self.scan_threads
         super().__init__(*args, **kwargs)
+        self.implementation = self.scan_threads
 
     @classmethod
     def get_requirements(cls):
@@ -48,8 +48,7 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface)
 
         Args:
             context: The context to retrieve required elements (layers, symbol tables) from
-            layer_name: The name of the layer on which to operate
-            symbol_table: The name of the table containing the kernel symbols
+            module_name: Name of the module to use for scanning
 
         Returns:
               A list of _ETHREAD objects found by scanning memory for the "Thre" / "Thr\\xE5" pool signatures
diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py
index 39f3b7d77..98a3169a5 100644
--- a/volatility3/framework/plugins/windows/threads.py
+++ b/volatility3/framework/plugins/windows/threads.py
@@ -19,8 +19,8 @@ class Threads(thrdscan.ThrdScan):
     _version = (1, 0, 0)
 
     def __init__(self, *args, **kwargs):
-        self.implementation = self.list_process_threads
         super().__init__(*args, **kwargs)
+        self.implementation = self.list_process_threads
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -50,7 +50,6 @@ class Threads(thrdscan.ThrdScan):
 
         Args:
             proc: _EPROCESS object from which to list the VADs
-            filter_func: Function to take a virtual address descriptor value and return True if it should be filtered out
 
         Returns:
             A list of threads based on the process and filtered based on the filter function
@@ -64,22 +63,19 @@ class Threads(thrdscan.ThrdScan):
             seen.add(thread.vol.offset)
             yield thread
 
-    @classmethod
-    def filter_func(cls, config: interfaces.configuration.HierarchicalDict) -> Callable:
-        return pslist.PsList.create_pid_filter(config.get("pid", None))
-
     @classmethod
     def list_process_threads(
         cls,
         context: interfaces.context.ContextInterface,
         module_name: str,
-        filter_func: Callable,
     ) -> Iterable[interfaces.objects.ObjectInterface]:
         """Runs through all processes and lists threads for each process"""
         module = context.modules[module_name]
         layer_name = module.layer_name
         symbol_table_name = module.symbol_table_name
 
+        filter_func = pslist.PsList.create_pid_filter(context.config.get("pid", None))
+
         for proc in pslist.PsList.list_processes(
             context=context,
             layer_name=layer_name,
diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py
new file mode 100644
index 000000000..1a1e59940
--- /dev/null
+++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py
@@ -0,0 +1,208 @@
+# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+
+# Full details on the techniques used in these plugins to detect EDR-evading malware
+# can be found in our 20 page whitepaper submitted to DEFCON along with the presentation
+# https://www.volexity.com/wp-content/uploads/2024/08/Defcon24_EDR_Evasion_Detection_White-Paper_Andrew-Case.pdf
+
+import logging
+
+from typing import Dict, Tuple, List, Generator
+
+from volatility3.framework import interfaces, exceptions
+from volatility3.framework import renderers
+from volatility3.framework.configuration import requirements
+from volatility3.framework.objects import utility
+from volatility3.plugins.windows import pslist, pe_symbols
+
+vollog = logging.getLogger(__name__)
+
+
+class unhooked_system_calls(interfaces.plugins.PluginInterface):
+    """Looks for signs of Skeleton Key malware"""
+
+    _required_framework_version = (2, 4, 0)
+
+    system_calls = {
+        "ntdll.dll": {
+            pe_symbols.wanted_names_identifier: [
+                "NtCreateThread",
+                "NtProtectVirtualMemory",
+                "NtReadVirtualMemory",
+                "NtOpenProcess",
+                "NtWriteFile",
+                "NtQueryVirtualMemory",
+                "NtAllocateVirtualMemory",
+                "NtWorkerFactoryWorkerReady",
+                "NtAcceptConnectPort",
+                "NtAddDriverEntry",
+                "NtAdjustPrivilegesToken",
+                "NtAlpcCreatePort",
+                "NtClose",
+                "NtCreateFile",
+                "NtCreateMutant",
+                "NtOpenFile",
+                "NtOpenIoCompletion",
+                "NtOpenJobObject",
+                "NtOpenKey",
+                "NtOpenKeyEx",
+                "NtOpenThread",
+                "NtOpenThreadToken",
+                "NtOpenThreadTokenEx",
+                "NtWriteVirtualMemory",
+                "NtTraceEvent",
+                "NtTranslateFilePath",
+                "NtUmsThreadYield",
+                "NtUnloadDriver",
+                "NtUnloadKey",
+                "NtUnloadKey2",
+                "NtUnloadKeyEx",
+                "NtCreateKey",
+                "NtCreateSection",
+                "NtDeleteKey",
+                "NtDeleteValueKey",
+                "NtDuplicateObject",
+                "NtQueryValueKey",
+                "NtReplaceKey",
+                "NtRequestWaitReplyPort",
+                "NtRestoreKey",
+                "NtSetContextThread",
+                "NtSetSecurityObject",
+                "NtSetValueKey",
+                "NtSystemDebugControl",
+                "NtTerminateProcess",
+            ]
+        }
+    }
+
+    # This data structure is used to track unique implementations of functions across processes
+    # The outer dictionary holds the module name (e.g., ntdll.dll)
+    # The next dictionary holds the function names (NtTerminateProcess, NtSetValueKey, etc.) inside a module
+    # The innermost dictionary holds the unique implementation (bytes) of a function across processes
+    # Each implementation is tracked along with the process(es) that host it
+    # For systems without malware, all functions should have the same implementation
+    # When API hooking/module unhooking is done, the victim (infected) processes will have unique implementations
+    _code_bytes_type = Dict[str, Dict[str, Dict[bytes, List[Tuple[int, str]]]]]
+
+    @classmethod
+    def get_requirements(cls) -> List:
+        # Since we're calling the plugin, make sure we have the plugin's requirements
+        return [
+            requirements.ModuleRequirement(
+                name="kernel",
+                description="Windows kernel",
+                architectures=["Intel32", "Intel64"],
+            ),
+            requirements.VersionRequirement(
+                name="pslist", component=pslist.PsList, version=(2, 0, 0)
+            ),
+            requirements.PluginRequirement(
+                name="pe_symbols", plugin=pe_symbols.PESymbols, version=(1, 0, 0)
+            ),
+        ]
+
+    def _gather_code_bytes(
+        self,
+        kernel: interfaces.context.ModuleInterface,
+        found_symbols: pe_symbols.found_symbols_type,
+    ) -> _code_bytes_type:
+        """
+        Enumerates the desired DLLs and function implementations in each process
+        Groups based on unique implementations of each DLLs' functions
+        The purpose is to detect when a function has different implementations (code)
+        in different processes.
+        This very effectively detects code injection.
+        """
+        code_bytes: unhooked_system_calls._code_bytes_type = {}
+
+        procs = pslist.PsList.list_processes(
+            context=self.context,
+            layer_name=kernel.layer_name,
+            symbol_table=kernel.symbol_table_name,
+        )
+
+        for proc in procs:
+            try:
+                proc_id = proc.UniqueProcessId
+                proc_name = utility.array_to_string(proc.ImageFileName)
+                proc_layer_name = proc.add_process_layer()
+            except exceptions.InvalidAddressException:
+                continue
+
+            for dll_name, functions in found_symbols.items():
+                for func_name, func_addr in functions:
+                    try:
+                        fbytes = self.context.layers[proc_layer_name].read(
+                            func_addr, 0x20
+                        )
+                    except exceptions.InvalidAddressException:
+                        continue
+
+                    # see the definition of _code_bytes_type for details of this data structure
+                    if dll_name not in code_bytes:
+                        code_bytes[dll_name] = {}
+
+                    if func_name not in code_bytes[dll_name]:
+                        code_bytes[dll_name][func_name] = {}
+
+                    if fbytes not in code_bytes[dll_name][func_name]:
+                        code_bytes[dll_name][func_name][fbytes] = []
+
+                    code_bytes[dll_name][func_name][fbytes].append((proc_id, proc_name))
+
+        return code_bytes
+
+    def _generator(self) -> Generator[Tuple[int, Tuple[str, str, int]], None, None]:
+        kernel = self.context.modules[self.config["kernel"]]
+
+        found_symbols = pe_symbols.PESymbols.addresses_for_process_symbols(
+            self.context,
+            self.config_path,
+            kernel.layer_name,
+            kernel.symbol_table_name,
+            unhooked_system_calls.system_calls,
+        )
+
+        # code_bytes[dll_name][func_name][func_bytes]
+        code_bytes = self._gather_code_bytes(kernel, found_symbols)
+
+        # walk the functions that were evaluated
+        for functions in code_bytes.values():
+            # cbb is the distinct groups of bytes (instructions)
+            # for this function across processes
+            for func_name, cbb in functions.items():
+                # the dict key here is the raw instructions, which is not helpful to look at
+                # the values are the list of tuples for the (proc_id, proc_name) pairs for this set of bytes (instructions)
+                cb = list(cbb.values())
+
+                # if all processes map to the same implementation, then no malware is present
+                if len(cb) == 1:
+                    yield 0, (func_name, "", len(cb[0]))
+                else:
+                    # if there are differing implementations then it means
+                    # that malware has overwritten system call(s) in infected processes
+                    # max_idx and small_idx find which implementation of a system call has the least processes
+                    # as all observed malware and open source projects only infected a few targets, leaving the
+                    # rest with the original EDR hooks in place
+                    max_idx = 0 if len(cb[0]) > len(cb[1]) else 1
+                    small_idx = (~max_idx) & 1
+
+                    ps = []
+
+                    # gather processes on small_idx since these are the malware infected ones
+                    for pid, pname in cb[small_idx]:
+                        ps.append("{:d}:{}".format(pid, pname))
+
+                    proc_names = ", ".join(ps)
+
+                    yield 0, (func_name, proc_names, len(cb[max_idx]))
+
+    def run(self) -> renderers.TreeGrid:
+        return renderers.TreeGrid(
+            [
+                ("Function", str),
+                ("Distinct Implementations", str),
+                ("Total Implementations", int),
+            ],
+            self._generator(),
+        )
diff --git a/volatility3/framework/plugins/windows/unloadedmodules.py b/volatility3/framework/plugins/windows/unloadedmodules.py
index 0d88e96ff..01e575818 100644
--- a/volatility3/framework/plugins/windows/unloadedmodules.py
+++ b/volatility3/framework/plugins/windows/unloadedmodules.py
@@ -7,7 +7,7 @@ import datetime
 from typing import List, Iterable
 
 from volatility3.framework import constants
-from volatility3.framework import interfaces, symbols
+from volatility3.framework import interfaces, symbols, exceptions
 from volatility3.framework import renderers
 from volatility3.framework.configuration import requirements
 from volatility3.framework.interfaces import configuration
@@ -132,10 +132,15 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt
             kernel.symbol_table_name,
             unloadedmodule_table_name,
         ):
+            try:
+                name = mod.Name.String
+            except exceptions.InvalidAddressException:
+                name = renderers.UnreadableValue()
+
             yield (
                 0,
                 (
-                    mod.Name.String,
+                    name,
                     format_hints.Hex(mod.StartAddress),
                     format_hints.Hex(mod.EndAddress),
                     conversion.wintime_to_datetime(mod.CurrentTime),
diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py
index abc6142fe..2c6ed4daf 100644
--- a/volatility3/framework/plugins/windows/vadinfo.py
+++ b/volatility3/framework/plugins/windows/vadinfo.py
@@ -3,7 +3,7 @@
 #
 
 import logging
-from typing import Callable, List, Generator, Iterable, Type, Optional
+from typing import Callable, List, Generator, Iterable, Type, Optional, Tuple
 
 from volatility3.framework import renderers, interfaces, exceptions
 from volatility3.framework.configuration import requirements
@@ -196,11 +196,31 @@ class VadInfo(interfaces.plugins.PluginInterface):
 
         return file_handle
 
-    def _generator(self, procs):
+    def _generator(self, procs: List[interfaces.objects.ObjectInterface]) -> Generator[
+        Tuple[
+            int,
+            Tuple[
+                int,
+                str,
+                format_hints.Hex,
+                format_hints.Hex,
+                format_hints.Hex,
+                str,
+                str,
+                int,
+                int,
+                format_hints.Hex,
+                str,
+                str,
+            ],
+        ],
+        None,
+        None,
+    ]:
         kernel = self.context.modules[self.config["kernel"]]
         kernel_layer = self.context.layers[kernel.layer_name]
 
-        def passthrough(_: interfaces.objects.ObjectInterface) -> bool:
+        def passthrough(x: interfaces.objects.ObjectInterface) -> bool:
             return False
 
         filter_func = passthrough
@@ -250,7 +270,7 @@ class VadInfo(interfaces.plugins.PluginInterface):
                     ),
                 )
 
-    def run(self):
+    def run(self) -> renderers.TreeGrid:
         kernel = self.context.modules[self.config["kernel"]]
 
         filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None))
diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py
index dc318dd93..2e9cc44ea 100644
--- a/volatility3/framework/plugins/windows/vadyarascan.py
+++ b/volatility3/framework/plugins/windows/vadyarascan.py
@@ -18,7 +18,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
     """Scans all the Virtual Address Descriptor memory maps using yara."""
 
     _required_framework_version = (2, 4, 0)
-    _version = (1, 1, 0)
+    _version = (1, 1, 1)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -32,8 +32,11 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
             requirements.PluginRequirement(
                 name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
             ),
+            requirements.VersionRequirement(
+                name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0)
+            ),
             requirements.PluginRequirement(
-                name="yarascan", plugin=yarascan.YaraScan, version=(1, 3, 0)
+                name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0)
             ),
             requirements.ListRequirement(
                 name="pid",
@@ -66,33 +69,40 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
         ):
             layer_name = task.add_process_layer()
             layer = self.context.layers[layer_name]
+
+            max_vad_size = 0
+            vad_maps_to_scan = []
+
             for start, size in self.get_vad_maps(task):
                 if size > sanity_check:
-                    vollog.warn(
+                    vollog.debug(
                         f"VAD at 0x{start:x} over sanity-check size, not scanning"
                     )
                     continue
+                max_vad_size = max(max_vad_size, size)
+                vad_maps_to_scan.append((start, size))
 
-                for match in rules.match(data=layer.read(start, size, True)):
-                    if yarascan.YaraScan.yara_returns_instances():
-                        for match_string in match.strings:
-                            for instance in match_string.instances:
-                                yield 0, (
-                                    format_hints.Hex(instance.offset + start),
-                                    task.UniqueProcessId,
-                                    match.rule,
-                                    match_string.identifier,
-                                    instance.matched_data,
-                                )
-                    else:
-                        for offset, name, value in match.strings:
-                            yield 0, (
-                                format_hints.Hex(offset + start),
-                                task.UniqueProcessId,
-                                match.rule,
-                                name,
-                                value,
-                            )
+            if not vad_maps_to_scan:
+                vollog.warning(
+                    f"No VADs were found for task {task.UniqueProcessID}, not scanning"
+                )
+                continue
+
+            scanner = yarascan.YaraScanner(rules=rules)
+            scanner.chunk_size = max_vad_size
+
+            # scan the VAD data (in one contiguous block) with the yarascanner
+            for start, size in vad_maps_to_scan:
+                for offset, rule_name, name, value in scanner(
+                    layer.read(start, size, pad=True), start
+                ):
+                    yield 0, (
+                        format_hints.Hex(offset),
+                        task.UniqueProcessId,
+                        rule_name,
+                        name,
+                        value,
+                    )
 
     @staticmethod
     def get_vad_maps(
diff --git a/volatility3/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py
index 1c6615804..4a06ed0c9 100644
--- a/volatility3/framework/plugins/windows/verinfo.py
+++ b/volatility3/framework/plugins/windows/verinfo.py
@@ -13,7 +13,7 @@ from volatility3.framework.layers import scanners
 from volatility3.framework.renderers import format_hints
 from volatility3.framework.symbols import intermed
 from volatility3.framework.symbols.windows.extensions import pe
-from volatility3.plugins.windows import pslist, modules, dlllist
+from volatility3.plugins.windows import pslist, modules
 
 vollog = logging.getLogger(__name__)
 
@@ -46,10 +46,7 @@ class VerInfo(interfaces.plugins.PluginInterface):
                 name="pslist", plugin=pslist.PsList, version=(2, 0, 0)
             ),
             requirements.PluginRequirement(
-                name="modules", plugin=modules.Modules, version=(1, 0, 0)
-            ),
-            requirements.VersionRequirement(
-                name="dlllist", component=dlllist.DllList, version=(2, 0, 0)
+                name="modules", plugin=modules.Modules, version=(2, 0, 0)
             ),
             requirements.BooleanRequirement(
                 name="extensive",
diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py
index 496ec1844..310bbd072 100644
--- a/volatility3/framework/plugins/yarascan.py
+++ b/volatility3/framework/plugins/yarascan.py
@@ -13,20 +13,31 @@ from volatility3.framework.renderers import format_hints
 
 vollog = logging.getLogger(__name__)
 
-try:
-    import yara
+USE_YARA_X = False
+
+try:
+    import yara_x
+
+    USE_YARA_X = True
 
-    if tuple([int(x) for x in yara.__version__.split(".")]) < (3, 8):
-        raise ImportError
 except ImportError:
-    vollog.info(
-        "Python Yara (>3.8.0) module not found, plugin (and dependent plugins) not available"
-    )
-    raise
+    try:
+        import yara
+
+        if tuple(int(x) for x in yara.__version__.split(".")) < (3, 8):
+            raise ImportError
+
+        vollog.debug("Using yara-python module")
+
+    except ImportError:
+        vollog.info(
+            "Neither yara-x nor yara-python (>3.8.0) module not found, plugin (and dependent plugins) not available"
+        )
+        raise
 
 
 class YaraScanner(interfaces.layers.ScannerInterface):
-    _version = (2, 0, 0)
+    _version = (2, 1, 0)
 
     # yara.Rules isn't exposed, so we can't type this properly
     def __init__(self, rules) -> None:
@@ -34,37 +45,69 @@ class YaraScanner(interfaces.layers.ScannerInterface):
         if rules is None:
             raise ValueError("No rules provided to YaraScanner")
         self._rules = rules
-        self.st_object = not tuple([int(x) for x in yara.__version__.split(".")]) < (
-            4,
-            3,
+        self.st_object = (
+            None
+            if USE_YARA_X
+            else not tuple(int(x) for x in yara.__version__.split(".")) < (4, 3)
         )
 
     def __call__(
         self, data: bytes, data_offset: int
     ) -> Iterable[Tuple[int, str, str, bytes]]:
-        for match in self._rules.match(data=data):
-            if YaraScan.yara_returns_instances():
-                for match_string in match.strings:
-                    for instance in match_string.instances:
+        if USE_YARA_X:
+            for match in self._rules.scan(data).matching_rules:
+                for match_string in match.patterns:
+                    for instance in match_string.matches:
                         yield (
                             instance.offset + data_offset,
-                            match.rule,
+                            f"{match.namespace}.{match.identifier}",
                             match_string.identifier,
-                            instance.matched_data,
+                            data[instance.offset : instance.offset + instance.length],
                         )
-            else:
-                for offset, name, value in match.strings:
-                    yield (offset + data_offset, match.rule, name, value)
+        else:
+            for match in self._rules.match(data=data):
+                if YaraScan.yara_returns_instances():
+                    for match_string in match.strings:
+                        for instance in match_string.instances:
+                            yield (
+                                instance.offset + data_offset,
+                                match.rule,
+                                match_string.identifier,
+                                instance.matched_data,
+                            )
+                else:
+                    for offset, name, value in match.strings:
+                        yield (offset + data_offset, match.rule, name, value)
+
+    @staticmethod
+    def get_rule(rule):
+        if USE_YARA_X:
+            return yara_x.compile(f"rule r1 {{strings: $a = {rule} condition: $a}}")
+        return yara.compile(
+            sources={"n": f"rule r1 {{strings: $a = {rule} condition: $a}}"}
+        )
+
+    @staticmethod
+    def from_compiled_file(filepath):
+        with resources.ResourceAccessor().open(filepath, "rb") as fp:
+            if USE_YARA_X:
+                return yara_x.Rules.deserialize_from(file=fp)
+            return yara.load(file=fp)
+
+    @staticmethod
+    def from_file(filepath):
+        with resources.ResourceAccessor().open(filepath, "rb") as fp:
+            if USE_YARA_X:
+                return yara_x.compile(fp.read().decode())
+            return yara.compile(file=fp)
 
 
 class YaraScan(plugins.PluginInterface):
     """Scans kernel memory using yara rules (string or file)."""
 
     _required_framework_version = (2, 0, 0)
-    _version = (1, 3, 0)
-
-    # TODO: When the major version is bumped, take the opportunity to rename the yara_rules config to yara_string
-    # or something that makes more sense
+    _version = (2, 0, 0)
+    _yara_x = USE_YARA_X
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -99,10 +142,14 @@ class YaraScan(plugins.PluginInterface):
                 optional=True,
             ),
             requirements.StringRequirement(
-                name="yara_rules", description="Yara rules (as a string)", optional=True
+                name="yara_string",
+                description="Yara rules (as a string)",
+                optional=True,
             ),
             requirements.URIRequirement(
-                name="yara_file", description="Yara rules (as a file)", optional=True
+                name="yara_file",
+                description="Yara rules (as a file)",
+                optional=True,
             ),
             # This additional requirement is to follow suit with upstream, who feel that compiled rules could potentially be used to execute malicious code
             # As such, there's a separate option to run compiled files, as happened with yara-3.9 and later
@@ -121,38 +168,28 @@ class YaraScan(plugins.PluginInterface):
 
     @classmethod
     def yara_returns_instances(cls) -> bool:
-        st_object = not tuple([int(x) for x in yara.__version__.split(".")]) < (
-            4,
-            3,
-        )
-        return st_object
+        return not tuple(int(x) for x in yara.__version__.split(".")) < (4, 3)
 
     @classmethod
     def process_yara_options(cls, config: Dict[str, Any]):
         rules = None
-        if config.get("yara_rules", None) is not None:
-            rule = config["yara_rules"]
+        if config.get("yara_string") is not None:
+            rule = config["yara_string"]
             if rule[0] not in ["{", "/"]:
                 rule = f'"{rule}"'
             if config.get("case", False):
                 rule += " nocase"
             if config.get("wide", False):
                 rule += " wide ascii"
-            rules = yara.compile(
-                sources={"n": f"rule r1 {{strings: $a = {rule} condition: $a}}"}
-            )
-        elif config.get("yara_source", None) is not None:
-            rules = yara.compile(source=config["yara_source"])
-        elif config.get("yara_file", None) is not None:
-            rules = yara.compile(
-                file=resources.ResourceAccessor().open(config["yara_file"], "rb")
-            )
-        elif config.get("yara_compiled_file", None) is not None:
-            rules = yara.load(
-                file=resources.ResourceAccessor().open(
-                    config["yara_compiled_file"], "rb"
-                )
+            rules = YaraScanner.get_rule(rule)
+        elif config.get("yara_file") is not None:
+            vollog.debug(f"Plain file: {config['yara_file']} - yara-x: {USE_YARA_X}")
+            rules = YaraScanner.from_file(config["yara_file"])
+        elif config.get("yara_compiled_file") is not None:
+            vollog.debug(
+                f"Compiled file: {config['yara_compiled_file']} - yara-x: {USE_YARA_X}"
             )
+            rules = YaraScanner.from_compiled_file(config["yara_compiled_file"])
         else:
             vollog.error("No yara rules, nor yara rules file were specified")
         return rules
diff --git a/volatility3/framework/renderers/conversion.py b/volatility3/framework/renderers/conversion.py
index 864794860..e48684b31 100644
--- a/volatility3/framework/renderers/conversion.py
+++ b/volatility3/framework/renderers/conversion.py
@@ -11,6 +11,7 @@ from typing import Union
 from volatility3.framework import interfaces, renderers
 
 
+# FIXME: Move wintime_to_datetime() and unixtime_to_datetime() out of renderers, possibly framework.objects.utility
 def wintime_to_datetime(
     wintime: int,
 ) -> Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]:
@@ -27,6 +28,27 @@ def wintime_to_datetime(
         return renderers.UnparsableValue()
 
 
+def windows_bytes_to_guid(buf: bytes) -> str:
+    """
+    Converts 16 raw bytes to a windows GUID.
+
+    Raises ValueError if the provided buffer is not exactly 16 bytes.
+    """
+    if len(buf) != 16:
+        raise ValueError("Expected 16 bytes for GUID")
+
+    head_components = [format(v, "x") for v in struct.unpack("<IHH", buf[:8])]
+    tail_component = [
+        format(v, "x")
+        for v in struct.unpack(
+            ">HQ",
+            buf[8:10] + b"\x00\x00" + buf[10:16],
+        )
+    ]
+    combined = head_components + tail_component
+    return "{" + "-".join(combined) + "}"
+
+
 def unixtime_to_datetime(
     unixtime: int,
 ) -> Union[interfaces.renderers.BaseAbsentValue, datetime.datetime]:
diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py
index 03353135d..3289775b6 100644
--- a/volatility3/framework/symbols/linux/__init__.py
+++ b/volatility3/framework/symbols/linux/__init__.py
@@ -1,6 +1,9 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
+import math
+import contextlib
+from abc import ABC, abstractmethod
 from typing import Iterator, List, Tuple, Optional, Union
 
 from volatility3 import framework
@@ -19,6 +22,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable):
         # Set-up Linux specific types
         self.set_type_class("file", extensions.struct_file)
         self.set_type_class("list_head", extensions.list_head)
+        self.set_type_class("hlist_head", extensions.hlist_head)
         self.set_type_class("mm_struct", extensions.mm_struct)
         self.set_type_class("super_block", extensions.super_block)
         self.set_type_class("task_struct", extensions.task_struct)
@@ -30,9 +34,13 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable):
         self.set_type_class("kobject", extensions.kobject)
         self.set_type_class("cred", extensions.cred)
         self.set_type_class("inode", extensions.inode)
+        self.set_type_class("idr", extensions.IDR)
+        self.set_type_class("address_space", extensions.address_space)
+        self.set_type_class("page", extensions.page)
         # Might not exist in the current symbols
         self.optional_set_type_class("module", extensions.module)
         self.optional_set_type_class("bpf_prog", extensions.bpf_prog)
+        self.optional_set_type_class("bpf_prog_aux", extensions.bpf_prog_aux)
         self.optional_set_type_class("kernel_cap_struct", extensions.kernel_cap_struct)
         self.optional_set_type_class("kernel_cap_t", extensions.kernel_cap_t)
 
@@ -46,6 +54,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable):
         # Might not exist in older kernels or the current symbols
         self.optional_set_type_class("mount", extensions.mount)
         self.optional_set_type_class("mnt_namespace", extensions.mnt_namespace)
+        self.optional_set_type_class("rb_root", extensions.rb_root)
 
         # Network
         self.set_type_class("net", extensions.net)
@@ -67,7 +76,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable):
 class LinuxUtilities(interfaces.configuration.VersionableInterface):
     """Class with multiple useful linux functions."""
 
-    _version = (2, 1, 0)
+    _version = (2, 1, 1)
     _required_framework_version = (2, 0, 0)
 
     framework.require_interface_version(*_required_framework_version)
@@ -162,13 +171,30 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
         Returns:
             str: Sock pipe pathname relative to the task's root directory.
         """
+        # FIXME: This function must be moved to the 'dentry' object extension
+        # Also, the scope of this function went beyond the sock pipe path, so we need to rename this.
+        # Once https://github.com/volatilityfoundation/volatility3/pull/1263 is merged, replace the
+        # dentry inode getters
+
+        if not (filp and filp.is_readable()):
+            return f"<invalid file pointer> {filp:x}"
+
         dentry = filp.get_dentry()
+        if not (dentry and dentry.is_readable()):
+            return f"<invalid dentry pointer> {dentry:x}"
 
         kernel_module = cls.get_module_from_volobj_type(context, dentry)
 
         sym_addr = dentry.d_op.d_dname
+        if not (sym_addr and sym_addr.is_readable()):
+            return f"<invalid d_dname pointer> {sym_addr:x}"
+
         symbs = list(kernel_module.get_symbols_by_absolute_location(sym_addr))
 
+        inode = dentry.d_inode
+        if not (inode and inode.is_readable() and inode.is_valid()):
+            return f"<invalid dentry inode> {inode:x}"
+
         if len(symbs) == 1:
             sym = symbs[0].split(constants.BANG)[1]
 
@@ -182,17 +208,50 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
                 pre_name = "pipe"
 
             elif sym == "simple_dname":
-                pre_name = cls._get_path_file(task, filp)
+                name = dentry.d_name.name
+                if name:
+                    pre_name = name.dereference().cast(
+                        "string", max_length=255, errors="replace"
+                    )
+                    return "/" + pre_name + " (deleted)"
+                else:
+                    pre_name = ""
 
+            elif sym == "ns_dname":
+                # From Kernels 3.19
+
+                # In Kernels >= 6.9, see Linux kernel commit 1fa08aece42512be072351f482096d5796edf7ca
+                # ns_common->stashed change from 'atomic64_t' to 'dentry*'
+                try:
+                    ns_common_type = kernel_module.get_type("ns_common")
+                    stashed_template = ns_common_type.child_template("stashed")
+                    stashed_type_full_name = stashed_template.vol.type_name
+                    stashed_type_name = stashed_type_full_name.split(constants.BANG)[1]
+                    if stashed_type_name == "atomic64_t":
+                        # 3.19 <= Kernels < 6.9
+                        fsdata_ptr = dentry.d_fsdata
+                        if not (fsdata_ptr and fsdata_ptr.is_readable()):
+                            raise IndexError
+
+                        ns_ops = fsdata_ptr.dereference().cast("proc_ns_operations")
+                    else:
+                        # Kernels >= 6.9
+                        private_ptr = inode.i_private
+                        if not (private_ptr and private_ptr.is_readable()):
+                            raise IndexError
+
+                        ns_common = private_ptr.dereference().cast("ns_common")
+                        ns_ops = ns_common.ops
+
+                    pre_name = utility.pointer_to_string(ns_ops.name, 255)
+                except IndexError:
+                    pre_name = "<unsupported ns_dname implementation>"
             else:
-                pre_name = f"<unsupported d_op symbol: {sym}>"
-
-            ret = f"{pre_name}:[{dentry.d_inode.i_ino:d}]"
-
+                pre_name = f"<unsupported d_op symbol> {sym}"
         else:
-            ret = f"<invalid d_dname pointer> {sym_addr:x}"
+            pre_name = f"<unknown d_dname pointer> {sym_addr:x}"
 
-        return ret
+        return f"{pre_name}:[{inode.i_ino:d}]"
 
     @classmethod
     def path_for_file(cls, context, task, filp) -> str:
@@ -249,7 +308,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
         task: interfaces.objects.ObjectInterface,
     ):
         # task.files can be null
-        if not task.files:
+        if not (task.files and task.files.is_readable()):
             return None
 
         fd_table = task.files.get_fds()
@@ -269,7 +328,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
         )
 
         for fd_num, filp in enumerate(fds):
-            if filp != 0:
+            if filp and filp.is_readable():
                 full_path = LinuxUtilities.path_for_file(context, task, filp)
 
                 yield fd_num, filp, full_path
@@ -412,9 +471,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
         Returns:
             A kernel object (vmlinux)
         """
-        symbol_table_arr = volobj.vol.type_name.split("!", 1)
-        symbol_table = symbol_table_arr[0] if len(symbol_table_arr) == 2 else None
-
+        symbol_table = volobj.get_symbol_table_name()
         module_names = context.modules.get_modules_by_symbol_tables(symbol_table)
         module_names = list(module_names)
 
@@ -425,3 +482,353 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
         kernel = context.modules[kernel_module_name]
 
         return kernel
+
+
+class IDStorage(ABC):
+    """Abstraction to support both XArray and RadixTree"""
+
+    # Dynamic values, these will be initialized later
+    CHUNK_SHIFT = None
+    CHUNK_SIZE = None
+    CHUNK_MASK = None
+
+    def __init__(
+        self,
+        context: interfaces.context.ContextInterface,
+        kernel_module_name: str,
+    ):
+        self.vmlinux = context.modules[kernel_module_name]
+        self.vmlinux_layer = self.vmlinux.context.layers[self.vmlinux.layer_name]
+
+        self.pointer_size = self.vmlinux.get_type("pointer").size
+        # Dynamically work out the (XA_CHUNK|RADIX_TREE_MAP)_SHIFT values based on
+        # the node.slots[] array size
+        node_type = self.vmlinux.get_type(self.node_type_name)
+        slots_array_size = node_type.child_template("slots").count
+
+        # Calculate the LSB index - 1
+        self.CHUNK_SHIFT = slots_array_size.bit_length() - 1
+        self.CHUNK_SIZE = 1 << self.CHUNK_SHIFT
+        self.CHUNK_MASK = self.CHUNK_SIZE - 1
+
+    @classmethod
+    def choose_id_storage(
+        cls,
+        context: interfaces.context.ContextInterface,
+        kernel_module_name: str,
+    ) -> "IDStorage":
+        """Returns the appropriate ID storage data structure instance for the current kernel implementation.
+        This is used by the IDR and the PageCache to choose between the XArray and RadixTree.
+
+        Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
+            kernel_module_name: The name of the kernel module on which to operate
+
+        Returns:
+            The appropriate ID storage instance for the current kernel
+        """
+        vmlinux = context.modules[kernel_module_name]
+        address_space_type = vmlinux.get_type("address_space")
+        address_space_has_i_pages = address_space_type.has_member("i_pages")
+        i_pages_type_name = (
+            address_space_type.child_template("i_pages").vol.type_name
+            if address_space_has_i_pages
+            else ""
+        )
+        i_pages_is_xarray = i_pages_type_name.endswith(constants.BANG + "xarray")
+        i_pages_is_radix_tree_root = i_pages_type_name.endswith(
+            constants.BANG + "radix_tree_root"
+        ) and vmlinux.get_type("radix_tree_root").has_member("xa_head")
+
+        if i_pages_is_xarray or i_pages_is_radix_tree_root:
+            return XArray(context, kernel_module_name)
+        else:
+            return RadixTree(context, kernel_module_name)
+
+    @property
+    @abstractmethod
+    def node_type_name(self) -> str:
+        """Returns the Tree implementation node type name
+
+        Returns:
+            A string with the node type name
+        """
+        raise NotImplementedError()
+
+    @property
+    def tag_internal_value(self) -> int:
+        """Returns the internal node flag for the tree"""
+        raise NotImplementedError()
+
+    @abstractmethod
+    def node_is_internal(self, nodep) -> bool:
+        """Checks if the node is internal"""
+        raise NotImplementedError
+
+    @abstractmethod
+    def is_node_tagged(self, nodep) -> bool:
+        """Checks if the node pointer is tagged"""
+        raise NotImplementedError
+
+    @abstractmethod
+    def untag_node(self, nodep) -> int:
+        """Untags a node pointer"""
+        raise NotImplementedError
+
+    @abstractmethod
+    def get_tree_height(self, treep) -> int:
+        """Returns the tree height"""
+        raise NotImplementedError
+
+    @abstractmethod
+    def get_node_height(self, nodep) -> int:
+        """Returns the node height"""
+        raise NotImplementedError
+
+    @abstractmethod
+    def get_head_node(self, tree) -> int:
+        """Returns a pointer to the tree's head"""
+        raise NotImplementedError
+
+    @abstractmethod
+    def is_valid_node(self, nodep) -> bool:
+        """Validates a node pointer"""
+        raise NotImplementedError
+
+    def nodep_to_node(self, nodep) -> interfaces.objects.ObjectInterface:
+        """Instanciates a tree node from its pointer
+
+        Args:
+            nodep: Pointer to the XArray/RadixTree node
+
+        Returns:
+            A XArray/RadixTree node instance
+        """
+        node = self.vmlinux.object(self.node_type_name, offset=nodep, absolute=True)
+        return node
+
+    def _slot_to_nodep(self, slot) -> int:
+        if self.node_is_internal(slot):
+            nodep = slot & ~self.tag_internal_value
+        else:
+            nodep = slot
+
+        return nodep
+
+    def _iter_node(self, nodep, height) -> Iterator[int]:
+        node = self.nodep_to_node(nodep)
+        node_slots = node.slots
+        for off in range(self.CHUNK_SIZE):
+            slot = node_slots[off]
+            if slot == 0:
+                continue
+
+            nodep = self._slot_to_nodep(slot)
+
+            if height == 1:
+                if self.is_valid_node(nodep):
+                    yield nodep
+            else:
+                for child_node in self._iter_node(nodep, height - 1):
+                    yield child_node
+
+    def get_entries(self, root: interfaces.objects.ObjectInterface) -> Iterator[int]:
+        """Walks the tree data structure
+
+        Args:
+            root: The tree root object
+
+        Yields:
+            A tree node pointer
+        """
+        height = self.get_tree_height(root.vol.offset)
+
+        nodep = self.get_head_node(root)
+        if not nodep:
+            return
+
+        # Keep the internal flag before untagging it
+        is_internal = self.node_is_internal(nodep)
+        if self.is_node_tagged(nodep):
+            nodep = self.untag_node(nodep)
+
+        if is_internal:
+            height = self.get_node_height(nodep)
+
+        if height == 0:
+            if self.is_valid_node(nodep):
+                yield nodep
+        else:
+            for child_node in self._iter_node(nodep, height):
+                yield child_node
+
+
+class XArray(IDStorage):
+    XARRAY_TAG_MASK = 3
+    XARRAY_TAG_INTERNAL = 2
+
+    def get_tree_height(self, treep) -> int:
+        return 0
+
+    @property
+    def node_type_name(self) -> str:
+        return "xa_node"
+
+    @property
+    def tag_internal_value(self) -> int:
+        return self.XARRAY_TAG_INTERNAL
+
+    def get_node_height(self, nodep) -> int:
+        node = self.nodep_to_node(nodep)
+        return (node.shift / self.CHUNK_SHIFT) + 1
+
+    def get_head_node(self, tree) -> int:
+        return tree.xa_head
+
+    def node_is_internal(self, nodep) -> bool:
+        return (nodep & self.XARRAY_TAG_MASK) == self.XARRAY_TAG_INTERNAL
+
+    def is_node_tagged(self, nodep) -> bool:
+        return (nodep & self.XARRAY_TAG_MASK) != 0
+
+    def untag_node(self, nodep) -> int:
+        return nodep & (~self.XARRAY_TAG_MASK)
+
+    def is_valid_node(self, nodep) -> bool:
+        # It should have the tag mask clear
+        return not self.is_node_tagged(nodep)
+
+
+class RadixTree(IDStorage):
+    RADIX_TREE_INTERNAL_NODE = 1
+    RADIX_TREE_EXCEPTIONAL_ENTRY = 2
+    RADIX_TREE_ENTRY_MASK = 3
+
+    # Dynamic values. These will be initialized later
+    RADIX_TREE_INDEX_BITS = None
+    RADIX_TREE_MAX_PATH = None
+    RADIX_TREE_HEIGHT_SHIFT = None
+    RADIX_TREE_HEIGHT_MASK = None
+
+    def __init__(self, *args, **kwargs) -> None:
+        super().__init__(*args, **kwargs)
+
+        char_bits = 8
+        self.RADIX_TREE_INDEX_BITS = char_bits * self.pointer_size
+        self.RADIX_TREE_MAX_PATH = int(
+            math.ceil(self.RADIX_TREE_INDEX_BITS / float(self.CHUNK_SHIFT))
+        )
+        self.RADIX_TREE_HEIGHT_SHIFT = self.RADIX_TREE_MAX_PATH + 1
+        self.RADIX_TREE_HEIGHT_MASK = (1 << self.RADIX_TREE_HEIGHT_SHIFT) - 1
+
+        if not self.vmlinux.has_type("radix_tree_root"):
+            # In kernels 4.20, RADIX_TREE_INTERNAL_NODE flag took RADIX_TREE_EXCEPTIONAL_ENTRY's
+            # value. RADIX_TREE_EXCEPTIONAL_ENTRY was removed but that's managed in is_valid_node()
+            # Note that the Radix Tree is still in use for IDR, even after kernels 4.20 when XArray
+            # mostly replace it
+            self.RADIX_TREE_INTERNAL_NODE = 2
+
+    @property
+    def node_type_name(self) -> str:
+        return "radix_tree_node"
+
+    @property
+    def tag_internal_value(self) -> int:
+        return self.RADIX_TREE_INTERNAL_NODE
+
+    def get_tree_height(self, treep) -> int:
+        with contextlib.suppress(exceptions.SymbolError):
+            if self.vmlinux.get_type("radix_tree_root").has_member("height"):
+                # kernels < 4.7.10
+                radix_tree_root = self.vmlinux.object(
+                    "radix_tree_root", offset=treep, absolute=True
+                )
+                return radix_tree_root.height
+
+        # kernels >= 4.7.10
+        return 0
+
+    def _radix_tree_maxindex(self, node, height) -> int:
+        """Return the maximum key which can be store into a radix tree with this height."""
+
+        if not self.vmlinux.has_symbol("height_to_maxindex"):
+            # Kernels >= 4.7
+            return (self.CHUNK_SIZE << node.shift) - 1
+        else:
+            # Kernels < 4.7
+            height_to_maxindex_array = self.vmlinux.object_from_symbol(
+                "height_to_maxindex"
+            )
+            maxindex = height_to_maxindex_array[height]
+            return maxindex
+
+    def get_node_height(self, nodep) -> int:
+        node = self.nodep_to_node(nodep)
+        if hasattr(node, "shift"):
+            # 4.7 <= Kernels < 4.20
+            return (node.shift / self.CHUNK_SHIFT) + 1
+        elif hasattr(node, "path"):
+            # 3.15 <= Kernels < 4.7
+            return node.path & self.RADIX_TREE_HEIGHT_MASK
+        elif hasattr(node, "height"):
+            # Kernels < 3.15
+            return node.height
+        else:
+            raise exceptions.VolatilityException("Cannot find radix-tree node height")
+
+    def get_head_node(self, tree) -> int:
+        return tree.rnode
+
+    def node_is_internal(self, nodep) -> bool:
+        return (nodep & self.RADIX_TREE_INTERNAL_NODE) != 0
+
+    def is_node_tagged(self, nodep) -> bool:
+        return self.node_is_internal(nodep)
+
+    def untag_node(self, nodep) -> int:
+        return nodep & (~self.RADIX_TREE_ENTRY_MASK)
+
+    def is_valid_node(self, nodep) -> bool:
+        # In kernels 4.20, exceptional nodes were removed and internal entries took their bitmask
+        if self.vmlinux.has_type("radix_tree_root"):
+            return (
+                nodep & self.RADIX_TREE_ENTRY_MASK
+            ) != self.RADIX_TREE_EXCEPTIONAL_ENTRY
+
+        return True
+
+
+class PageCache(object):
+    """Linux Page Cache abstraction"""
+
+    def __init__(
+        self,
+        context: interfaces.context.ContextInterface,
+        kernel_module_name: str,
+        page_cache: interfaces.objects.ObjectInterface,
+    ):
+        """
+        Args:
+            context: interfaces.context.ContextInterface,
+            kernel_module_name: The name of the kernel module on which to operate
+            page_cache: Page cache address space
+        """
+        self.vmlinux = context.modules[kernel_module_name]
+
+        self._page_cache = page_cache
+        self._idstorage = IDStorage.choose_id_storage(context, kernel_module_name)
+
+    def get_cached_pages(self) -> Iterator[interfaces.objects.ObjectInterface]:
+        """Returns all page cache contents
+
+        Yields:
+            Page objects
+        """
+
+        for page_addr in self._idstorage.get_entries(self._page_cache.i_pages):
+            if not page_addr:
+                continue
+
+            page = self.vmlinux.object("page", offset=page_addr, absolute=True)
+            if page:
+                yield page
diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index 05679523f..927f767e2 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -2,26 +2,25 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
+import abc
 import collections.abc
 import logging
+import functools
+import binascii
 import stat
-from datetime import datetime
+import datetime
 import socket as socket_module
-from typing import Generator, Iterable, Iterator, Optional, Tuple, List, Union
+from typing import Generator, Iterable, Iterator, Optional, Tuple, List, Union, Dict
 
 from volatility3.framework import constants, exceptions, objects, interfaces, symbols
 from volatility3.framework.renderers import conversion
-from volatility3.framework.constants.linux import SOCK_TYPES, SOCK_FAMILY
-from volatility3.framework.constants.linux import IP_PROTOCOLS, IPV6_PROTOCOLS
-from volatility3.framework.constants.linux import TCP_STATES, NETLINK_PROTOCOLS
-from volatility3.framework.constants.linux import ETH_PROTOCOLS, BLUETOOTH_STATES
-from volatility3.framework.constants.linux import BLUETOOTH_PROTOCOLS, SOCKET_STATES
-from volatility3.framework.constants.linux import CAPABILITIES
+from volatility3.framework.constants import linux as linux_constants
 from volatility3.framework.layers import linear
 from volatility3.framework.objects import utility
 from volatility3.framework.symbols import generic, linux, intermed
 from volatility3.framework.symbols.linux.extensions import elf
 
+
 vollog = logging.getLogger(__name__)
 
 # Keep these in a basic module, to prevent import cycles when symbol providers require them
@@ -29,112 +28,140 @@ vollog = logging.getLogger(__name__)
 
 class module(generic.GenericIntelProcess):
 
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self._mod_mem_type = None  # Initialize _mod_mem_type to None for memoization
+    def is_valid(self):
+        """Determine whether it is a valid module object by verifying the self-referential
+        in module_kobject. This also confirms that the module is actively allocated and
+        not a remnant of freed memory or a failed module load attempt by verifying the
+        module memory section sizes.
+        """
+        layer = self._context.layers[self.vol.layer_name]
+        # Make sure the entire module content is readable
+        if not layer.is_valid(self.vol.offset, self.vol.size):
+            return False
 
-    @property
-    def mod_mem_type(self):
+        core_size = self.get_core_size()
+        core_text_size = self.get_core_text_size()
+        init_size = self.get_init_size()
+        if not (
+            0 < core_text_size <= linux_constants.MODULE_MAXIMUM_CORE_TEXT_SIZE
+            and 0 < core_size <= linux_constants.MODULE_MAXIMUM_CORE_SIZE
+            and core_size + init_size >= linux_constants.MODULE_MINIMUM_SIZE
+        ):
+            return False
+
+        if not (
+            self.mkobj
+            and self.mkobj.mod
+            and self.mkobj.mod.is_readable()
+            and self.mkobj.mod == self.vol.offset
+        ):
+            return False
+
+        return True
+
+    @functools.cached_property
+    def mod_mem_type(self) -> Dict:
         """Return the mod_mem_type enum choices if available or an empty dict if not"""
         # mod_mem_type and module_memory were added in kernel 6.4 which replaces
         # module_layout for storing the information around core_layout etc.
         # see commit ac3b43283923440900b4f36ca5f9f0b1ca43b70e for more information
+        symbol_table_name = self.get_symbol_table_name()
+        mod_mem_type_symname = symbol_table_name + constants.BANG + "mod_mem_type"
+        symbol_space = self._context.symbol_space
+        try:
+            mod_mem_type = symbol_space.get_enumeration(mod_mem_type_symname).choices
+        except exceptions.SymbolError:
+            mod_mem_type = {}
+            vollog.debug(
+                "Unable to find mod_mem_type enum. This message can be ignored for kernels < 6.4"
+            )
 
-        if self._mod_mem_type is None:
-            try:
-                self._mod_mem_type = self._context.symbol_space.get_enumeration(
-                    self.get_symbol_table_name() + constants.BANG + "mod_mem_type"
-                ).choices
-            except exceptions.SymbolError:
-                vollog.debug(
-                    f"Unable to find mod_mem_type enum. This message can be ignored for kernels < 6.4"
-                )
-                # set to empty dict to show that the enum was not found, and so shouldn't be searched for again
-                self._mod_mem_type = {}
-        return self._mod_mem_type
+        return mod_mem_type
+
+    def _get_mem_type(self, mod_mem_type_name):
+        module_mem_index = self.mod_mem_type.get(mod_mem_type_name)
+        if module_mem_index is None:
+            raise AttributeError(f"Unknown module memory type '{mod_mem_type_name}'")
+
+        if not (0 <= module_mem_index < self.mem.count):
+            raise AttributeError(
+                f"Invalid module memory type index '{module_mem_index}'"
+            )
+
+        return self.mem[module_mem_index]
+
+    def _get_mem_size(self, mod_mem_type_name):
+        return self._get_mem_type(mod_mem_type_name).size
+
+    def _get_mem_base(self, mod_mem_type_name):
+        return self._get_mem_type(mod_mem_type_name).base
 
     def get_module_base(self):
         if self.has_member("mem"):  # kernels 6.4+
-            try:
-                return self.mem[self.mod_mem_type["MOD_TEXT"]].base
-            except KeyError:
-                raise AttributeError(
-                    "module -> get_module_base: Unable to get module base. Cannot read base from MOD_TEXT."
-                )
+            return self._get_mem_base("MOD_TEXT")
         elif self.has_member("core_layout"):
             return self.core_layout.base
         elif self.has_member("module_core"):
             return self.module_core
-        raise AttributeError("module -> get_module_base: Unable to get module base")
+
+        raise AttributeError("Unable to get module base")
 
     def get_init_size(self):
         if self.has_member("mem"):  # kernels 6.4+
-            try:
-                return (
-                    self.mem[self.mod_mem_type["MOD_INIT_TEXT"]].size
-                    + self.mem[self.mod_mem_type["MOD_INIT_DATA"]].size
-                    + self.mem[self.mod_mem_type["MOD_INIT_RODATA"]].size
-                )
-            except KeyError:
-                raise AttributeError(
-                    "module -> get_init_size: Unable to determine .init section size of module. Cannot read size of MOD_INIT_TEXT, MOD_INIT_DATA, and MOD_INIT_RODATA"
-                )
+            return (
+                self._get_mem_size("MOD_INIT_TEXT")
+                + self._get_mem_size("MOD_INIT_DATA")
+                + self._get_mem_size("MOD_INIT_RODATA")
+            )
         elif self.has_member("init_layout"):
             return self.init_layout.size
         elif self.has_member("init_size"):
             return self.init_size
-        raise AttributeError(
-            "module -> get_init_size: Unable to determine .init section size of module"
-        )
+
+        raise AttributeError("Unable to determine .init section size of module")
 
     def get_core_size(self):
         if self.has_member("mem"):  # kernels 6.4+
-            try:
-                return (
-                    self.mem[self.mod_mem_type["MOD_TEXT"]].size
-                    + self.mem[self.mod_mem_type["MOD_DATA"]].size
-                    + self.mem[self.mod_mem_type["MOD_RODATA"]].size
-                    + self.mem[self.mod_mem_type["MOD_RO_AFTER_INIT"]].size
-                )
-            except KeyError:
-                raise AttributeError(
-                    "module -> get_core_size: Unable to determine core size of module. Cannot read size of MOD_TEXT, MOD_DATA, MOD_RODATA, and MOD_RO_AFTER_INIT."
-                )
+            return (
+                self._get_mem_size("MOD_TEXT")
+                + self._get_mem_size("MOD_DATA")
+                + self._get_mem_size("MOD_RODATA")
+                + self._get_mem_size("MOD_RO_AFTER_INIT")
+            )
         elif self.has_member("core_layout"):
             return self.core_layout.size
         elif self.has_member("core_size"):
             return self.core_size
-        raise AttributeError(
-            "module -> get_core_size: Unable to determine core size of module"
-        )
+
+        raise AttributeError("Unable to determine core size of module")
+
+    def get_core_text_size(self):
+        if self.has_member("mem"):  # kernels 6.4+
+            return self._get_mem_size("MOD_TEXT")
+        elif self.has_member("core_layout"):
+            return self.core_layout.text_size
+        elif self.has_member("core_text_size"):
+            return self.core_text_size
+
+        raise AttributeError("Unable to determine core text size of module")
 
     def get_module_core(self):
         if self.has_member("mem"):  # kernels 6.4+
-            try:
-                return self.mem[self.mod_mem_type["MOD_TEXT"]].base
-            except KeyError:
-                raise AttributeError(
-                    "module -> get_module_core: Unable to get module core. Cannot read base from MOD_TEXT."
-                )
+            return self._get_mem_base("MOD_TEXT")
         elif self.has_member("core_layout"):
             return self.core_layout.base
         elif self.has_member("module_core"):
             return self.module_core
-        raise AttributeError("module -> get_module_core: Unable to get module core")
+        raise AttributeError("Unable to get module core")
 
     def get_module_init(self):
         if self.has_member("mem"):  # kernels 6.4+
-            try:
-                return self.mem[self.mod_mem_type["MOD_INIT_TEXT"]].base
-            except KeyError:
-                raise AttributeError(
-                    "module -> get_module_core: Unable to get module init. Cannot read base from MOD_INIT_TEXT."
-                )
+            return self._get_mem_base("MOD_INIT_TEXT")
         elif self.has_member("init_layout"):
             return self.init_layout.base
         elif self.has_member("module_init"):
             return self.module_init
-        raise AttributeError("module -> get_module_init: Unable to get module init")
+        raise AttributeError("Unable to get module init")
 
     def get_name(self):
         """Get the name of the module as a string"""
@@ -213,7 +240,7 @@ class module(generic.GenericIntelProcess):
             for sym in syms:
                 yield sym
 
-    def get_symbols_names_and_addresses(self) -> Tuple[str, int]:
+    def get_symbols_names_and_addresses(self) -> Iterable[Tuple[str, int]]:
         """Get names and addresses for each symbol of the module
 
         Yields:
@@ -260,17 +287,15 @@ class module(generic.GenericIntelProcess):
             return self.kallsyms.symtab
         elif self.has_member("symtab"):
             return self.symtab
-        raise AttributeError("module -> symtab: Unable to get symtab")
+        raise AttributeError("Unable to get symtab")
 
     @property
     def num_symtab(self):
         if self.has_member("kallsyms"):
             return int(self.kallsyms.num_symtab)
         elif self.has_member("num_symtab"):
-            return int(self.num_symtab)
-        raise AttributeError(
-            "module -> num_symtab: Unable to determine number of symbols"
-        )
+            return int(self.member("num_symtab"))
+        raise AttributeError("Unable to determine number of symbols")
 
     @property
     def section_strtab(self):
@@ -280,7 +305,7 @@ class module(generic.GenericIntelProcess):
         # Older kernels
         elif self.has_member("strtab"):
             return self.strtab
-        raise AttributeError("module -> strtab: Unable to get strtab")
+        raise AttributeError("Unable to get strtab")
 
 
 class task_struct(generic.GenericIntelProcess):
@@ -336,7 +361,7 @@ class task_struct(generic.GenericIntelProcess):
         Returns:
             bool: True, if this task is a kernel thread. Otherwise, False.
         """
-        return (self.flags & constants.linux.PF_KTHREAD) != 0
+        return (self.flags & linux_constants.PF_KTHREAD) != 0
 
     @property
     def is_thread_group_leader(self) -> bool:
@@ -356,20 +381,259 @@ class task_struct(generic.GenericIntelProcess):
         """
         return not self.is_kernel_thread and self.tgid != self.pid
 
-    def get_threads(self) -> Iterable[interfaces.objects.ObjectInterface]:
-        """Returns a list of the task_struct based on the list_head
-        thread_node structure."""
+    def _get_tasks_iterable(self) -> Iterable[interfaces.objects.ObjectInterface]:
+        """Returns the respective iterable to obtain the threads in this process"""
+        vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self)
+        task_struct_symname = f"{vmlinux.symbol_table_name}{constants.BANG}task_struct"
+        if vmlinux.get_type("task_struct").has_member("signal") and vmlinux.get_type(
+            "signal_struct"
+        ).has_member("thread_head"):
+            # kernels >= 6.7 - via signals
+            return self.signal.thread_head.to_list(task_struct_symname, "thread_node")
+        elif vmlinux.get_type("task_struct").has_member("thread_group"):
+            # kernels < 6.7 - via thread_group
+            return self.thread_group.to_list(task_struct_symname, "thread_group")
 
+        raise AttributeError("Unable to find the root dentry")
+
+    def get_threads(self) -> Iterable[interfaces.objects.ObjectInterface]:
+        """Returns each thread in this process"""
+        tasks_iterable = self._get_tasks_iterable()
+        threads_seen = set([self.vol.offset])
+        for task in tasks_iterable:
+            if task.vol.offset not in threads_seen:
+                threads_seen.add(task.vol.offset)
+                yield task
+
+    @property
+    def is_being_ptraced(self) -> bool:
+        """Returns True if this task is being traced using ptrace"""
+        return self.ptrace != 0
+
+    @property
+    def is_ptracing(self) -> bool:
+        """Returns True if this task is tracing other tasks using ptrace"""
+        is_tracing = (
+            self.ptraced.next.is_readable()
+            and self.ptraced.next.dereference().vol.offset != self.ptraced.vol.offset
+        )
+        return is_tracing
+
+    def get_ptrace_tracer_tid(self) -> Optional[int]:
+        """Returns the tracer's TID tracing this task"""
+        return self.parent.pid if self.is_being_ptraced else None
+
+    def get_ptrace_tracee_tids(self) -> List[int]:
+        """Returns the list of TIDs being traced by this task"""
         task_symbol_table_name = self.get_symbol_table_name()
 
-        # iterating through the thread_list from thread_group
-        # this allows iterating through pointers to grab the
-        # threads and using the thread_group offset to get the
-        # corresponding task_struct
-        for task in self.thread_group.to_list(
-            f"{task_symbol_table_name}{constants.BANG}task_struct", "thread_group"
-        ):
-            yield task
+        task_struct_symname = f"{task_symbol_table_name}{constants.BANG}task_struct"
+        tracing_tid_list = [
+            task_being_traced.pid
+            for task_being_traced in self.ptraced.to_list(
+                task_struct_symname, "ptrace_entry"
+            )
+        ]
+        return tracing_tid_list
+
+    def get_ptrace_tracee_flags(self) -> Optional[str]:
+        """Returns a string with the ptrace flags"""
+        return (
+            linux_constants.PT_FLAGS(self.ptrace).flags
+            if self.is_being_ptraced
+            else None
+        )
+
+    def _get_task_start_time(self) -> datetime.timedelta:
+        """Returns the task's monotonic start_time as a timedelta.
+
+        Returns:
+            The task's start time as a timedelta object.
+        """
+        for member_name in ("start_boottime", "real_start_time", "start_time"):
+            if self.has_member(member_name):
+                start_time_obj = self.member(member_name)
+                start_time_obj_type = start_time_obj.vol.type_name
+                start_time_obj_type_name = start_time_obj_type.split(constants.BANG)[1]
+                if start_time_obj_type_name != "timespec":
+                    # kernels >= 3.17 real_start_time and start_time are u64
+                    # kernels >= 5.5 uses start_boottime which is also a u64
+                    start_time = Timespec64Concrete.new_from_nsec(start_time_obj)
+                else:
+                    # kernels < 3.17 real_start_time and start_time are timespec
+                    start_time = Timespec64Concrete.new_from_timespec(start_time_obj)
+
+                # This is relative to the boot time so it makes sense to be a timedelta.
+                return start_time.to_timedelta()
+
+        raise AttributeError("Unsupported task_struct start_time member")
+
+    def get_time_namespace(self) -> Optional[interfaces.objects.ObjectInterface]:
+        """Returns the task's time namespace"""
+        vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self)
+        if not self.has_member("nsproxy"):
+            # kernels < 2.6.19: ab516013ad9ca47f1d3a936fa81303bfbf734d52
+            return None
+
+        if not vmlinux.get_type("nsproxy").has_member("time_ns"):
+            # kernels < 5.6 769071ac9f20b6a447410c7eaa55d1a5233ef40c
+            return None
+
+        return self.nsproxy.time_ns
+
+    def get_time_namespace_id(self) -> int:
+        """Returns the task's time namespace ID."""
+        time_ns = self.get_time_namespace()
+        if not time_ns:
+            # kernels < 5.6
+            return None
+
+        # We are good. ns_common (ns) was introduced in kernels 3.19. So by the time the
+        # time namespace was added in kernels 5.6, it already included the ns member.
+        return time_ns.ns.inum
+
+    def _get_time_namespace_offsets(
+        self,
+    ) -> Optional[interfaces.objects.ObjectInterface]:
+        """Returns the time offsets from the task's time namespace."""
+        time_ns = self.get_time_namespace()
+        if not time_ns:
+            # kernels < 5.6
+            return None
+
+        if not time_ns.has_member("offsets"):
+            # kernels < 5.6 af993f58d69ee9c1f421dfc87c3ed231c113989c
+            return None
+
+        return time_ns.offsets
+
+    def get_time_namespace_monotonic_offset(
+        self,
+    ) -> Optional[interfaces.objects.ObjectInterface]:
+        """Gets task's time namespace monotonic offset
+
+        Returns:
+            a kernel's timespec64 object with the monotonic offset
+        """
+        time_namespace_offsets = self._get_time_namespace_offsets()
+        if not time_namespace_offsets:
+            return None
+
+        return time_namespace_offsets.monotonic
+
+    def _get_time_namespace_boottime_offset(
+        self,
+    ) -> Optional[interfaces.objects.ObjectInterface]:
+        """Gets task's time namespace boottime offset
+
+        Returns:
+            a kernel's timespec64 object with the boottime offset
+        """
+        time_namespace_offsets = self._get_time_namespace_offsets()
+        if not time_namespace_offsets:
+            return None
+
+        return time_namespace_offsets.boottime
+
+    def _get_boottime_raw(self) -> "Timespec64Concrete":
+        """Returns the boot time in a Timespec64Concrete object."""
+
+        vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self)
+        if vmlinux.has_symbol("tk_core"):
+            # kernels >= 3.17 | tk_core | 3fdb14fd1df70325e1e91e1203a699a4803ed741
+            tk_core = vmlinux.object_from_symbol("tk_core")
+            timekeeper = tk_core.timekeeper
+            if not timekeeper.offs_real.has_member("tv64"):
+                # kernels >= 4.10 - Tested on Ubuntu 6.8.0-41
+                boottime_nsec = timekeeper.offs_real - timekeeper.offs_boot
+            else:
+                # 3.17 <= kernels < 4.10 - Tested on Ubuntu 4.4.0-142
+                boottime_nsec = timekeeper.offs_real.tv64 - timekeeper.offs_boot.tv64
+            return Timespec64Concrete.new_from_nsec(boottime_nsec)
+
+        elif vmlinux.has_symbol("timekeeper") and vmlinux.get_type(
+            "timekeeper"
+        ).has_member("wall_to_monotonic"):
+            # 3.4 <= kernels < 3.17 - Tested on Ubuntu 3.13.0-185
+            timekeeper = vmlinux.object_from_symbol("timekeeper")
+
+            # timekeeper.wall_to_monotonic is timespec
+            boottime = Timespec64Concrete.new_from_timespec(
+                timekeeper.wall_to_monotonic
+            )
+
+            boottime += timekeeper.total_sleep_time
+
+            return boottime.negate()
+
+        elif vmlinux.has_symbol("wall_to_monotonic"):
+            # kernels < 3.4 - Tested on Debian7 3.2.0-4 (3.2.57-3+deb7u2)
+            wall_to_monotonic = vmlinux.object_from_symbol("wall_to_monotonic")
+            boottime = Timespec64Concrete.new_from_timespec(wall_to_monotonic)
+            if vmlinux.has_symbol("total_sleep_time"):
+                # 2.6.23 <= kernels < 3.4 7c3f1a573237b90ef331267260358a0ec4ac9079
+                total_sleep_time = vmlinux.object_from_symbol("total_sleep_time")
+                full_type_name = total_sleep_time.vol.type_name
+                type_name = full_type_name.split(constants.BANG)[1]
+                if type_name == "timespec":
+                    # kernels >= 2.6.32 total_sleep_time is a timespec
+                    boottime += total_sleep_time
+                else:
+                    # kernels < 2.6.32 total_sleep_time is an unsigned long as seconds
+                    boottime.tv_sec += total_sleep_time
+
+            return boottime.negate()
+
+        raise exceptions.VolatilityException("Unsupported")
+
+    def get_boottime(self, root_time_namespace: bool = True) -> datetime.datetime:
+        """Returns the boot time in UTC as a datetime.
+
+        Args:
+            root_time_namespace: If True, it returns the boot time as seen from the root
+                time namespace. Otherwise, it returns the boot time relative to the
+                task's time namespace.
+
+        Returns:
+            A datetime with the UTC boot time.
+        """
+        boottime = self._get_boottime_raw()
+        if not boottime:
+            return None
+
+        if not root_time_namespace:
+            # Shift boot timestamp according to the task's time namespace offset
+            boottime_offset_timespec = self._get_time_namespace_boottime_offset()
+            if boottime_offset_timespec:
+                # Time namespace support is from kernels 5.6
+                boottime -= boottime_offset_timespec
+
+        return boottime.to_datetime()
+
+    def get_create_time(self) -> datetime.datetime:
+        """Retrieves the task's start time from its time namespace.
+        Args:
+            context: The context to retrieve required elements (layers, symbol tables) from
+            vmlinux_module_name: The name of the kernel module on which to operate
+            task: A reference task
+
+        Returns:
+            A datetime with task's start time
+        """
+        # Typically, we want to see the creation time seen from the root time namespace
+        boottime = self.get_boottime(root_time_namespace=True)
+
+        # The kernel exports only tv_sec to procfs, see kernel's show_stat().
+        # This means user-space tools, like those in the procps package (e.g., ps, top, etc.),
+        # only use the boot time seconds to compute dates relatives to this.
+        boottime = boottime.replace(microsecond=0)
+
+        task_start_time_timedelta = self._get_task_start_time()
+
+        # NOTE: Do NOT apply the task's time namespace offsets here. While the kernel uses
+        # timens_add_boottime_ns(), it's not needed here since we're seeing it from the
+        # root time namespace, not within the task's own time namespace
+        return boottime + task_start_time_timedelta
 
 
 class fs_struct(objects.StructType):
@@ -635,11 +899,23 @@ class super_block(objects.StructType):
         ]
         return sb_opts
 
-    def get_type(self):
-        mnt_sb_type = utility.pointer_to_string(self.s_type.name, count=255)
-        if self.s_subtype:
-            mnt_sb_subtype = utility.pointer_to_string(self.s_subtype, count=255)
+    def get_type(self) -> Optional[str]:
+        """Gets the superblock filesystem type string"""
+
+        s_type_ptr = self.s_type
+        if not (s_type_ptr and s_type_ptr.is_readable()):
+            return None
+
+        s_type_name_ptr = s_type_ptr.name
+        if not (s_type_name_ptr and s_type_name_ptr.is_readable()):
+            return None
+
+        mnt_sb_type = utility.pointer_to_string(s_type_name_ptr, count=255)
+        s_subtype_ptr = self.s_subtype
+        if s_subtype_ptr and s_subtype_ptr.is_readable():
+            mnt_sb_subtype = utility.pointer_to_string(s_subtype_ptr, count=255)
             mnt_sb_type += "." + mnt_sb_subtype
+
         return mnt_sb_type
 
 
@@ -820,25 +1096,75 @@ class dentry(objects.StructType):
             current_dentry = current_dentry.d_parent
         return None
 
+    def get_subdirs(self) -> Iterable[interfaces.objects.ObjectInterface]:
+        """Walks dentry subdirs
+
+        Yields:
+            A dentry object
+        """
+        if self.has_member("d_sib") and self.has_member("d_children"):
+            # kernels >= 6.8
+            walk_member = "d_sib"
+            list_head_member = self.d_children
+        elif self.has_member("d_child") and self.has_member("d_subdirs"):
+            # 2.5.0 <= kernels < 6.8
+            walk_member = "d_child"
+            list_head_member = self.d_subdirs
+        else:
+            raise exceptions.VolatilityException("Unsupported dentry type")
+
+        dentry_type_name = self.get_symbol_table_name() + constants.BANG + "dentry"
+        yield from list_head_member.to_list(dentry_type_name, walk_member)
+
+    def get_inode(self) -> interfaces.objects.ObjectInterface:
+        """Returns the inode associated with this dentry"""
+
+        inode_ptr = self.d_inode
+        if not (inode_ptr and inode_ptr.is_readable() and inode_ptr.is_valid()):
+            return None
+
+        return inode_ptr.dereference()
+
 
 class struct_file(objects.StructType):
     def get_dentry(self) -> interfaces.objects.ObjectInterface:
-        if self.has_member("f_dentry"):
-            return self.f_dentry
-        elif self.has_member("f_path"):
+        """Returns a pointer to the dentry associated with this file"""
+        if self.has_member("f_path"):
             return self.f_path.dentry
+        elif self.has_member("f_dentry"):
+            return self.f_dentry
         else:
             raise AttributeError("Unable to find file -> dentry")
 
     def get_vfsmnt(self) -> interfaces.objects.ObjectInterface:
         """Returns the fs (vfsmount) where this file is mounted"""
-        if self.has_member("f_vfsmnt"):
-            return self.f_vfsmnt
-        elif self.has_member("f_path"):
+        if self.has_member("f_path"):
             return self.f_path.mnt
+        elif self.has_member("f_vfsmnt"):
+            return self.f_vfsmnt
         else:
             raise AttributeError("Unable to find file -> vfs mount")
 
+    def get_inode(self) -> interfaces.objects.ObjectInterface:
+        """Returns an inode associated with this file"""
+
+        inode_ptr = None
+        if self.has_member("f_inode") and self.f_inode and self.f_inode.is_readable():
+            # Try first the cached value, kernels +3.9
+            inode_ptr = self.f_inode
+
+        if not (inode_ptr and inode_ptr.is_readable() and inode_ptr.is_valid()):
+            dentry_ptr = self.get_dentry()
+            if not (dentry_ptr and dentry_ptr.is_readable()):
+                return None
+
+            inode_ptr = dentry_ptr.d_inode
+
+        if not (inode_ptr and inode_ptr.is_readable() and inode_ptr.is_valid()):
+            return None
+
+        return inode_ptr.dereference()
+
 
 class list_head(objects.StructType, collections.abc.Iterable):
     def to_list(
@@ -896,6 +1222,40 @@ class list_head(objects.StructType, collections.abc.Iterable):
         return self.to_list(self.vol.parent.vol.type_name, self.vol.member_name)
 
 
+class hlist_head(objects.StructType):
+    def to_list(
+        self,
+        symbol_type: str,
+        member: str,
+    ) -> Iterator[interfaces.objects.ObjectInterface]:
+        """Returns an iterator of the entries in the list.
+
+        This is a doubly linked list; however, it is not circular, so the 'forward' field
+        doesn't make sense. Also, the sentinel concept doesn't make sense here either;
+        unlike list_head, the head and nodes each have their own distinct types. A list_head
+        cannot be a node by itself.
+        - The 'pprev' of the first 'hlist_node' points to the 'hlist_head', not to the last node.
+        - The last element 'next' member is NULL
+
+        Args:
+            symbol_type: Type of the list elements
+            member: Name of the list_head member in the list elements
+
+        Yields:
+            Objects of the type specified via the "symbol_type" argument.
+
+        """
+        vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self)
+
+        current = self.first
+        while current and current.is_readable():
+            yield linux.LinuxUtilities.container_of(
+                current, symbol_type, member, vmlinux
+            )
+
+            current = current.next
+
+
 class files_struct(objects.StructType):
     def get_fds(self) -> interfaces.objects.ObjectInterface:
         if self.has_member("fdt"):
@@ -936,7 +1296,8 @@ class mount(objects.StructType):
         MNT_RELATIME: "relatime",
     }
 
-    def get_mnt_sb(self):
+    def get_mnt_sb(self) -> int:
+        """Returns a pointer to the super_block"""
         if self.has_member("mnt"):
             return self.mnt.mnt_sb
         elif self.has_member("mnt_sb"):
@@ -1156,7 +1517,7 @@ class vfsmount(objects.StructType):
             bool: 'True' if the given argument points to the the same 'vfsmount'
             as 'self'.
         """
-        if type(vfsmount_ptr) == objects.Pointer:
+        if isinstance(vfsmount_ptr, objects.Pointer):
             return self.vol.offset == vfsmount_ptr
         else:
             raise exceptions.VolatilityException(
@@ -1251,6 +1612,7 @@ class vfsmount(objects.StructType):
             return self._get_real_mnt().has_parent()
 
     def get_mnt_sb(self):
+        """Returns a pointer to the super_block"""
         return self.mnt_sb
 
     def get_flags_access(self) -> str:
@@ -1299,14 +1661,42 @@ class mnt_namespace(objects.StructType):
         else:
             raise AttributeError("Unable to find mnt_namespace inode")
 
-    def get_mount_points(self):
+    def get_mount_points(
+        self,
+    ) -> Iterator[interfaces.objects.ObjectInterface]:
+        """Yields the mount points for this mount namespace.
+
+        Yields:
+            mount struct instances
+        """
         table_name = self.vol.type_name.split(constants.BANG)[0]
-        mnt_type = table_name + constants.BANG + "mount"
-        if not self._context.symbol_space.has_type(mnt_type):
-            # Old kernels ~ 2.6
-            mnt_type = table_name + constants.BANG + "vfsmount"
-        for mount in self.list.to_list(mnt_type, "mnt_list"):
-            yield mount
+
+        if self.has_member("list"):
+            # kernels < 6.8
+            mnt_type = table_name + constants.BANG + "mount"
+            if not self._context.symbol_space.has_type(mnt_type):
+                # In kernels < 3.3, the 'mount' struct didn't exist, and the 'mnt_list'
+                # member was part of the 'vfsmount' struct.
+                mnt_type = table_name + constants.BANG + "vfsmount"
+
+            yield from self.list.to_list(mnt_type, "mnt_list")
+        elif (
+            self.has_member("mounts")
+            and self.mounts.vol.type_name == table_name + constants.BANG + "rb_root"
+        ):
+            # kernels >= 6.8
+            vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(
+                self._context, self
+            )
+            for node in self.mounts.get_nodes():
+                mnt = linux.LinuxUtilities.container_of(
+                    node, "mount", "mnt_list", vmlinux
+                )
+                yield mnt
+        else:
+            raise exceptions.VolatilityException(
+                "Unsupported kernel mount namespace implementation"
+            )
 
 
 class net(objects.StructType):
@@ -1350,18 +1740,18 @@ class socket(objects.StructType):
 
     def get_state(self):
         socket_state_idx = self.state
-        if 0 <= socket_state_idx < len(SOCKET_STATES):
-            return SOCKET_STATES[socket_state_idx]
+        if 0 <= socket_state_idx < len(linux_constants.SOCKET_STATES):
+            return linux_constants.SOCKET_STATES[socket_state_idx]
 
 
 class sock(objects.StructType):
     def get_family(self):
         family_idx = self.__sk_common.skc_family
-        if 0 <= family_idx < len(SOCK_FAMILY):
-            return SOCK_FAMILY[family_idx]
+        if 0 <= family_idx < len(linux_constants.SOCK_FAMILY):
+            return linux_constants.SOCK_FAMILY[family_idx]
 
     def get_type(self):
-        return SOCK_TYPES.get(self.sk_type, "")
+        return linux_constants.SOCK_TYPES.get(self.sk_type, "")
 
     def get_inode(self):
         if not self.sk_socket:
@@ -1395,8 +1785,8 @@ class unix_sock(objects.StructType):
         # Unix socket states reuse (a subset) of the inet_sock states contants
         if self.sk.get_type() == "STREAM":
             state_idx = self.sk.__sk_common.skc_state
-            if 0 <= state_idx < len(TCP_STATES):
-                return TCP_STATES[state_idx]
+            if 0 <= state_idx < len(linux_constants.TCP_STATES):
+                return linux_constants.TCP_STATES[state_idx]
         else:
             # Return the generic socket state
             return self.sk.sk_socket.get_state()
@@ -1408,15 +1798,15 @@ class unix_sock(objects.StructType):
 class inet_sock(objects.StructType):
     def get_family(self):
         family_idx = self.sk.__sk_common.skc_family
-        if 0 <= family_idx < len(SOCK_FAMILY):
-            return SOCK_FAMILY[family_idx]
+        if 0 <= family_idx < len(linux_constants.SOCK_FAMILY):
+            return linux_constants.SOCK_FAMILY[family_idx]
 
     def get_protocol(self):
         # If INET6 family and a proto is defined, we use that specific IPv6 protocol.
         # Otherwise, we use the standard IP protocol.
-        protocol = IP_PROTOCOLS.get(self.sk.sk_protocol)
+        protocol = linux_constants.IP_PROTOCOLS.get(self.sk.sk_protocol)
         if self.get_family() == "AF_INET6":
-            protocol = IPV6_PROTOCOLS.get(self.sk.sk_protocol, protocol)
+            protocol = linux_constants.IPV6_PROTOCOLS.get(self.sk.sk_protocol, protocol)
         return protocol
 
     def get_state(self):
@@ -1424,8 +1814,8 @@ class inet_sock(objects.StructType):
 
         if self.sk.get_type() == "STREAM":
             state_idx = self.sk.__sk_common.skc_state
-            if 0 <= state_idx < len(TCP_STATES):
-                return TCP_STATES[state_idx]
+            if 0 <= state_idx < len(linux_constants.TCP_STATES):
+                return linux_constants.TCP_STATES[state_idx]
         else:
             # Return the generic socket state
             return self.sk.sk_socket.get_state()
@@ -1508,8 +1898,8 @@ class inet_sock(objects.StructType):
 class netlink_sock(objects.StructType):
     def get_protocol(self):
         protocol_idx = self.sk.sk_protocol
-        if 0 <= protocol_idx < len(NETLINK_PROTOCOLS):
-            return NETLINK_PROTOCOLS[protocol_idx]
+        if 0 <= protocol_idx < len(linux_constants.NETLINK_PROTOCOLS):
+            return linux_constants.NETLINK_PROTOCOLS[protocol_idx]
 
     def get_state(self):
         # Return the generic socket state
@@ -1551,8 +1941,8 @@ class packet_sock(objects.StructType):
         eth_proto = socket_module.htons(self.num)
         if eth_proto == 0:
             return None
-        elif eth_proto in ETH_PROTOCOLS:
-            return ETH_PROTOCOLS[eth_proto]
+        elif eth_proto in linux_constants.ETH_PROTOCOLS:
+            return linux_constants.ETH_PROTOCOLS[eth_proto]
         else:
             return f"0x{eth_proto:x}"
 
@@ -1564,13 +1954,13 @@ class packet_sock(objects.StructType):
 class bt_sock(objects.StructType):
     def get_protocol(self):
         type_idx = self.sk.sk_protocol
-        if 0 <= type_idx < len(BLUETOOTH_PROTOCOLS):
-            return BLUETOOTH_PROTOCOLS[type_idx]
+        if 0 <= type_idx < len(linux_constants.BLUETOOTH_PROTOCOLS):
+            return linux_constants.BLUETOOTH_PROTOCOLS[type_idx]
 
     def get_state(self):
         state_idx = self.sk.__sk_common.skc_state
-        if 0 <= state_idx < len(BLUETOOTH_STATES):
-            return BLUETOOTH_STATES[state_idx]
+        if 0 <= state_idx < len(linux_constants.BLUETOOTH_STATES):
+            return linux_constants.BLUETOOTH_STATES[state_idx]
 
 
 class xdp_sock(objects.StructType):
@@ -1584,20 +1974,59 @@ class xdp_sock(objects.StructType):
 
 
 class bpf_prog(objects.StructType):
-    def get_type(self):
+    def get_type(self) -> Union[str, None]:
+        """Returns a string with the eBPF program type"""
+
         # The program type was in `bpf_prog_aux::prog_type` from 3.18.140 to
         # 4.1.52 before it was moved to `bpf_prog::type`
         if self.has_member("type"):
             # kernel >= 4.1.52
-            return self.type
+            return self.type.description
 
         if self.has_member("aux") and self.aux:
             if self.aux.has_member("prog_type"):
                 # 3.18.140 <= kernel < 4.1.52
-                return self.aux.prog_type
+                return self.aux.prog_type.description
 
         # kernel < 3.18.140
-        raise AttributeError("Unable to find the BPF type")
+        return None
+
+    def get_tag(self) -> Union[str, None]:
+        """Returns a string with the eBPF program tag"""
+        # 'tag' was added in kernels 4.10
+        if not self.has_member("tag"):
+            return None
+
+        vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self)
+        vmlinux_layer = vmlinux.context.layers[vmlinux.layer_name]
+
+        prog_tag_addr = self.tag.vol.offset
+        prog_tag_size = self.tag.count
+        prog_tag_bytes = vmlinux_layer.read(prog_tag_addr, prog_tag_size)
+
+        prog_tag = binascii.hexlify(prog_tag_bytes).decode()
+        return prog_tag
+
+    def get_name(self) -> Union[str, None]:
+        """Returns a string with the eBPF program name"""
+        if not self.has_member("aux"):
+            # 'prog_aux' was added in kernels 3.18
+            return None
+
+        return self.aux.get_name()
+
+
+class bpf_prog_aux(objects.StructType):
+    def get_name(self) -> Union[str, None]:
+        """Returns a string with the eBPF program name"""
+        if not self.has_member("name"):
+            # 'name' was added in kernels 4.15
+            return None
+
+        if not self.name:
+            return None
+
+        return utility.array_to_string(self.name)
 
 
 class cred(objects.StructType):
@@ -1649,7 +2078,7 @@ class kernel_cap_struct(objects.StructType):
         Returns:
             int: The latest capability ID supported by the framework.
         """
-        return len(CAPABILITIES) - 1
+        return len(linux_constants.CAPABILITIES) - 1
 
     def get_kernel_cap_full(self) -> int:
         """Return the maximum value allowed for this kernel for a capability
@@ -1678,7 +2107,7 @@ class kernel_cap_struct(objects.StructType):
         """
 
         capabilities = []
-        for bit, name in enumerate(CAPABILITIES):
+        for bit, name in enumerate(linux_constants.CAPABILITIES):
             if capabilities_bitfield & (1 << bit) != 0:
                 capabilities.append(name)
 
@@ -1739,10 +2168,10 @@ class kernel_cap_struct(objects.StructType):
         Returns:
             bool: "True" if the given capability is enabled.
         """
-        if capability not in CAPABILITIES:
+        if capability not in linux_constants.CAPABILITIES:
             raise AttributeError(f"Unknown capability with name '{capability}'")
 
-        cap_value = 1 << CAPABILITIES.index(capability)
+        cap_value = 1 << linux_constants.CAPABILITIES.index(capability)
         return cap_value & self.get_capabilities() != 0
 
 
@@ -1766,12 +2195,118 @@ class kernel_cap_t(kernel_cap_struct):
         return cap_value & self.get_kernel_cap_full()
 
 
-class timespec64(objects.StructType):
-    def to_datetime(self) -> datetime:
-        """Returns the respective aware datetime"""
+class Timespec64Abstract(abc.ABC):
+    """Abstract class to handle all required timespec64 operations, convertions and
+    adjustments."""
 
-        dt = conversion.unixtime_to_datetime(self.tv_sec + self.tv_nsec / 1e9)
-        return dt
+    @classmethod
+    def new_from_timespec(cls, other) -> "Timespec64Concrete":
+        """Creates a new instance from an Timespec64Abstract subclass object"""
+        if not isinstance(other, Timespec64Abstract):
+            raise TypeError("Requires an object subclass of Timespec64Abstract")
+
+        tv_sec = int(other.tv_sec)
+        tv_nsec = int(other.tv_nsec)
+        return Timespec64Concrete(tv_sec=tv_sec, tv_nsec=tv_nsec)
+
+    @classmethod
+    def new_from_nsec(cls, nsec) -> "Timespec64Concrete":
+        """Creates a new instance from an integer in nanoseconds"""
+
+        # Based on ns_to_timespec64()
+        if nsec > 0:
+            tv_sec = nsec // linux_constants.NSEC_PER_SEC
+            tv_nsec = nsec % linux_constants.NSEC_PER_SEC
+        elif nsec < 0:
+            tv_sec = -((-nsec - 1) // linux_constants.NSEC_PER_SEC) - 1
+            rem = (-nsec - 1) % linux_constants.NSEC_PER_SEC
+            tv_nsec = linux_constants.NSEC_PER_SEC - rem - 1
+        else:
+            tv_sec = tv_nsec = 0
+
+        return Timespec64Concrete(tv_sec=tv_sec, tv_nsec=tv_nsec)
+
+    def to_datetime(self) -> datetime.datetime:
+        """Converts this Timespec64Abstract subclass object to a UTC aware datetime"""
+
+        # pylint: disable=E1101
+        return conversion.unixtime_to_datetime(
+            self.tv_sec + self.tv_nsec / linux_constants.NSEC_PER_SEC
+        )
+
+    def to_timedelta(self) -> datetime.timedelta:
+        """Converts this Timespec64Abstract subclass object to timedelta"""
+        # pylint: disable=E1101
+        return datetime.timedelta(
+            seconds=self.tv_sec + self.tv_nsec / linux_constants.NSEC_PER_SEC
+        )
+
+    def __add__(self, other) -> "Timespec64Concrete":
+        """Returns a new Timespec64Concrete object that sums the current values with those
+        in the timespec argument"""
+        if not isinstance(other, Timespec64Abstract):
+            raise TypeError("Requires an object subclass of Timespec64Abstract")
+
+        # pylint: disable=E1101
+        result = Timespec64Concrete(
+            tv_sec=self.tv_sec + other.tv_sec,
+            tv_nsec=self.tv_nsec + other.tv_nsec,
+        )
+
+        result.normalize()
+
+        return result
+
+    def __sub__(self, other) -> "Timespec64Concrete":
+        """Returns a new Timespec64Abstract object that subtracts the values in the timespec
+        argument from the current object's values"""
+        if not isinstance(other, Timespec64Abstract):
+            raise TypeError("Requires an object subclass of Timespec64Abstract")
+
+        return self + other.negate()
+
+    def negate(self) -> "Timespec64Concrete":
+        """Returns a new Timespec64Concrete object with the values of the current object negated"""
+        # pylint: disable=E1101
+        result = Timespec64Concrete(
+            tv_sec=-self.tv_sec,
+            tv_nsec=-self.tv_nsec,
+        )
+
+        result.normalize()
+
+        return result
+
+    def normalize(self):
+        """Normalize any overflow in tv_sec and tv_nsec."""
+        # Based on kernel's set_normalized_timespec64()
+
+        # pylint: disable=E1101
+        while self.tv_nsec >= linux_constants.NSEC_PER_SEC:
+            self.tv_nsec -= linux_constants.NSEC_PER_SEC
+            self.tv_sec += 1
+
+        while self.tv_nsec < 0:
+            self.tv_nsec += linux_constants.NSEC_PER_SEC
+            self.tv_sec -= 1
+
+
+class Timespec64Concrete(Timespec64Abstract):
+    """Handle all required timespec64 operations, convertions and adjustments.
+    This is used to dynamically create timespec64-like objects, each with its own variables
+    and the same methods as a timespec64 object extension.
+    """
+
+    def __init__(self, tv_sec=0, tv_nsec=0):
+        self.tv_sec = tv_sec
+        self.tv_nsec = tv_nsec
+
+
+class timespec64(Timespec64Abstract, objects.StructType):
+    """Handle all required timespec64 operations, convertions and adjustments.
+    This works as an extension of the timespec64 object while maintaining the same methods
+    as a Timespec64Concrete object.
+    """
 
 
 class inode(objects.StructType):
@@ -1843,7 +2378,7 @@ class inode(objects.StructType):
         else:
             return None
 
-    def _time_member_to_datetime(self, member) -> datetime:
+    def _time_member_to_datetime(self, member) -> datetime.datetime:
         if self.has_member(f"{member}_sec") and self.has_member(f"{member}_nsec"):
             # kernels >= 6.11 it's i_*_sec -> time64_t and i_*_nsec -> u32
             # Ref Linux commit 3aa63a569c64e708df547a8913c84e64a06e7853
@@ -1862,7 +2397,7 @@ class inode(objects.StructType):
                 "Unsupported kernel inode type implementation"
             )
 
-    def get_access_time(self) -> datetime:
+    def get_access_time(self) -> datetime.datetime:
         """Returns the inode's last access time
         This is updated when inode contents are read
 
@@ -1871,7 +2406,7 @@ class inode(objects.StructType):
         """
         return self._time_member_to_datetime("i_atime")
 
-    def get_modification_time(self) -> datetime:
+    def get_modification_time(self) -> datetime.datetime:
         """Returns the inode's last modification time
         This is updated when the inode contents change
 
@@ -1881,7 +2416,7 @@ class inode(objects.StructType):
 
         return self._time_member_to_datetime("i_mtime")
 
-    def get_change_time(self) -> datetime:
+    def get_change_time(self) -> datetime.datetime:
         """Returns the inode's last change time
         This is updated when the inode metadata changes
 
@@ -1897,3 +2432,278 @@ class inode(objects.StructType):
             The inode's file mode string
         """
         return stat.filemode(self.i_mode)
+
+    def get_pages(self) -> Iterable[interfaces.objects.ObjectInterface]:
+        """Gets the inode's cached pages
+
+        Yields:
+            The inode's cached pages
+        """
+        if not self.i_size:
+            return
+        elif not (self.i_mapping and self.i_mapping.nrpages > 0):
+            return
+
+        page_cache = linux.PageCache(
+            context=self._context,
+            kernel_module_name="kernel",
+            page_cache=self.i_mapping.dereference(),
+        )
+        yield from page_cache.get_cached_pages()
+
+    def get_contents(self):
+        """Get the inode cached pages from the page cache
+
+        Yields:
+            page_index (int): The page index in the Tree. File offset is page_index * PAGE_SIZE.
+            page_content (str): The page content
+        """
+        for page_obj in self.get_pages():
+            page_index = int(page_obj.index)
+            page_content = page_obj.get_content()
+            yield page_index, page_content
+
+
+class address_space(objects.StructType):
+    @property
+    def i_pages(self):
+        """Returns the appropriate member containing the page cache tree"""
+        if self.has_member("i_pages"):
+            # Kernel >= 4.17
+            return self.member("i_pages")
+        elif self.has_member("page_tree"):
+            # Kernel < 4.17
+            return self.member("page_tree")
+
+        raise exceptions.VolatilityException("Unsupported page cache tree")
+
+
+class page(objects.StructType):
+    @property
+    @functools.lru_cache()
+    def pageflags_enum(self) -> Dict:
+        """Returns 'pageflags' enumeration key/values
+
+        Returns:
+            A dictionary with the pageflags enumeration key/values
+        """
+        # FIXME: It would be even better to use @functools.cached_property instead,
+        # however, this requires Python +3.8
+        try:
+            pageflags_enum = self._context.symbol_space.get_enumeration(
+                self.get_symbol_table_name() + constants.BANG + "pageflags"
+            ).choices
+        except exceptions.SymbolError:
+            vollog.debug(
+                "Unable to find pageflags enum. This can happen in kernels < 2.6.26 or wrong ISF"
+            )
+            # set to empty dict to show that the enum was not found, and so shouldn't be searched for again
+            pageflags_enum = {}
+
+        return pageflags_enum
+
+    def get_flags_list(self) -> List[str]:
+        """Returns a list of page flags
+
+        Returns:
+            List of page flags
+        """
+        flags = []
+        for name, value in self.pageflags_enum.items():
+            if self.flags & (1 << value) != 0:
+                flags.append(name)
+
+        return flags
+
+    def to_paddr(self) -> int:
+        """Converts a page's virtual address to its physical address using the current physical memory model.
+
+        Returns:
+            int: page physical address
+        """
+        vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self)
+        vmlinux_layer = vmlinux.context.layers[vmlinux.layer_name]
+
+        vmemmap_start = None
+        if vmlinux.has_symbol("mem_section"):
+            # SPARSEMEM_VMEMMAP physical memory model: memmap is virtually contiguous
+            if vmlinux.has_symbol("vmemmap_base"):
+                # CONFIG_DYNAMIC_MEMORY_LAYOUT - KASLR kernels >= 4.9
+                vmemmap_start = vmlinux.object_from_symbol("vmemmap_base")
+            else:
+                # !CONFIG_DYNAMIC_MEMORY_LAYOUT
+                if vmlinux_layer._maxvirtaddr < 57:
+                    # 4-Level paging -> VMEMMAP_START = __VMEMMAP_BASE_L4
+                    vmemmap_base_l4 = 0xFFFFEA0000000000
+                    vmemmap_start = vmemmap_base_l4
+                else:
+                    # 5-Level paging -> VMEMMAP_START = __VMEMMAP_BASE_L5
+                    # FIXME: Once 5-level paging is supported, uncomment the following lines and remove the exception
+                    # vmemmap_base_l5 = 0xFFD4000000000000
+                    # vmemmap_start = vmemmap_base_l5
+                    raise exceptions.VolatilityException(
+                        "5-level paging is not yet supported"
+                    )
+
+        elif vmlinux.has_symbol("mem_map"):
+            # FLATMEM physical memory model, typically 32bit
+            vmemmap_start = vmlinux.object_from_symbol("mem_map")
+
+        elif vmlinux.has_symbol("node_data"):
+            raise exceptions.VolatilityException("NUMA systems are not yet supported")
+        else:
+            raise exceptions.VolatilityException("Unsupported Linux memory model")
+
+        if not vmemmap_start:
+            raise exceptions.VolatilityException(
+                "Something went wrong, we shouldn't be here"
+            )
+
+        page_type_size = vmlinux.get_type("page").size
+        pagec = vmlinux_layer.canonicalize(self.vol.offset)
+        pfn = (pagec - vmemmap_start) // page_type_size
+        page_paddr = pfn * vmlinux_layer.page_size
+
+        return page_paddr
+
+    def get_content(self) -> Union[str, None]:
+        """Returns the page content
+
+        Returns:
+            The page content
+        """
+        vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self)
+        vmlinux_layer = vmlinux.context.layers[vmlinux.layer_name]
+        physical_layer = vmlinux.context.layers["memory_layer"]
+        page_paddr = self.to_paddr()
+        if not page_paddr:
+            return None
+
+        page_data = physical_layer.read(page_paddr, vmlinux_layer.page_size)
+        return page_data
+
+
+class IDR(objects.StructType):
+    IDR_BITS = 8
+    IDR_MASK = (1 << IDR_BITS) - 1
+    INT_SIZE = 4
+    MAX_IDR_SHIFT = INT_SIZE * 8 - 1
+    MAX_IDR_BIT = 1 << MAX_IDR_SHIFT
+
+    def idr_max(self, num_layers: int) -> int:
+        """Returns the maximum ID which can be allocated given idr::layers
+
+        Args:
+            num_layers: Number of layers
+
+        Returns:
+            Maximum ID for a given number of layers
+        """
+        # Kernel < 4.17
+        bits = min([self.INT_SIZE, num_layers * self.IDR_BITS, self.MAX_IDR_SHIFT])
+
+        return (1 << bits) - 1
+
+    def idr_find(self, idr_id: int) -> int:
+        """Finds an ID within the IDR data structure.
+        Based on idr_find_slowpath(), 3.9 <= Kernel < 4.11
+        Args:
+            idr_id: The IDR lookup ID
+
+        Returns:
+            A pointer to the given ID element
+        """
+        vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self)
+        if not vmlinux.get_type("idr_layer").has_member("layer"):
+            vollog.info(
+                "Unsupported IDR implementation, it should be a very very old kernel, probabably < 2.6"
+            )
+            return None
+
+        if idr_id < 0:
+            return None
+
+        idr_layer = self.top
+        if not idr_layer:
+            return None
+
+        n = (idr_layer.layer + 1) * self.IDR_BITS
+
+        if idr_id > self.idr_max(idr_layer.layer + 1):
+            return None
+
+        assert n != 0
+
+        while n > 0 and idr_layer:
+            n -= self.IDR_BITS
+            assert n == idr_layer.layer * self.IDR_BITS
+            idr_layer = idr_layer.ary[(idr_id >> n) & self.IDR_MASK]
+
+        return idr_layer
+
+    def _old_kernel_get_entries(self) -> Iterable[int]:
+        # Kernels < 4.11
+        cur = self.cur
+        total = next_id = 0
+        while next_id < cur:
+            entry = self.idr_find(next_id)
+            if entry:
+                yield entry
+                total += 1
+
+            next_id += 1
+
+    def _new_kernel_get_entries(self) -> Iterable[int]:
+        # Kernels >= 4.11
+        id_storage = linux.IDStorage.choose_id_storage(
+            self._context, kernel_module_name="kernel"
+        )
+        for page_addr in id_storage.get_entries(root=self.idr_rt):
+            yield page_addr
+
+    def get_entries(self) -> Iterable[int]:
+        """Walks the IDR and yield a pointer associated with each element.
+
+        Args:
+            in_use (int, optional): _description_. Defaults to 0.
+
+        Yields:
+            A pointer associated with each element.
+        """
+        if self.has_member("idr_rt"):
+            # Kernels >= 4.11
+            get_entries_func = self._new_kernel_get_entries
+        else:
+            # Kernels < 4.11
+            get_entries_func = self._old_kernel_get_entries
+
+        for page_addr in get_entries_func():
+            yield page_addr
+
+
+class rb_root(objects.StructType):
+    def _walk_nodes(self, root_node) -> Iterator[int]:
+        """Traverses the Red-Black tree from the root node and yields a pointer to each
+        node in this tree.
+
+        Args:
+            root_node: A Red-Black tree node from which to start descending
+
+        Yields:
+            A pointer to every node descending from the specified root node
+        """
+        if not root_node:
+            return
+
+        yield root_node
+        yield from self._walk_nodes(root_node.rb_left)
+        yield from self._walk_nodes(root_node.rb_right)
+
+    def get_nodes(self) -> Iterator[int]:
+        """Yields a pointer to each node in the Red-Black tree
+
+        Yields:
+            A pointer to every node in the Red-Black tree
+        """
+
+        yield from self._walk_nodes(root_node=self.rb_node)
diff --git a/volatility3/framework/symbols/metadata.py b/volatility3/framework/symbols/metadata.py
index 149829371..95f542f07 100644
--- a/volatility3/framework/symbols/metadata.py
+++ b/volatility3/framework/symbols/metadata.py
@@ -24,8 +24,8 @@ class ProducerMetadata(interfaces.symbols.MetadataInterface):
         version = self._json_data.get("version", None)
         if not version:
             return None
-        if all([x in "0123456789." for x in version]):
-            return tuple([int(x) for x in version.split(".")])
+        if all(x in "0123456789." for x in version):
+            return tuple(int(x) for x in version.split("."))
         vollog.log(
             constants.LOGLEVEL_VVVV,
             f"Metadata version contains unexpected characters: '{version}'",
diff --git a/volatility3/framework/symbols/windows/consoles/consoles-win10-17763-3232-x64.json b/volatility3/framework/symbols/windows/consoles/consoles-win10-17763-3232-x64.json
new file mode 100644
index 000000000..13382c7ee
--- /dev/null
+++ b/volatility3/framework/symbols/windows/consoles/consoles-win10-17763-3232-x64.json
@@ -0,0 +1,659 @@
+{
+    "symbols": {}, 
+    "enums": {},
+    "base_types": {
+        "unsigned long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned char": {
+            "kind": "char",
+            "size": 1,
+            "signed": false,
+            "endian": "little"
+        },
+        "pointer": {
+            "kind": "int",
+            "size": 8,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned int": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "short": {
+            "kind": "int",
+            "size": 2,
+            "signed": true,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        }
+    },
+    "user_types": {
+        "_CONSOLE_INFORMATION": {
+            "fields": {
+                "ScreenX": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 32
+                },
+                "ScreenY": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 34
+                },
+                "CommandHistorySize": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 144
+                },
+                "HistoryBufferMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 148
+                },
+                "OriginalTitle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 1736
+                },
+                "Title": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 1672
+                },
+                "GetScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 1800
+                },
+                "CurrentScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 1384
+                },
+                "ConsoleProcessList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 1360
+                },
+                "ProcessCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 1368
+                },
+                "HistoryList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": -760
+                },
+                "HistoryBufferCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": -752
+                },
+                "ExeAliasList": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 1392
+                }
+            },
+            "kind": "struct",
+            "size": 140
+        },
+        "_VECTOR": {
+            "fields": {
+                "Begin": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 0
+                },
+                "End": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 8
+                },
+                "EndCapacity": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned long"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned char"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Pointer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Length": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 16
+                },
+                "Allocated": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 24
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        },
+        "_CONSOLE_PROCESS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ConsoleProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_CONSOLE_PROCESS_HANDLE": {
+            "fields": {
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 52
+        },
+        "_CONSOLE_PROCESS": {
+            "fields": {
+                "ProcessId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 28
+                },
+                "ThreadId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 32
+                },
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND_HISTORY": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "CommandBucket": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_VECTOR"
+                    },
+                    "offset": 16
+                },
+                "CommandCountMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 40
+                },
+                "Application": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                },
+                "ConsoleProcessHandle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS_HANDLE"
+                        }
+                    },
+                    "offset": 80
+                },
+                "Flags": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 88
+                },
+                "LastDisplayed": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 92
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_SCREEN_INFORMATION": {
+            "fields": {
+                "TextBufferInfo": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 56
+                },
+                "Next": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 64
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_ROW_POINTER": {
+            "fields": {
+                "Row": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+
+        },
+        "_ROWS_ARRAY": {
+            "fields": {
+                "Rows": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW_POINTER"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_TEXT_BUFFER_INFO": {
+            "fields": {
+                "BufferDeque": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_DEQUE"
+                        }
+                    },
+                    "offset": 0
+                },
+                "BufferRows": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROWS_ARRAY"
+                        }
+                    },
+                    "offset": 8
+                },
+                "BufferCapacity": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 32
+                },
+                "ThisBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 48
+                },
+                "BufferEnd": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 56
+                },
+                "BufferLastIndex": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 58
+                },
+                "BufferStart": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 112
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_CHAR_ROW_CELL": {
+            "fields": {
+                "Text": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_UNICODE_STRING"
+                    },
+                    "offset": 0
+                },
+                "DbcsAttribute": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 2
+                }
+             },
+            "kind": "struct",
+            "size": 3
+        },
+        "_CHAR_ROW_CELL_ARRAY": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_ROW": {
+            "fields": {
+                "CharRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL_ARRAY"
+                        }
+                    },
+                    "offset": 8
+                },
+                "RowLength": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 64
+                },
+                "Index": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 72
+                },
+                "RowLength2": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 80
+                },
+                "TextBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 88
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_DEQUE": {
+            "fields": {
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "void"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_EXE_ALIAS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ExeLength": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 8
+                },
+                "ExeName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 24
+                },
+                "AliasList": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 32
+                }
+            },
+            "kind": "struct",
+            "size": 48
+        },
+        "_ALIAS": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "Source": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "Target": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        }
+    },
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "Dave Lassalle",
+            "datetime": "2024-07-31T15:05:35-06:00"
+        },
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/consoles/consoles-win10-17763-x64.json b/volatility3/framework/symbols/windows/consoles/consoles-win10-17763-x64.json
new file mode 100644
index 000000000..f813691bc
--- /dev/null
+++ b/volatility3/framework/symbols/windows/consoles/consoles-win10-17763-x64.json
@@ -0,0 +1,659 @@
+{
+    "symbols": {}, 
+    "enums": {},
+    "base_types": {
+        "unsigned long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned char": {
+            "kind": "char",
+            "size": 1,
+            "signed": false,
+            "endian": "little"
+        },
+        "pointer": {
+            "kind": "int",
+            "size": 8,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned int": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "short": {
+            "kind": "int",
+            "size": 2,
+            "signed": true,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        }
+    },
+    "user_types": {
+        "_CONSOLE_INFORMATION": {
+            "fields": {
+                "ScreenX": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 32
+                },
+                "ScreenY": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 34
+                },
+                "CommandHistorySize": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 144
+                },
+                "HistoryBufferMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 148
+                },
+                "OriginalTitle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 1736
+                },
+                "Title": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 1672
+                },
+                "GetScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 1800
+                },
+                "CurrentScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 1384
+                },
+                "ConsoleProcessList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 1360
+                },
+                "ProcessCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 1368
+                },
+                "HistoryList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": -760
+                },
+                "HistoryBufferCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": -752
+                },
+                "ExeAliasList": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 1392
+                }
+            },
+            "kind": "struct",
+            "size": 140
+        },
+        "_VECTOR": {
+            "fields": {
+                "Begin": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 0
+                },
+                "End": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 8
+                },
+                "EndCapacity": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned long"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned char"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Pointer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Length": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 16
+                },
+                "Allocated": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 24
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        },
+        "_CONSOLE_PROCESS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ConsoleProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_CONSOLE_PROCESS_HANDLE": {
+            "fields": {
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 52
+        },
+        "_CONSOLE_PROCESS": {
+            "fields": {
+                "ProcessId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 28
+                },
+                "ThreadId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 32
+                },
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND_HISTORY": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "CommandBucket": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_VECTOR"
+                    },
+                    "offset": 16
+                },
+                "CommandCountMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 40
+                },
+                "Application": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                },
+                "ConsoleProcessHandle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS_HANDLE"
+                        }
+                    },
+                    "offset": 80
+                },
+                "Flags": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 88
+                },
+                "LastDisplayed": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 92
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_SCREEN_INFORMATION": {
+            "fields": {
+                "TextBufferInfo": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 32
+                },
+                "Next": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 36
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_ROW_POINTER": {
+            "fields": {
+                "Row": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+
+        },
+        "_ROWS_ARRAY": {
+            "fields": {
+                "Rows": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW_POINTER"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_TEXT_BUFFER_INFO": {
+            "fields": {
+                "BufferDeque": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_DEQUE"
+                        }
+                    },
+                    "offset": 0
+                },
+                "BufferRows": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROWS_ARRAY"
+                        }
+                    },
+                    "offset": 8
+                },
+                "BufferCapacity": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 32
+                },
+                "ThisBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 48
+                },
+                "BufferEnd": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 56
+                },
+                "BufferLastIndex": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 58
+                },
+                "BufferStart": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 112
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_CHAR_ROW_CELL": {
+            "fields": {
+                "Text": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_UNICODE_STRING"
+                    },
+                    "offset": 0
+                },
+                "DbcsAttribute": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 2
+                }
+             },
+            "kind": "struct",
+            "size": 3
+        },
+        "_CHAR_ROW_CELL_ARRAY": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_ROW": {
+            "fields": {
+                "CharRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL_ARRAY"
+                        }
+                    },
+                    "offset": 8
+                },
+                "RowLength": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 64
+                },
+                "Index": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 72
+                },
+                "RowLength2": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 80
+                },
+                "TextBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 88
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_DEQUE": {
+            "fields": {
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "void"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_EXE_ALIAS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ExeLength": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 16
+                },
+                "ExeName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 24
+                },
+                "AliasList": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 32
+                }
+            },
+            "kind": "struct",
+            "size": 48
+        },
+        "_ALIAS": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "Source": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "Target": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        }
+    },
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "Dave Lassalle",
+            "datetime": "2024-07-31T15:05:35-06:00"
+        },
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/consoles/consoles-win10-18362-x64.json b/volatility3/framework/symbols/windows/consoles/consoles-win10-18362-x64.json
new file mode 100644
index 000000000..85ef9d718
--- /dev/null
+++ b/volatility3/framework/symbols/windows/consoles/consoles-win10-18362-x64.json
@@ -0,0 +1,649 @@
+{
+    "symbols": {}, 
+    "enums": {},
+    "base_types": {
+        "unsigned long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned char": {
+            "kind": "char",
+            "size": 1,
+            "signed": false,
+            "endian": "little"
+        },
+        "pointer": {
+            "kind": "int",
+            "size": 8,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned int": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "short": {
+            "kind": "int",
+            "size": 2,
+            "signed": true,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        }
+    },
+    "user_types": {
+        "_CONSOLE_INFORMATION": {
+            "fields": {
+                "ScreenX": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 32
+                },
+                "ScreenY": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 34
+                },
+                "CommandHistorySize": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 144
+                },
+                "HistoryBufferMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 148
+                },
+                "OriginalTitle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 1744
+                },
+                "Title": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 1680
+                },
+                "GetScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 1808
+                },
+                "CurrentScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 1392
+                },
+                "ConsoleProcessList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 1368
+                },
+                "ProcessCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 1376
+                },
+                "HistoryList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": -768
+                },
+                "HistoryBufferCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": -760
+                },
+                "ExeAliasList": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": -856
+                }
+            },
+            "kind": "struct",
+            "size": 140
+        },
+        "_VECTOR": {
+            "fields": {
+                "Begin": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 0
+                },
+                "End": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 8
+                },
+                "EndCapacity": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned long"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned char"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Pointer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Length": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 16
+                },
+                "Allocated": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 24
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        },
+        "_CONSOLE_PROCESS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ConsoleProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_CONSOLE_PROCESS_HANDLE": {
+            "fields": {
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 52
+        },
+        "_CONSOLE_PROCESS": {
+            "fields": {
+                "ProcessId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 28
+                },
+                "ThreadId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 32
+                },
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND_HISTORY": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "CommandBucket": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_VECTOR"
+                    },
+                    "offset": 16
+                },
+                "CommandCountMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 40
+                },
+                "Application": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                },
+                "ConsoleProcessHandle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS_HANDLE"
+                        }
+                    },
+                    "offset": 80
+                },
+                "Flags": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 88
+                },
+                "LastDisplayed": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 92
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_SCREEN_INFORMATION": {
+            "fields": {
+                "TextBufferInfo": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 56
+                },
+                "Next": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 64
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_ROW_POINTER": {
+            "fields": {
+                "Row": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+
+        },
+        "_ROWS_ARRAY": {
+            "fields": {
+                "Rows": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW_POINTER"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_TEXT_BUFFER_INFO": {
+            "fields": {
+                "BufferDeque": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_DEQUE"
+                        }
+                    },
+                    "offset": 0
+                },
+                "BufferRows": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROWS_ARRAY"
+                        }
+                    },
+                    "offset": 8
+                },
+                "BufferCapacity": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 32
+                },
+                "BufferEnd": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 56
+                },
+                "BufferLastIndex": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 58
+                },
+                "BufferStart": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 88
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_CHAR_ROW_CELL": {
+            "fields": {
+                "Text": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_UNICODE_STRING"
+                    },
+                    "offset": 0
+                },
+                "DbcsAttribute": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 2
+                }
+             },
+            "kind": "struct",
+            "size": 3
+        },
+        "_CHAR_ROW_CELL_ARRAY": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_ROW": {
+            "fields": {
+                "CharRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL_ARRAY"
+                        }
+                    },
+                    "offset": 8
+                },
+                "RowLength": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 64
+                },
+                "Index": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 72
+                },
+                "RowLength2": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 80
+                },
+                "TextBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 88
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_DEQUE": {
+            "fields": {
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "void"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_EXE_ALIAS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ExeLength": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 8
+                },
+                "ExeName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 24
+                },
+                "AliasList": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 32
+                }
+            },
+            "kind": "struct",
+            "size": 48
+        },
+        "_ALIAS": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "Source": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "Target": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        }
+    },
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "Dave Lassalle",
+            "datetime": "2024-07-31T15:05:35-06:00"
+        },
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/consoles/consoles-win10-19041-x64.json b/volatility3/framework/symbols/windows/consoles/consoles-win10-19041-x64.json
new file mode 100644
index 000000000..8f6dd8c6a
--- /dev/null
+++ b/volatility3/framework/symbols/windows/consoles/consoles-win10-19041-x64.json
@@ -0,0 +1,649 @@
+{
+    "symbols": {},
+    "enums": {},
+    "base_types": {
+        "unsigned long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned char": {
+            "kind": "char",
+            "size": 1,
+            "signed": false,
+            "endian": "little"
+        },
+        "pointer": {
+            "kind": "int",
+            "size": 8,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned int": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "short": {
+            "kind": "int",
+            "size": 2,
+            "signed": true,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        }
+    },
+    "user_types": {
+        "_CONSOLE_INFORMATION": {
+            "fields": {
+                "ScreenX": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 32
+                },
+                "ScreenY": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 34
+                },
+                "CommandHistorySize": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 144
+                },
+                "HistoryBufferMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 148
+                },
+                "OriginalTitle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 1752
+                },
+                "Title": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 1688
+                },
+                "GetScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 1816
+                },
+                "CurrentScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 1392
+                },
+                "ConsoleProcessList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 1368
+                },
+                "ProcessCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 1376
+                },
+                "HistoryList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": -352
+                },
+                "HistoryBufferCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": -344
+                },
+                "ExeAliasList": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 1436
+                }
+            },
+            "kind": "struct",
+            "size": 140
+        },
+        "_VECTOR": {
+            "fields": {
+                "Begin": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 0
+                },
+                "End": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 8
+                },
+                "EndCapacity": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned long"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned char"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Pointer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Length": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 16
+                },
+                "Allocated": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 24
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        },
+        "_CONSOLE_PROCESS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ConsoleProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_CONSOLE_PROCESS_HANDLE": {
+            "fields": {
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 52
+        },
+        "_CONSOLE_PROCESS": {
+            "fields": {
+                "ProcessId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 28
+                },
+                "ThreadId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 32
+                },
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND_HISTORY": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "CommandBucket": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_VECTOR"
+                    },
+                    "offset": 16
+                },
+                "CommandCountMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 40
+                },
+                "Application": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                },
+                "ConsoleProcessHandle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS_HANDLE"
+                        }
+                    },
+                    "offset": 80
+                },
+                "Flags": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 88
+                },
+                "LastDisplayed": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 92
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_SCREEN_INFORMATION": {
+            "fields": {
+                "TextBufferInfo": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 56
+                },
+                "Next": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 64
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_ROW_POINTER": {
+            "fields": {
+                "Row": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+
+        },
+        "_ROWS_ARRAY": {
+            "fields": {
+                "Rows": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW_POINTER"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_TEXT_BUFFER_INFO": {
+            "fields": {
+                "BufferDeque": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_DEQUE"
+                        }
+                    },
+                    "offset": 0
+                },
+                "BufferRows": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROWS_ARRAY"
+                        }
+                    },
+                    "offset": 8
+                },
+                "BufferCapacity": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 32
+                },
+                "BufferEnd": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 56
+                },
+                "BufferLastIndex": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 58
+                },
+                "BufferStart": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 88
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_CHAR_ROW_CELL": {
+            "fields": {
+                "Text": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_UNICODE_STRING"
+                    },
+                    "offset": 0
+                },
+                "DbcsAttribute": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 2
+                }
+             },
+            "kind": "struct",
+            "size": 3
+        },
+        "_CHAR_ROW_CELL_ARRAY": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_ROW": {
+            "fields": {
+                "CharRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL_ARRAY"
+                        }
+                    },
+                    "offset": 8
+                },
+                "RowLength": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 64
+                },
+                "Index": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 72
+                },
+                "RowLength2": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 80
+                },
+                "TextBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 88
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_DEQUE": {
+            "fields": {
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "void"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_EXE_ALIAS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ExeLength": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 8
+                },
+                "ExeName": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 24
+                },
+                "AliasList": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 32
+                }
+            },
+            "kind": "struct",
+            "size": 48
+        },
+        "_ALIAS": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "Source": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "Target": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        }
+    },
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "Dave Lassalle",
+            "datetime": "2024-07-31T15:05:35-06:00"
+        },
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/consoles/consoles-win10-20348-1970-x64.json b/volatility3/framework/symbols/windows/consoles/consoles-win10-20348-1970-x64.json
new file mode 100644
index 000000000..8357ece4a
--- /dev/null
+++ b/volatility3/framework/symbols/windows/consoles/consoles-win10-20348-1970-x64.json
@@ -0,0 +1,655 @@
+{
+    "symbols": {}, 
+    "enums": {},
+    "base_types": {
+        "unsigned long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned char": {
+            "kind": "char",
+            "size": 1,
+            "signed": false,
+            "endian": "little"
+        },
+        "pointer": {
+            "kind": "int",
+            "size": 8,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned int": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "short": {
+            "kind": "int",
+            "size": 2,
+            "signed": true,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        }
+    },
+    "user_types": {
+        "_CONSOLE_INFORMATION": {
+            "fields": {
+                "ScreenX": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 24
+                },
+                "ScreenY": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 26
+                },
+                "CommandHistorySize": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 136
+                },
+                "HistoryBufferMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 140
+                },
+                "OriginalTitle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 1616
+                },
+                "Title": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 1552
+                },
+                "GetScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 1680
+                },
+                "CurrentScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 1296
+                },
+                "ConsoleProcessList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 1272
+                },
+                "ProcessCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 1280
+                },
+                "HistoryList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 9320
+                },
+                "HistoryBufferCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 9328
+                },
+                "ExeAliasList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 2410
+                }
+            },
+            "kind": "struct",
+            "size": 140
+        },
+        "_VECTOR": {
+            "fields": {
+                "Begin": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 0
+                },
+                "End": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 8
+                },
+                "EndCapacity": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned long"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned char"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Pointer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Length": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 16
+                },
+                "Allocated": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 24
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        },
+        "_CONSOLE_PROCESS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ConsoleProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_CONSOLE_PROCESS_HANDLE": {
+            "fields": {
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 52
+        },
+        "_CONSOLE_PROCESS": {
+            "fields": {
+                "ProcessId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 28
+                },
+                "ThreadId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 32
+                },
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND_HISTORY": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "CommandBucket": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_VECTOR"
+                    },
+                    "offset": 16
+                },
+                "CommandCountMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 40
+                },
+                "Application": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                },
+                "ConsoleProcessHandle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS_HANDLE"
+                        }
+                    },
+                    "offset": 80
+                },
+                "Flags": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 88
+                },
+                "LastDisplayed": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 92
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_SCREEN_INFORMATION": {
+            "fields": {
+                "TextBufferInfo": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 56
+                },
+                "Next": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 64
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_ROW_POINTER": {
+            "fields": {
+                "Row": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+
+        },
+        "_ROWS_ARRAY": {
+            "fields": {
+                "Rows": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW_POINTER"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_TEXT_BUFFER_INFO": {
+            "fields": {
+                "BufferDeque": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_DEQUE"
+                        }
+                    },
+                    "offset": 0
+                },
+                "BufferRows": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROWS_ARRAY"
+                        }
+                    },
+                    "offset": 16
+                },
+                "BufferCapacity": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 40
+                },
+                "ThisBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 48
+                },
+                "BufferEnd": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 54
+                },
+                "BufferLastIndex": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 56
+                },
+                "BufferStart": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 96
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_CHAR_ROW_CELL": {
+            "fields": {
+                "Text": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_UNICODE_STRING"
+                    },
+                    "offset": 0
+                },
+                "DbcsAttribute": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 2
+                }
+             },
+            "kind": "struct",
+            "size": 3
+        },
+        "_CHAR_ROW_CELL_ARRAY": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_ROW": {
+            "fields": {
+                "CharRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL_ARRAY"
+                        }
+                    },
+                    "offset": 8
+                },
+                "RowLength": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 64
+                },
+                "Index": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 72
+                },
+                "RowLength2": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 80
+                },
+                "TextBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 88
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_DEQUE": {
+            "fields": {
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "void"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_EXE_ALIAS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ExeName": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "AliasList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 56
+                }
+            },
+            "kind": "struct",
+            "size": 64
+        },
+        "_ALIAS": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "Source": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "Target": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        }
+    },
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "Dave Lassalle",
+            "datetime": "2024-07-31T15:05:35-06:00"
+        },
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/consoles/consoles-win10-20348-2461-x64.json b/volatility3/framework/symbols/windows/consoles/consoles-win10-20348-2461-x64.json
new file mode 100644
index 000000000..f80a99148
--- /dev/null
+++ b/volatility3/framework/symbols/windows/consoles/consoles-win10-20348-2461-x64.json
@@ -0,0 +1,655 @@
+{
+    "symbols": {}, 
+    "enums": {},
+    "base_types": {
+        "unsigned long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned char": {
+            "kind": "char",
+            "size": 1,
+            "signed": false,
+            "endian": "little"
+        },
+        "pointer": {
+            "kind": "int",
+            "size": 8,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned int": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "short": {
+            "kind": "int",
+            "size": 2,
+            "signed": true,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        }
+    },
+    "user_types": {
+        "_CONSOLE_INFORMATION": {
+            "fields": {
+                "ScreenX": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 24
+                },
+                "ScreenY": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 26
+                },
+                "CommandHistorySize": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 136
+                },
+                "HistoryBufferMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 140
+                },
+                "OriginalTitle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 1616
+                },
+                "Title": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 1552
+                },
+                "GetScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 1680
+                },
+                "CurrentScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 1296
+                },
+                "ConsoleProcessList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 1272
+                },
+                "ProcessCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 1280
+                },
+                "HistoryList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 9176
+                },
+                "HistoryBufferCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 9184
+                },
+                "ExeAliasList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 9232
+                }
+            },
+            "kind": "struct",
+            "size": 140
+        },
+        "_VECTOR": {
+            "fields": {
+                "Begin": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 0
+                },
+                "End": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 8
+                },
+                "EndCapacity": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned long"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned char"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Pointer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Length": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 16
+                },
+                "Allocated": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 24
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        },
+        "_CONSOLE_PROCESS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ConsoleProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_CONSOLE_PROCESS_HANDLE": {
+            "fields": {
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 52
+        },
+        "_CONSOLE_PROCESS": {
+            "fields": {
+                "ProcessId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 28
+                },
+                "ThreadId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 32
+                },
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND_HISTORY": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "CommandBucket": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_VECTOR"
+                    },
+                    "offset": 16
+                },
+                "CommandCountMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 40
+                },
+                "Application": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                },
+                "ConsoleProcessHandle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS_HANDLE"
+                        }
+                    },
+                    "offset": 80
+                },
+                "Flags": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 88
+                },
+                "LastDisplayed": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 92
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_SCREEN_INFORMATION": {
+            "fields": {
+                "TextBufferInfo": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 56
+                },
+                "Next": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 64
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_ROW_POINTER": {
+            "fields": {
+                "Row": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+
+        },
+        "_ROWS_ARRAY": {
+            "fields": {
+                "Rows": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW_POINTER"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_TEXT_BUFFER_INFO": {
+            "fields": {
+                "BufferDeque": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_DEQUE"
+                        }
+                    },
+                    "offset": 0
+                },
+                "BufferRows": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROWS_ARRAY"
+                        }
+                    },
+                    "offset": 16
+                },
+                "BufferCapacity": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 40
+                },
+                "ThisBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 48
+                },
+                "BufferEnd": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 54
+                },
+                "BufferLastIndex": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 56
+                },
+                "BufferStart": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 96
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_CHAR_ROW_CELL": {
+            "fields": {
+                "Text": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_UNICODE_STRING"
+                    },
+                    "offset": 0
+                },
+                "DbcsAttribute": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 2
+                }
+             },
+            "kind": "struct",
+            "size": 3
+        },
+        "_CHAR_ROW_CELL_ARRAY": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_ROW": {
+            "fields": {
+                "CharRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL_ARRAY"
+                        }
+                    },
+                    "offset": 8
+                },
+                "RowLength": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 64
+                },
+                "Index": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 72
+                },
+                "RowLength2": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 80
+                },
+                "TextBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 88
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_DEQUE": {
+            "fields": {
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "void"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_EXE_ALIAS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ExeName": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "AliasList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 56
+                }
+            },
+            "kind": "struct",
+            "size": 64
+        },
+        "_ALIAS": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "Source": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "Target": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        }
+    },
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "Dave Lassalle",
+            "datetime": "2024-07-31T15:05:35-06:00"
+        },
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/consoles/consoles-win10-20348-x64.json b/volatility3/framework/symbols/windows/consoles/consoles-win10-20348-x64.json
new file mode 100644
index 000000000..5c7fc8473
--- /dev/null
+++ b/volatility3/framework/symbols/windows/consoles/consoles-win10-20348-x64.json
@@ -0,0 +1,655 @@
+{
+    "symbols": {}, 
+    "enums": {},
+    "base_types": {
+        "unsigned long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned char": {
+            "kind": "char",
+            "size": 1,
+            "signed": false,
+            "endian": "little"
+        },
+        "pointer": {
+            "kind": "int",
+            "size": 8,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned int": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "short": {
+            "kind": "int",
+            "size": 2,
+            "signed": true,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        }
+    },
+    "user_types": {
+        "_CONSOLE_INFORMATION": {
+            "fields": {
+                "ScreenX": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 24
+                },
+                "ScreenY": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 26
+                },
+                "CommandHistorySize": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 136
+                },
+                "HistoryBufferMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 140
+                },
+                "OriginalTitle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 1616
+                },
+                "Title": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 1552
+                },
+                "GetScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 1680
+                },
+                "CurrentScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 1296
+                },
+                "ConsoleProcessList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 1272
+                },
+                "ProcessCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 1280
+                },
+                "HistoryList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": -288
+                },
+                "HistoryBufferCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": -280
+                },
+                "ExeAliasList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": -376
+                }
+            },
+            "kind": "struct",
+            "size": 140
+        },
+        "_VECTOR": {
+            "fields": {
+                "Begin": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 0
+                },
+                "End": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 8
+                },
+                "EndCapacity": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned long"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned char"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Pointer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Length": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 16
+                },
+                "Allocated": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 24
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        },
+        "_CONSOLE_PROCESS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ConsoleProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_CONSOLE_PROCESS_HANDLE": {
+            "fields": {
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 52
+        },
+        "_CONSOLE_PROCESS": {
+            "fields": {
+                "ProcessId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 28
+                },
+                "ThreadId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 32
+                },
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND_HISTORY": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "CommandBucket": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_VECTOR"
+                    },
+                    "offset": 16
+                },
+                "CommandCountMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 40
+                },
+                "Application": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                },
+                "ConsoleProcessHandle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS_HANDLE"
+                        }
+                    },
+                    "offset": 80
+                },
+                "Flags": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 88
+                },
+                "LastDisplayed": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 92
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_SCREEN_INFORMATION": {
+            "fields": {
+                "TextBufferInfo": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 56
+                },
+                "Next": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 64
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_ROW_POINTER": {
+            "fields": {
+                "Row": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+
+        },
+        "_ROWS_ARRAY": {
+            "fields": {
+                "Rows": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW_POINTER"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_TEXT_BUFFER_INFO": {
+            "fields": {
+                "BufferDeque": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_DEQUE"
+                        }
+                    },
+                    "offset": 0
+                },
+                "BufferRows": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROWS_ARRAY"
+                        }
+                    },
+                    "offset": 16
+                },
+                "BufferCapacity": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 40
+                },
+                "ThisBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 48
+                },
+                "BufferEnd": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 54
+                },
+                "BufferLastIndex": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 56
+                },
+                "BufferStart": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 96
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_CHAR_ROW_CELL": {
+            "fields": {
+                "Text": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_UNICODE_STRING"
+                    },
+                    "offset": 0
+                },
+                "DbcsAttribute": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 2
+                }
+             },
+            "kind": "struct",
+            "size": 3
+        },
+        "_CHAR_ROW_CELL_ARRAY": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_ROW": {
+            "fields": {
+                "CharRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL_ARRAY"
+                        }
+                    },
+                    "offset": 8
+                },
+                "RowLength": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 64
+                },
+                "Index": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 72
+                },
+                "RowLength2": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 80
+                },
+                "TextBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 88
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_DEQUE": {
+            "fields": {
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "void"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_EXE_ALIAS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ExeName": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "AliasList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 56
+                }
+            },
+            "kind": "struct",
+            "size": 64
+        },
+        "_ALIAS": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "Source": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "Target": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        }
+    },
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "Dave Lassalle",
+            "datetime": "2024-07-31T15:05:35-06:00"
+        },
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/consoles/consoles-win10-22000-x64.json b/volatility3/framework/symbols/windows/consoles/consoles-win10-22000-x64.json
new file mode 100644
index 000000000..cf38d3e14
--- /dev/null
+++ b/volatility3/framework/symbols/windows/consoles/consoles-win10-22000-x64.json
@@ -0,0 +1,681 @@
+{
+    "symbols": {},
+    "enums": {},
+    "base_types": {
+        "unsigned long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned char": {
+            "kind": "char",
+            "size": 1,
+            "signed": false,
+            "endian": "little"
+        },
+        "pointer": {
+            "kind": "int",
+            "size": 8,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned int": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "short": {
+            "kind": "int",
+            "size": 2,
+            "signed": true,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        }
+    },
+    "user_types": {
+        "_CONSOLE_INFORMATION": {
+            "fields": {
+                "ScreenX": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 24
+                },
+                "ScreenY": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 26
+                },
+                "CommandHistorySize": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 136
+                },
+                "HistoryBufferMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 140
+                },
+                "OriginalTitle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 1648
+                },
+                "Title": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 1616
+                },
+                "GetScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 1664
+                },
+                "CurrentScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 1296
+                },
+                "ConsoleProcessList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 1272
+                },
+                "ProcessCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 1280
+                },
+                "HistoryList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": -920
+                },
+                "HistoryBufferCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": -912
+                },
+                "ExeAliasList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": -1008
+                }
+            },
+            "kind": "struct",
+            "size": 140
+        },
+        "_VECTOR": {
+            "fields": {
+                "Begin": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 0
+                },
+                "End": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 8
+                },
+                "EndCapacity": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned long"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned char"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Pointer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Length": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 16
+                },
+                "Allocated": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 24
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        },
+        "_CONSOLE_PROCESS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ConsoleProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_CONSOLE_PROCESS_HANDLE": {
+            "fields": {
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 52
+        },
+        "_CONSOLE_PROCESS": {
+            "fields": {
+                "ProcessId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 28
+                },
+                "ThreadId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 32
+                },
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND_HISTORY": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "CommandBucket": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_VECTOR"
+                    },
+                    "offset": 16
+                },
+                "CommandCountMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 40
+                },
+                "Application": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                },
+                "ConsoleProcessHandle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS_HANDLE"
+                        }
+                    },
+                    "offset": 80
+                },
+                "Flags": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 88
+                },
+                "LastDisplayed": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 92
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_SCREEN_INFORMATION": {
+            "fields": {
+                "TextBufferInfo": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 56
+                },
+                "Next": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 64
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_ROW_POINTER": {
+            "fields": {
+                "Row": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_ROWS_ARRAY": {
+            "fields": {
+                "Rows": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_TEXT_BUFFER_INFO": {
+            "fields": {
+                "ScreenX": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 4
+                },
+                "ScreenY": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 6
+                },
+                "BufferRows": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROWS_ARRAY"
+                        }
+                    },
+                    "offset": 8
+                },
+                "BufferCapacity": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 6
+                },
+                "ThisBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 32
+                },
+                "FirstRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 8
+                },
+                "LastRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 16
+                },
+                "BufferStart": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 80
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_CHAR_ROW_CELL": {
+            "fields": {
+                "Text": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_UNICODE_STRING"
+                    },
+                    "offset": 0
+                },
+                "DbcsAttribute": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 2
+                }
+            },
+            "kind": "struct",
+            "size": 3
+        },
+        "_CHAR_ROW_CELL_ARRAY": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_ROW": {
+            "fields": {
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": -88
+                },
+                "CharRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL_ARRAY"
+                        }
+                    },
+                    "offset": 0
+                },
+                "RowLength": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": -18
+                },
+                "Index": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": -20
+                },
+                "RowLength2": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 8
+                },
+                "Allocated": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 16
+                },
+                "TextBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": -8
+                }
+            },
+            "kind": "struct",
+            "size": 480
+        },
+        "_DEQUE": {
+            "fields": {
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "void"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_EXE_ALIAS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ExeName": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "AliasList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 56
+                }
+            },
+            "kind": "struct",
+            "size": 64
+        },
+        "_ALIAS": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "Source": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "Target": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        }
+    },
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "Dave Lassalle",
+            "datetime": "2024-07-31T15:05:35-06:00"
+        },
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/consoles/consoles-win10-22621-3527-x64.json b/volatility3/framework/symbols/windows/consoles/consoles-win10-22621-3527-x64.json
new file mode 100644
index 000000000..a5bda0f35
--- /dev/null
+++ b/volatility3/framework/symbols/windows/consoles/consoles-win10-22621-3527-x64.json
@@ -0,0 +1,681 @@
+{
+    "symbols": {},
+    "enums": {},
+    "base_types": {
+        "unsigned long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned char": {
+            "kind": "char",
+            "size": 1,
+            "signed": false,
+            "endian": "little"
+        },
+        "pointer": {
+            "kind": "int",
+            "size": 8,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned int": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "short": {
+            "kind": "int",
+            "size": 2,
+            "signed": true,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        }
+    },
+    "user_types": {
+        "_CONSOLE_INFORMATION": {
+            "fields": {
+                "ScreenX": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 2400
+                },
+                "ScreenY": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 2402
+                },
+                "CommandHistorySize": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 2512
+                },
+                "HistoryBufferMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 2516
+                },
+                "OriginalTitle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 2944
+                },
+                "Title": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 2912
+                },
+                "GetScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 3008
+                },
+                "CurrentScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 2632
+                },
+                "ConsoleProcessList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 2608
+                },
+                "ProcessCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 2616
+                },
+                "HistoryList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 10640
+                },
+                "HistoryBufferCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 10648
+                },
+                "ExeAliasList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 10552
+                }
+            },
+            "kind": "struct",
+            "size": 140
+        },
+        "_VECTOR": {
+            "fields": {
+                "Begin": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 0
+                },
+                "End": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 8
+                },
+                "EndCapacity": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned long"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned char"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Pointer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Length": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 16
+                },
+                "Allocated": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 24
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        },
+        "_CONSOLE_PROCESS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ConsoleProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_CONSOLE_PROCESS_HANDLE": {
+            "fields": {
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 52
+        },
+        "_CONSOLE_PROCESS": {
+            "fields": {
+                "ProcessId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 28
+                },
+                "ThreadId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 32
+                },
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND_HISTORY": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "CommandBucket": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_VECTOR"
+                    },
+                    "offset": 16
+                },
+                "CommandCountMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 40
+                },
+                "Application": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                },
+                "ConsoleProcessHandle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS_HANDLE"
+                        }
+                    },
+                    "offset": 80
+                },
+                "Flags": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 88
+                },
+                "LastDisplayed": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 92
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_SCREEN_INFORMATION": {
+            "fields": {
+                "TextBufferInfo": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 56
+                },
+                "Next": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 64
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_ROW_POINTER": {
+            "fields": {
+                "Row": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_ROWS_ARRAY": {
+            "fields": {
+                "Rows": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_TEXT_BUFFER_INFO": {
+            "fields": {
+                "ScreenX": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 4
+                },
+                "ScreenY": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 6
+                },
+                "BufferRows": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROWS_ARRAY"
+                        }
+                    },
+                    "offset": 8
+                },
+                "BufferCapacity": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 6
+                },
+                "ThisBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 32
+                },
+                "FirstRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 8
+                },
+                "LastRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 16
+                },
+                "BufferStart": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 72
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_CHAR_ROW_CELL": {
+            "fields": {
+                "Text": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_UNICODE_STRING"
+                    },
+                    "offset": 0
+                },
+                "DbcsAttribute": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 2
+                }
+            },
+            "kind": "struct",
+            "size": 3
+        },
+        "_CHAR_ROW_CELL_ARRAY": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_ROW": {
+            "fields": {
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": -80
+                },
+                "CharRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL_ARRAY"
+                        }
+                    },
+                    "offset": 0
+                },
+                "RowLength": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 8
+                },
+                "Index": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": -20
+                },
+                "RowLength2": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 8
+                },
+                "Allocated": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 16
+                },
+                "TextBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": -16
+                }
+            },
+            "kind": "struct",
+            "size": 472
+        },
+        "_DEQUE": {
+            "fields": {
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "void"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_EXE_ALIAS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ExeName": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "AliasList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 56
+                }
+            },
+            "kind": "struct",
+            "size": 64
+        },
+        "_ALIAS": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "Source": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "Target": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        }
+    },
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "Dave Lassalle",
+            "datetime": "2024-07-31T15:05:35-06:00"
+        },
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/consoles/consoles-win10-22621-x64.json b/volatility3/framework/symbols/windows/consoles/consoles-win10-22621-x64.json
new file mode 100644
index 000000000..44f926a87
--- /dev/null
+++ b/volatility3/framework/symbols/windows/consoles/consoles-win10-22621-x64.json
@@ -0,0 +1,681 @@
+{
+    "symbols": {},
+    "enums": {},
+    "base_types": {
+        "unsigned long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned char": {
+            "kind": "char",
+            "size": 1,
+            "signed": false,
+            "endian": "little"
+        },
+        "pointer": {
+            "kind": "int",
+            "size": 8,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned int": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "short": {
+            "kind": "int",
+            "size": 2,
+            "signed": true,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        }
+    },
+    "user_types": {
+        "_CONSOLE_INFORMATION": {
+            "fields": {
+                "ScreenX": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 2400
+                },
+                "ScreenY": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 2402
+                },
+                "CommandHistorySize": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 2512
+                },
+                "HistoryBufferMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 2516
+                },
+                "OriginalTitle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 2944
+                },
+                "Title": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 2912
+                },
+                "GetScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 3008
+                },
+                "CurrentScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 2632
+                },
+                "ConsoleProcessList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 2608
+                },
+                "ProcessCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 2616
+                },
+                "HistoryList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 10664
+                },
+                "HistoryBufferCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 10672
+                },
+                "ExeAliasList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 10576
+                }
+            },
+            "kind": "struct",
+            "size": 140
+        },
+        "_VECTOR": {
+            "fields": {
+                "Begin": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 0
+                },
+                "End": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 8
+                },
+                "EndCapacity": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned long"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned char"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Pointer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Length": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 16
+                },
+                "Allocated": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 24
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        },
+        "_CONSOLE_PROCESS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ConsoleProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_CONSOLE_PROCESS_HANDLE": {
+            "fields": {
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 52
+        },
+        "_CONSOLE_PROCESS": {
+            "fields": {
+                "ProcessId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 28
+                },
+                "ThreadId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 32
+                },
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND_HISTORY": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "CommandBucket": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_VECTOR"
+                    },
+                    "offset": 16
+                },
+                "CommandCountMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 40
+                },
+                "Application": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                },
+                "ConsoleProcessHandle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS_HANDLE"
+                        }
+                    },
+                    "offset": 80
+                },
+                "Flags": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 88
+                },
+                "LastDisplayed": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 92
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_SCREEN_INFORMATION": {
+            "fields": {
+                "TextBufferInfo": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 56
+                },
+                "Next": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 64
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_ROW_POINTER": {
+            "fields": {
+                "Row": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_ROWS_ARRAY": {
+            "fields": {
+                "Rows": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_TEXT_BUFFER_INFO": {
+            "fields": {
+                "ScreenX": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 4
+                },
+                "ScreenY": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 6
+                },
+                "BufferRows": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROWS_ARRAY"
+                        }
+                    },
+                    "offset": 8
+                },
+                "BufferCapacity": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 6
+                },
+                "ThisBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 32
+                },
+                "FirstRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 8
+                },
+                "LastRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 16
+                },
+                "BufferStart": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 72
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_CHAR_ROW_CELL": {
+            "fields": {
+                "Text": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_UNICODE_STRING"
+                    },
+                    "offset": 0
+                },
+                "DbcsAttribute": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 2
+                }
+            },
+            "kind": "struct",
+            "size": 3
+        },
+        "_CHAR_ROW_CELL_ARRAY": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_ROW": {
+            "fields": {
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": -96
+                },
+                "CharRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL_ARRAY"
+                        }
+                    },
+                    "offset": 0
+                },
+                "RowLength": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 8
+                },
+                "Index": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": -20
+                },
+                "RowLength2": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 8
+                },
+                "Allocated": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 16
+                },
+                "TextBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": -8
+                }
+            },
+            "kind": "struct",
+            "size": 480
+        },
+        "_DEQUE": {
+            "fields": {
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "void"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_EXE_ALIAS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ExeName": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "AliasList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 56
+                }
+            },
+            "kind": "struct",
+            "size": 64
+        },
+        "_ALIAS": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "Source": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "Target": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        }
+    },
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "Dave Lassalle",
+            "datetime": "2024-07-31T15:05:35-06:00"
+        },
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/consoles/consoles-win10-25398-x64.json b/volatility3/framework/symbols/windows/consoles/consoles-win10-25398-x64.json
new file mode 100644
index 000000000..5e91d8824
--- /dev/null
+++ b/volatility3/framework/symbols/windows/consoles/consoles-win10-25398-x64.json
@@ -0,0 +1,682 @@
+{
+    "symbols": {}, 
+    "enums": {},
+    "base_types": {
+        "unsigned long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned char": {
+            "kind": "char",
+            "size": 1,
+            "signed": false,
+            "endian": "little"
+        },
+        "pointer": {
+            "kind": "int",
+            "size": 8,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned int": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        },
+        "unsigned short": {
+            "kind": "int",
+            "size": 2,
+            "signed": false,
+            "endian": "little"
+        },
+        "short": {
+            "kind": "int",
+            "size": 2,
+            "signed": true,
+            "endian": "little"
+        },
+        "long": {
+            "kind": "int",
+            "size": 4,
+            "signed": false,
+            "endian": "little"
+        }
+    },
+    "user_types": {
+        "_CONSOLE_INFORMATION": {
+            "fields": {
+                "ScreenX": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 2592
+                },
+                "ScreenY": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 2594
+                },
+                "CommandHistorySize": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 2704
+                },
+                "HistoryBufferMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 2708
+                },
+                "OriginalTitle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 3056
+                },
+                "Title": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 3120
+                },
+                "GetScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 3216
+                },
+                "CurrentScreenBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 2824
+                },
+                "ConsoleProcessList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 2800
+                },
+                "ProcessCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 2808
+                },
+                "HistoryList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": -360
+                },
+                "HistoryBufferCount": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": -352
+                },
+                "ExeAliasList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 3776
+                }
+            },
+            "kind": "struct",
+            "size": 140
+        },
+        "_VECTOR": {
+            "fields": {
+                "Begin": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 0
+                },
+                "End": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_COMMAND"
+                        }
+                    },
+                    "offset": 8
+                },
+                "EndCapacity": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned long"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "unsigned char"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Pointer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "string"
+                        }
+                    },
+                    "offset": 0
+                },
+                "Length": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 16
+                },
+                "Allocated": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 24
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        },
+        "_CONSOLE_PROCESS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ConsoleProcess": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS"
+                        }
+                    },
+                    "offset": 16
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_CONSOLE_PROCESS_HANDLE": {
+            "fields": {
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 52
+        },
+        "_CONSOLE_PROCESS": {
+            "fields": {
+                "ProcessId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 28
+                },
+                "ThreadId": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 32
+                },
+                "ProcessHandle": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 24
+        },
+        "_COMMAND_HISTORY": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "CommandBucket": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_VECTOR"
+                    },
+                    "offset": 16
+                },
+                "CommandCountMax": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 40
+                },
+                "Application": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                },
+                "ConsoleProcessHandle": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CONSOLE_PROCESS_HANDLE"
+                        }
+                    },
+                    "offset": 80
+                },
+                "Flags": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned short"
+                    },
+                    "offset": 88
+                },
+                "LastDisplayed": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 92
+                }
+            },
+            "kind": "struct",
+            "size": 96
+        },
+        "_SCREEN_INFORMATION": {
+            "fields": {
+                "TextBufferInfo": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 56
+                },
+                "Next": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_SCREEN_INFORMATION"
+                        }
+                    },
+                    "offset": 64
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_ROW_POINTER": {
+            "fields": {
+                "Row": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+
+        },
+        "_ROWS_ARRAY": {
+            "fields": {
+                "Rows": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW_POINTER"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_TEXT_BUFFER_INFO": {
+            "fields": {
+                "ScreenX": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 8
+                },
+                "ScreenY": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 10
+                },
+                "BufferRows": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROWS_ARRAY"
+                        }
+                    },
+                    "offset": 16
+                },
+                "BufferCapacity": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 10
+                },
+                "ThisBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": 40
+                },
+                "FirstRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 16
+                },
+                "LastRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": 24
+                },
+                "BufferStart": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 88
+                }
+            },
+            "kind": "struct",
+            "size": 72
+        },
+        "_CHAR_ROW_CELL": {
+            "fields": {
+                "Text": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_UNICODE_STRING"
+                    },
+                    "offset": 0
+                },
+                "DbcsAttribute": {
+                    "type": {
+                        "kind": "base",
+                        "name": "unsigned int"
+                    },
+                    "offset": 2
+                }
+             },
+            "kind": "struct",
+            "size": 3
+        },
+        "_CHAR_ROW_CELL_ARRAY": {
+            "fields": {
+                "Chars": {
+                    "type": {
+                        "count": 1,
+                        "kind": "array",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_ROW": {
+            "fields": {
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_ROW"
+                        }
+                    },
+                    "offset": -88
+                },
+                "CharRow": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_CHAR_ROW_CELL_ARRAY"
+                        }
+                    },
+                    "offset": 0
+                },
+                "RowLength": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 8
+                },
+                "Index": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": -20
+                },
+                "RowLength2": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 8
+                },
+                "Allocated": {
+                    "type": {
+                        "kind": "base",
+                        "name": "short"
+                    },
+                    "offset": 16
+                },
+                "TextBuffer": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "_TEXT_BUFFER_INFO"
+                        }
+                    },
+                    "offset": -8
+                }
+            },
+            "kind": "struct",
+            "size": 464
+        },
+        "_DEQUE": {
+            "fields": {
+                "Blink": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "base",
+                            "name": "void"
+                        }
+                    },
+                    "offset": 0
+                }
+            },
+            "kind": "struct",
+            "size": 8
+        },
+        "_EXE_ALIAS_LIST": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "ExeName": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "AliasList": {
+                    "type": {
+                        "kind": "pointer",
+                        "subtype": {
+                            "kind": "struct",
+                            "name": "nt_symbols!_LIST_ENTRY"
+                        }
+                    },
+                    "offset": 56
+                }
+            },
+            "kind": "struct",
+            "size": 64
+        },
+        "_ALIAS": {
+            "fields": {
+                "ListEntry": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "nt_symbols!_LIST_ENTRY"
+                    },
+                    "offset": 0
+                },
+                "Source": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 16
+                },
+                "Target": {
+                    "type": {
+                        "kind": "struct",
+                        "name": "_COMMAND"
+                    },
+                    "offset": 48
+                }
+            },
+            "kind": "struct",
+            "size": 32
+        }
+    },
+    "metadata": {
+        "producer": {
+            "version": "0.0.1", 
+            "name": "Dave Lassalle",
+            "datetime": "2024-07-31T15:05:35-06:00"
+        },
+        "format": "4.1.0"
+    }
+}
diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py
index 80d3b48b7..ecfc2f163 100755
--- a/volatility3/framework/symbols/windows/extensions/__init__.py
+++ b/volatility3/framework/symbols/windows/extensions/__init__.py
@@ -1247,6 +1247,15 @@ class CONTROL_AREA(objects.StructType):
         is_64bit = symbols.symbol_table_is_64bit(self._context, symbol_table_name)
         is_pae = self._context.layers[self.vol.layer_name].metadata.get("pae", False)
 
+        # the sector_size is used as a multiplier to the StartingSector
+        # within each _SUBSECTION. ImageSectionObjects use a multiplier
+        # of 0x200 corresponding to sector alignment on disk,
+        # while DataSectionObjects use a multiplier of 0x1000 corresponding
+        # to the size of a page
+        sector_size = 0x200
+        if self.u.Flags.Image != 1:
+            sector_size = 0x1000
+
         # This is a null-terminated single-linked list.
         while subsection != 0:
             try:
@@ -1257,7 +1266,7 @@ class CONTROL_AREA(objects.StructType):
 
             # The offset into the file is stored implicitly based on the PTE location within the Subsection.
             starting_sector = subsection.StartingSector
-            subsection_offset = starting_sector * 0x200
+            subsection_offset = starting_sector * sector_size
 
             # Similar to the check in is_valid(), make sure the SubsectionBase is not page aligned.
             # if subsection.SubsectionBase & self.PAGE_MASK == 0:
diff --git a/volatility3/framework/symbols/windows/extensions/callbacks.py b/volatility3/framework/symbols/windows/extensions/callbacks.py
index f894644db..f54db39f2 100644
--- a/volatility3/framework/symbols/windows/extensions/callbacks.py
+++ b/volatility3/framework/symbols/windows/extensions/callbacks.py
@@ -1,4 +1,5 @@
 import logging
+from typing import Dict
 
 from volatility3.framework import exceptions, objects
 from volatility3.framework.symbols.windows.extensions import pool
@@ -24,12 +25,8 @@ class _SHUTDOWN_PACKET(objects.StructType, pool.ExecutiveObject):
                 and self.Entry.Blink.is_readable()
                 and self.DeviceObject.is_readable()
             ):
-                return False
-
-            device = self.DeviceObject
-            if not device or not (device.DriverObject.DriverStart % 0x1000 == 0):
                 vollog.debug(
-                    f"callback obj 0x{self.vol.offset:x} invalid due to invalid device object"
+                    f"Callback obj 0x{self.vol.offset:x} invalid due to unreadable structure members"
                 )
                 return False
 
@@ -39,12 +36,43 @@ class _SHUTDOWN_PACKET(objects.StructType, pool.ExecutiveObject):
             )
             return False
 
+        return True
+
+    def is_parseable(self, type_map: Dict[int, str]) -> bool:
+        """
+        Determines whether or not this `_SHUTDOWN_PACKET` callback can be reliably parsed.
+        Requires a `type_map` that maps NT executive object type indices to string representations.
+        This type map can be acquired via the `handles.Handles.get_type_map` classmethod.
+        """
+        if not self.is_valid():
+            return False
+
         try:
+
+            device = self.DeviceObject
+            if not device or not (device.DriverObject.DriverStart % 0x1000 == 0):
+                vollog.debug(
+                    f"callback obj 0x{self.vol.offset:x} invalid due to invalid device object"
+                )
+                return False
+
             header = device.get_object_header()
-            valid = header.NameInfo.Name == "Device"
-            return valid
+            object_type = header.get_object_type(type_map)
+            is_valid = object_type == "Device"
+            if not is_valid:
+                vollog.debug(
+                    f"Callback obj 0x{self.vol.offset:x} invalid due to invalid device type: wanted 'Device', found '{object_type}'"
+                )
+            return is_valid
+        except exceptions.InvalidAddressException:
+            vollog.debug(
+                f"callback obj 0x{self.vol.offset:x} invalid due to invalid address access"
+            )
+            return False
         except ValueError:
-            vollog.debug(f"Could not get NameInfo for object at 0x{self.vol.offset:x}")
+            vollog.debug(
+                f"Could not get object type for object at 0x{self.vol.offset:x}"
+            )
             return False
 
 
diff --git a/volatility3/framework/symbols/windows/extensions/consoles.py b/volatility3/framework/symbols/windows/extensions/consoles.py
new file mode 100644
index 000000000..2312149c7
--- /dev/null
+++ b/volatility3/framework/symbols/windows/extensions/consoles.py
@@ -0,0 +1,415 @@
+# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+
+import logging
+from typing import Generator, List, Union, Tuple
+from volatility3.framework import objects, interfaces
+from volatility3.framework import constants
+
+vollog = logging.getLogger(__name__)
+
+
+class ROW(objects.StructType):
+    """A Row Structure."""
+
+    def _valid_dbcs(self, dbcs_attr: int, text_attr_msb: int) -> bool:
+        # TODO this need more research and testing
+        # https://github.com/search?q=repo%3Amicrosoft%2Fterminal+DbcsAttr&type=code
+        valid = text_attr_msb == 0 and dbcs_attr in (
+            0x0,
+            0x1,
+            0x2,
+            0x8,
+            0x10,
+            0x18,
+            0x20,
+            0x28,
+            0x30,
+            0x48,
+            0x50,
+            0x58,
+            0x60,
+            0x68,
+            0x70,
+            0x78,
+            0x80,
+            0x88,
+            0xA8,
+            0xB8,
+            0xC0,
+            0xC8,
+            0x98,
+            0xD8,
+            0xE0,
+            0xE8,
+            0xF8,
+            0xF0,
+            0xA0,
+        )
+        if text_attr_msb == 0 and not valid:
+            vollog.debug(f"Bad Dbcs Attribute {dbcs_attr:#x}")
+        return valid
+
+    def get_text(self, truncate: bool = True) -> str:
+        """A convenience method to extract the text from the _ROW.  The _ROW
+        contains a pointer CharRow to an array of CharRowCell objects. Each
+        CharRowCell contains the wide character and an attribute. Enumerating
+        self.CharRow.Chars and casting each character to unicode takes too long,
+        so this reads the whole row into a buffer, then extracts the text characters."""
+
+        layer = self._context.layers[self.vol.layer_name]
+        offset = self.CharRow.Chars.vol.offset
+        length = self.RowLength * 3
+        char_row = layer.read(offset, length)
+        line = ""
+        try:
+            if char_row:
+                line = "".join(
+                    (
+                        char_row[i : i + 2].decode("utf-16le", errors="replace")
+                        if self._valid_dbcs(char_row[i + 2], char_row[i + 1])
+                        else ""
+                    )
+                    for i in range(0, len(char_row), 3)
+                )
+        except Exception as e:
+            line = ""
+
+        if truncate:
+            return line.rstrip()
+        else:
+            return line
+
+
+class ALIAS(objects.StructType):
+    """An Alias Structure"""
+
+    def get_source(self) -> Union[str, None]:
+        return self.Source.get_command_string()
+
+    def get_target(self) -> Union[str, None]:
+        return self.Target.get_command_string()
+
+
+class EXE_ALIAS_LIST(objects.StructType):
+    """An Exe Alias List Structure"""
+
+    def get_exename(self) -> Union[str, None]:
+        exe_name = self.ExeName
+        # Windows 10 22000 and Server 20348 removed the Pointer
+        if isinstance(exe_name, objects.Pointer):
+            exe_name = exe_name.dereference()
+            return exe_name.get_string()
+
+        return exe_name.get_command_string()
+
+    def get_aliases(self) -> Generator[interfaces.objects.ObjectInterface, None, None]:
+        """Generator for the individual aliases for a
+        particular executable."""
+        for alias in self.AliasList.to_list(
+            f"{self.get_symbol_table_name()}{constants.BANG}_ALIAS",
+            "ListEntry",
+        ):
+            yield alias
+
+
+class SCREEN_INFORMATION(objects.StructType):
+    """A Screen Information Structure."""
+
+    @property
+    def ScreenX(self) -> int:
+        # 22000 change from an array of pointers to _ROW to an array of _ROW
+        row = self.TextBufferInfo.BufferRows.Rows[0]
+        if hasattr(row, "Row"):
+            return row.Row.RowLength2
+        else:
+            return row.RowLength2
+
+    @property
+    def ScreenY(self) -> int:
+        return self.TextBufferInfo.BufferCapacity
+
+    def _truncate_rows(self, rows: List[str]) -> List[str]:
+        """To truncate empty rows at the end, walk the list
+        backwards and get the last non-empty row. Use that
+        row index to splice. Rows are created based on the
+        length given in the ROW structure, so empty rows will
+        be ''."""
+
+        non_empty_index = 0
+        rows_traversed = False
+
+        for index, row in enumerate(reversed(rows)):
+            # the string was created based on the length in the ROW structure so it shouldn't have any bad data
+            if len(row.rstrip()) > 0:
+                non_empty_index = index
+                break
+            rows_traversed = True
+
+        if non_empty_index == 0 and rows_traversed:
+            rows = []
+        else:
+            rows = rows[0 : len(rows) - non_empty_index]
+
+        return rows
+
+    def get_buffer(
+        self, truncate_rows: bool = True, truncate_lines: bool = True
+    ) -> List[str]:
+        """Get the screen buffer.
+
+        The screen buffer is comprised of the screen's Y
+        coordinate which tells us the number of rows and
+        the X coordinate which tells us the width of each
+        row in characters. Windows 10 17763 changed from
+        a large text buffer to a grid of cells, with each
+        cell containing a single wide character in that
+        cell, stored in a CharRowCell object.
+
+        @param truncate: True if the empty rows at the
+        end (i.e. bottom) of the screen buffer should be
+        supressed.
+        """
+        rows = []
+
+        capacity = self.TextBufferInfo.BufferCapacity
+        start = self.TextBufferInfo.BufferStart
+        buffer_rows = self.TextBufferInfo.BufferRows
+        buffer_rows.Rows.count = self.TextBufferInfo.BufferCapacity
+
+        for i in range(capacity):
+            index = (start + i) % capacity
+            row = buffer_rows.Rows[index]
+            if hasattr(row, "Row"):
+                row = row.Row
+            try:
+                text = row.get_text(truncate_lines)
+                rows.append(text)
+            except Exception:
+                break
+
+        if truncate_rows:
+            rows = self._truncate_rows(rows)
+
+        return rows
+
+
+class CONSOLE_INFORMATION(objects.StructType):
+    """A Console Information Structure."""
+
+    @property
+    def ScreenBuffer(self) -> interfaces.objects.ObjectInterface:
+        return self.GetScreenBuffer
+
+    def is_valid(self, max_buffers: int = 4) -> bool:
+        """Determine if the structure is valid."""
+
+        # Last displayed must be between -1 and max
+        if self.HistoryBufferCount < 1 or self.HistoryBufferCount > max_buffers:
+            return False
+
+        if not self.get_title() and not self.get_original_title():
+            return False
+
+        return True
+
+    def get_screens(self) -> Generator[interfaces.objects.ObjectInterface, None, None]:
+        """Generator for screens in the console.
+
+        A console can have multiple screen buffers at a time,
+        but only the current/active one is displayed.
+
+        Multiple screens are tracked using the singly-linked
+        list _SCREEN_INFORMATION.Next.
+
+        See CreateConsoleScreenBuffer
+        """
+        screens = [self.CurrentScreenBuffer]
+
+        if self.ScreenBuffer not in screens:
+            screens.append(self.ScreenBuffer)
+
+        seen = set()
+
+        for screen in screens:
+            cur = screen
+            while cur and cur.vol.offset != 0 and cur.vol.offset not in seen:
+                cur.TextBufferInfo.BufferRows.Rows.count = (
+                    cur.TextBufferInfo.BufferCapacity
+                )
+                yield cur
+                seen.add(cur.vol.offset)
+                cur = cur.Next
+
+    def get_histories(
+        self,
+    ) -> Generator[interfaces.objects.ObjectInterface, None, None]:
+        for cmd_hist in self.HistoryList.to_list(
+            f"{self.get_symbol_table_name()}{constants.BANG}_COMMAND_HISTORY",
+            "ListEntry",
+        ):
+            yield cmd_hist
+
+    def get_exe_aliases(
+        self,
+    ) -> Generator[interfaces.objects.ObjectInterface, None, None]:
+        exe_alias_list = self.ExeAliasList
+        # Windows 10 22000 and Server 20348 made this a Pointer
+        if isinstance(exe_alias_list, objects.Pointer):
+            exe_alias_list = exe_alias_list.dereference()
+        for exe_alias_list_item in exe_alias_list.to_list(
+            f"{self.get_symbol_table_name()}{constants.BANG}_EXE_ALIAS_LIST",
+            "ListEntry",
+        ):
+            yield exe_alias_list_item
+
+    def get_processes(
+        self,
+    ) -> Generator[interfaces.objects.ObjectInterface, None, None]:
+        for proc in self.ConsoleProcessList.to_list(
+            f"{self.get_symbol_table_name()}{constants.BANG}_CONSOLE_PROCESS_LIST",
+            "ListEntry",
+        ):
+            yield proc
+
+    def get_title(self) -> Union[str, None]:
+        try:
+            return self.Title.dereference().cast(
+                "string", encoding="utf-16", errors="replace", max_length=512
+            )
+        except Exception:
+            return ""
+
+    def get_original_title(self) -> Union[str, None]:
+        try:
+            return self.OriginalTitle.dereference().cast(
+                "string", encoding="utf-16", errors="replace", max_length=512
+            )
+        except Exception:
+            return ""
+
+
+class COMMAND(objects.StructType):
+    """A Command Structure"""
+
+    def is_valid(self) -> bool:
+        if (
+            self.Length < 1
+            or self.Allocated < 1
+            or self.Length > 1024
+            or self.Allocated > 1024
+        ):
+            return False
+
+        return True
+
+    def get_command_string(self) -> Union[str, None]:
+        if self.Length < 8:
+            return self.Chars.cast(
+                "string",
+                encoding="utf-16",
+                errors="replace",
+                max_length=self.Length * 2,
+            )
+        elif self.Length < 1024:
+            return self.Pointer.dereference().cast(
+                "string",
+                encoding="utf-16",
+                errors="replace",
+                max_length=self.Length * 2,
+            )
+
+        return None
+
+
+class COMMAND_HISTORY(objects.StructType):
+    """A Command History Structure."""
+
+    @property
+    def CommandCount(self) -> int:
+        command_type = self.get_symbol_table_name() + constants.BANG + "_COMMAND"
+        command_size = self._context.symbol_space.get_type(command_type).size
+        return int((self.CommandBucket.End - self.CommandBucket.Begin) / command_size)
+
+    @property
+    def ProcessHandle(self) -> int:
+        """Allow ProcessHandle to be referenced regardless of OS version"""
+        return self.ConsoleProcessHandle.ProcessHandle
+
+    def is_valid(self, max_history: int = 50) -> bool:
+        # The count must be between zero and max
+        if self.CommandCount < 0 or self.CommandCount > max_history:
+            return False
+
+        # Last displayed must be between -1 and max
+        if self.LastDisplayed < -1 or self.LastDisplayed > max_history:
+            return False
+
+        # Process handle must be a valid pid
+        if (
+            self.ProcessHandle <= 0
+            or self.ProcessHandle > 0xFFFF
+            or self.ProcessHandle % 4 != 0
+        ):
+            return False
+
+        return True
+
+    def get_application(self) -> Union[str, None]:
+        return self.Application.get_command_string()
+
+    def scan_command_bucket(
+        self, end: Union[int, None] = None
+    ) -> Generator[Tuple[int, interfaces.objects.ObjectInterface], None, None]:
+        """Brute force print all strings pointed to by the CommandBucket entries by
+        going to greater of EndCapacity or CommandCountMax*sizeof(_COMMAND)"""
+
+        command_type = self.get_symbol_table_name() + constants.BANG + "_COMMAND"
+        command_history_size = self._context.symbol_space.get_type(
+            self.vol.type_name
+        ).size
+        command_size = self._context.symbol_space.get_type(command_type).size
+
+        if end is None:
+            end = max(
+                self.CommandBucket.EndCapacity,
+                self.CommandBucket.Begin + command_history_size * self.CommandCountMax,
+            )
+
+        for i, pointer in enumerate(range(self.CommandBucket.Begin, end, command_size)):
+            cmd = self._context.object(command_type, self.vol.layer_name, pointer)
+            if cmd.is_valid():
+                yield i, cmd
+
+    def get_commands(
+        self,
+    ) -> Generator[Tuple[int, interfaces.objects.ObjectInterface], None, None]:
+        """Generator for commands in the history buffer.
+
+        The CommandBucket is an array of pointers to _COMMAND
+        structures. The array size is CommandCount. Once CommandCount
+        is reached, the oldest commands are cycled out and the
+        rest are coalesced.
+        """
+
+        for i, cmd in self.scan_command_bucket(self.CommandBucket.End):
+            yield i, cmd
+
+
+win10_x64_class_types = {
+    "_EXE_ALIAS_LIST": EXE_ALIAS_LIST,
+    "_ALIAS": ALIAS,
+    "_ROW": ROW,
+    "_SCREEN_INFORMATION": SCREEN_INFORMATION,
+    "_CONSOLE_INFORMATION": CONSOLE_INFORMATION,
+    "_COMMAND_HISTORY": COMMAND_HISTORY,
+    "_COMMAND": COMMAND,
+}
+class_types = {
+    "_ROW": ROW,
+    "_SCREEN_INFORMATION": SCREEN_INFORMATION,
+    "_CONSOLE_INFORMATION": CONSOLE_INFORMATION,
+    "_COMMAND_HISTORY": COMMAND_HISTORY,
+    "_COMMAND": COMMAND,
+}
diff --git a/volatility3/framework/symbols/windows/extensions/mft.py b/volatility3/framework/symbols/windows/extensions/mft.py
index 14c1f08d6..ebba882c0 100644
--- a/volatility3/framework/symbols/windows/extensions/mft.py
+++ b/volatility3/framework/symbols/windows/extensions/mft.py
@@ -2,6 +2,8 @@
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
 
+from typing import Optional
+
 from volatility3.framework import objects, constants, exceptions
 
 
@@ -26,7 +28,15 @@ class MFTFileName(objects.StructType):
 class MFTAttribute(objects.StructType):
     """This represents an MFT ATTRIBUTE"""
 
-    def get_resident_filename(self) -> str:
+    def get_resident_filename(self) -> Optional[str]:
+        # 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems
+        # Length as 512 as its 256*2, which is the maximum size for an entire file path, so this is even generous
+        if (
+            self.Attr_Header.ContentOffset > 0x400000
+            or self.Attr_Header.NameLength > 512
+        ):
+            return None
+
         # To get the resident name, we jump to relative name offset and read name length * 2 bytes of data
         try:
             name = self._context.object(
@@ -41,7 +51,15 @@ class MFTAttribute(objects.StructType):
         except exceptions.InvalidAddressException:
             return None
 
-    def get_resident_filecontent(self) -> bytes:
+    def get_resident_filecontent(self) -> Optional[bytes]:
+        # smear observed in mass testing of samples
+        # 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems
+        if (
+            self.Attr_Header.ContentOffset > 0x400000
+            or self.Attr_Header.ContentLength > 0x400000
+        ):
+            return None
+
         # To get the resident content, we jump to relative content offset and read name length * 2 bytes of data
         try:
             bytesobj = self._context.object(
diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py
index 51be0841c..bebfaea89 100644
--- a/volatility3/framework/symbols/windows/extensions/registry.py
+++ b/volatility3/framework/symbols/windows/extensions/registry.py
@@ -5,7 +5,7 @@ import contextlib
 import enum
 import logging
 import struct
-from typing import Iterable, Optional, Union
+from typing import Iterator, Optional, Union, cast
 
 from volatility3.framework import constants, exceptions, interfaces, objects
 from volatility3.framework.layers.registry import (
@@ -39,6 +39,29 @@ class RegValueTypes(enum.Enum):
         return cls(RegValueTypes.REG_UNKNOWN)
 
 
+INTEGER_TYPES = [
+    RegValueTypes.REG_DWORD,
+    RegValueTypes.REG_QWORD,
+    RegValueTypes.REG_DWORD_BIG_ENDIAN,
+    RegValueTypes.REG_DWORD_BIG_ENDIAN,
+]
+
+STRING_TYPES = [
+    RegValueTypes.REG_SZ,
+    RegValueTypes.REG_MULTI_SZ,
+    RegValueTypes.REG_EXPAND_SZ,
+    RegValueTypes.REG_LINK,
+]
+
+BINARY_TYPES = [
+    RegValueTypes.REG_RESOURCE_LIST,
+    RegValueTypes.REG_BINARY,
+    RegValueTypes.REG_FULL_RESOURCE_DESCRIPTOR,
+    RegValueTypes.REG_RESOURCE_REQUIREMENTS_LIST,
+    RegValueTypes.REG_NONE,
+]
+
+
 class RegKeyFlags(enum.IntEnum):
     KEY_IS_VOLATILE = 0x01
     KEY_HIVE_EXIT = 0x02
@@ -142,7 +165,7 @@ class CM_KEY_NODE(objects.StructType):
             )
         return bool(self.vol.offset & 0x80000000)
 
-    def get_subkeys(self) -> Iterable[interfaces.objects.ObjectInterface]:
+    def get_subkeys(self) -> Iterator["CM_KEY_NODE"]:
         """Returns a list of the key nodes."""
         hive = self._context.layers[self.vol.layer_name]
         if not isinstance(hive, RegistryHive):
@@ -154,7 +177,7 @@ class CM_KEY_NODE(objects.StructType):
 
     def _get_subkeys_recursive(
         self, hive: RegistryHive, node: interfaces.objects.ObjectInterface
-    ) -> Iterable[interfaces.objects.ObjectInterface]:
+    ) -> Iterator["CM_KEY_NODE"]:
         """Recursively descend a node returning subkeys."""
         # The keylist appears to include 4 bytes of key name after each value
         # We can either double the list and only use the even items, or
@@ -170,7 +193,7 @@ class CM_KEY_NODE(objects.StructType):
         elif signature == "lh" or signature == "lf":
             listjump = 2
         elif node.vol.type_name.endswith(constants.BANG + "_CM_KEY_NODE"):
-            yield node
+            yield cast("CM_KEY_NODE", node)
         else:
             vollog.debug(
                 "Unexpected node type encountered when traversing subkeys: {}, signature: {}".format(
@@ -200,7 +223,7 @@ class CM_KEY_NODE(objects.StructType):
                         continue
                     yield from self._get_subkeys_recursive(hive, subnode)
 
-    def get_values(self) -> Iterable[interfaces.objects.ObjectInterface]:
+    def get_values(self) -> Iterator["CM_KEY_VALUE"]:
         """Returns a list of the Value nodes for a key."""
         hive = self._context.layers[self.vol.layer_name]
         if not isinstance(hive, RegistryHive):
@@ -216,8 +239,9 @@ class CM_KEY_NODE(objects.StructType):
                     except (RegistryInvalidIndex, RegistryFormatException) as excp:
                         vollog.debug(f"Invalid address {excp}")
                         continue
-                    if node.vol.type_name.endswith(constants.BANG + "_CM_KEY_VALUE"):
+                    if isinstance(node, CM_KEY_VALUE):
                         yield node
+
         except (exceptions.InvalidAddressException, RegistryFormatException) as excp:
             vollog.debug(f"Invalid address in get_values iteration: {excp}")
             return None
@@ -249,6 +273,10 @@ class CM_KEY_VALUE(objects.StructType):
         self.Name.count = namelength
         return self.Name.cast("string", max_length=namelength, encoding="latin-1")
 
+    def get_type(self) -> RegValueTypes:
+        """Get the type of the registry value"""
+        return RegValueTypes(self.Type)
+
     def decode_data(self) -> Union[int, bytes]:
         """Properly decodes the data associated with the value node"""
         # Determine if the data is stored inline
@@ -293,29 +321,28 @@ class CM_KEY_VALUE(objects.StructType):
             # but the length at the start could be negative so just adding 4 to jump past it
             data = layer.read(self.Data + 4, datalen)
 
-        self_type = RegValueTypes(self.Type)
-        if self_type == RegValueTypes.REG_DWORD:
+        if self.get_type() == RegValueTypes.REG_DWORD:
             if len(data) != struct.calcsize("<L"):
                 raise ValueError(
                     f"Size of data does not match the type of registry value {self.get_name()}"
                 )
             (res,) = struct.unpack("<L", data)
             return res
-        if self_type == RegValueTypes.REG_DWORD_BIG_ENDIAN:
+        if self.get_type() == RegValueTypes.REG_DWORD_BIG_ENDIAN:
             if len(data) != struct.calcsize(">L"):
                 raise ValueError(
                     f"Size of data does not match the type of registry value {self.get_name()}"
                 )
             (res,) = struct.unpack(">L", data)
             return res
-        if self_type == RegValueTypes.REG_QWORD:
+        if self.get_type() == RegValueTypes.REG_QWORD:
             if len(data) != struct.calcsize("<Q"):
                 raise ValueError(
                     f"Size of data does not match the type of registry value {self.get_name()}"
                 )
             (res,) = struct.unpack("<Q", data)
             return res
-        if self_type in [
+        if self.get_type() in [
             RegValueTypes.REG_SZ,
             RegValueTypes.REG_EXPAND_SZ,
             RegValueTypes.REG_LINK,
@@ -326,7 +353,7 @@ class CM_KEY_VALUE(objects.StructType):
             RegValueTypes.REG_RESOURCE_REQUIREMENTS_LIST,
         ]:
             return data
-        if self_type == RegValueTypes.REG_NONE:
+        if self.get_type() == RegValueTypes.REG_NONE:
             return b""
 
         # Fall back if it's something weird
diff --git a/volatility3/schemas/__init__.py b/volatility3/schemas/__init__.py
index be120f2af..3ca00e5dc 100644
--- a/volatility3/schemas/__init__.py
+++ b/volatility3/schemas/__init__.py
@@ -6,8 +6,8 @@ import hashlib
 import json
 import logging
 import os
-from typing import Any, Dict, Optional, Set
-
+import re
+from typing import Any, Dict, Optional, Set, Tuple
 from volatility3.framework import constants
 
 vollog = logging.getLogger(__name__)
@@ -77,6 +77,17 @@ def valid(
     input: Dict[str, Any], schema: Dict[str, Any], use_cache: bool = True
 ) -> bool:
     """Validates a json schema."""
+    producer = input.get("metadata", {}).get("producer", {})
+    if producer and producer.get("name") == "dwarf2json":
+        dwarf2json_version = parse_producer_version(producer.get("version", ""))
+        # No warnings if version couldn't be parsed, as it's not our role here
+        # to validate the schema.
+        if dwarf2json_version:
+            if dwarf2json_check_rust_type_confusion(input, dwarf2json_version):
+                vollog.warning(
+                    "This ISF was generated by dwarf2json < 0.9.0, which is known to produce inaccurate results (see dwarf2json GitHub issue #63)."
+                )
+
     input_hash = create_json_hash(input, schema)
     if input_hash in cached_validations and use_cache:
         return True
@@ -98,3 +109,42 @@ def valid(
 
     record_cached_validations(cached_validations)
     return True
+
+
+def parse_producer_version(version_string: str) -> Optional[Tuple[int]]:
+    """Parses a producer version and returns a tuple of identifiers.
+
+    Args:
+        version_string: string containing dot-separated integers,
+    expected to follow the Volatility3 versioning schema
+
+    Returns:
+        A tuple containing each version identifier
+    """
+    identifiers = re.search("^(\\d+)[.](\\d+)[.](\\d+)$", version_string)
+    if not identifiers:
+        return None
+
+    return tuple(int(d) for d in identifiers.groups())
+
+
+# dwarf2json sanity checks #
+def dwarf2json_check_rust_type_confusion(
+    input: Dict[str, Any], dwarf2json_version: Tuple[int]
+) -> bool:
+    """dwarf2json sanity check for Rust and C types confusion:
+     - dwarf2json #63
+     - volatility3 #1305
+
+    Args:
+        dwarf2json_version: a tuple containing each version identifier
+
+    Returns:
+        True if the issue was detected
+    """
+
+    return "rust_helper_BUG" in input.get("symbols", {}) and dwarf2json_version < (
+        0,
+        9,
+        0,
+    )
diff --git a/volatility3/symbols/generic/vmcs/nehalem-architecture.json b/volatility3/symbols/generic/vmcs/nehalem-architecture.json
new file mode 100644
index 000000000..ae0ab2863
--- /dev/null
+++ b/volatility3/symbols/generic/vmcs/nehalem-architecture.json
@@ -0,0 +1,131 @@
+{
+  "base_types": {
+    "pointer": {
+      "endian": "little",
+      "kind": "int",
+      "signed": false,
+      "size": 8
+    },
+    "unsigned char": {
+      "endian": "little",
+      "kind": "int",
+      "signed": false,
+      "size": 1
+    },
+    "unsigned long": {
+      "endian": "little",
+      "kind": "int",
+      "signed": false,
+      "size": 4
+    },
+    "unsigned long long": {
+      "endian": "little",
+      "kind": "int",
+      "signed": false,
+      "size": 8
+    },
+    "unsigned short": {
+      "endian": "little",
+      "kind": "int",
+      "signed": false,
+      "size": 2
+    }
+  },
+  "enums": {},
+  "metadata": {
+    "format": "6.1.0",
+    "producer": {
+      "datetime": "2021-07-31T17:37:28.302702",
+      "name": "vmextract-by-hand",
+      "version": "0.0.1"
+    }
+  },
+  "symbols": {
+    "revision_id": {
+      "address": 0,
+      "constant_data": "MTQ="
+    }
+  },
+  "user_types": {
+    "_VMCS": {
+      "fields": {
+        "ept": {
+          "offset": 232,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "executive_vmcs_ptr": {
+          "offset": 208,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "guest_cr3": {
+          "offset": 736,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "guest_cr4": {
+          "offset": 744,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "guest_pdpte": {
+          "offset": 928,
+          "type": {
+            "count": 4,
+            "kind": "array",
+            "subtype": {
+              "kind": "struct",
+              "name": "unsigned long long"
+            }
+          }
+        },
+        "guest_physical_addr": {
+          "offset": 240,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "host_cr3": {
+          "offset": 832,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "host_cr4": {
+          "offset": 840,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "vmcs_link_ptr": {
+          "offset": 248,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "vpid": {
+          "offset": 752,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned short"
+          }
+        }
+      },
+      "kind": "struct",
+      "size": 4096
+    }
+  }
+}
\ No newline at end of file
diff --git a/volatility3/symbols/generic/vmcs/sandybridge-architecture.json b/volatility3/symbols/generic/vmcs/sandybridge-architecture.json
new file mode 100644
index 000000000..b2b3cfebf
--- /dev/null
+++ b/volatility3/symbols/generic/vmcs/sandybridge-architecture.json
@@ -0,0 +1,131 @@
+{
+  "base_types": {
+    "pointer": {
+      "endian": "little",
+      "kind": "int",
+      "signed": false,
+      "size": 8
+    },
+    "unsigned char": {
+      "endian": "little",
+      "kind": "int",
+      "signed": false,
+      "size": 1
+    },
+    "unsigned long": {
+      "endian": "little",
+      "kind": "int",
+      "signed": false,
+      "size": 4
+    },
+    "unsigned long long": {
+      "endian": "little",
+      "kind": "int",
+      "signed": false,
+      "size": 8
+    },
+    "unsigned short": {
+      "endian": "little",
+      "kind": "int",
+      "signed": false,
+      "size": 2
+    }
+  },
+  "enums": {},
+  "metadata": {
+    "format": "6.1.0",
+    "producer": {
+      "datetime": "2021-07-31T17:37:28.311608",
+      "name": "vmextract-by-hand",
+      "version": "0.0.1"
+    }
+  },
+  "symbols": {
+    "revision_id": {
+      "address": 0,
+      "constant_data": "MTY="
+    }
+  },
+  "user_types": {
+    "_VMCS": {
+      "fields": {
+        "ept": {
+          "offset": 232,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "executive_vmcs_ptr": {
+          "offset": 208,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "guest_cr3": {
+          "offset": 736,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "guest_cr4": {
+          "offset": 744,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "guest_pdpte": {
+          "offset": 928,
+          "type": {
+            "count": 4,
+            "kind": "array",
+            "subtype": {
+              "kind": "struct",
+              "name": "unsigned long long"
+            }
+          }
+        },
+        "guest_physical_addr": {
+          "offset": 240,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "host_cr3": {
+          "offset": 832,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "host_cr4": {
+          "offset": 840,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "vmcs_link_ptr": {
+          "offset": 248,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "vpid": {
+          "offset": 752,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned short"
+          }
+        }
+      },
+      "kind": "struct",
+      "size": 4096
+    }
+  }
+}
\ No newline at end of file
diff --git a/volatility3/symbols/generic/vmcs/westmere-architecture.json b/volatility3/symbols/generic/vmcs/westmere-architecture.json
new file mode 100644
index 000000000..2769f7081
--- /dev/null
+++ b/volatility3/symbols/generic/vmcs/westmere-architecture.json
@@ -0,0 +1,131 @@
+{
+  "base_types": {
+    "pointer": {
+      "endian": "little",
+      "kind": "int",
+      "signed": false,
+      "size": 8
+    },
+    "unsigned char": {
+      "endian": "little",
+      "kind": "int",
+      "signed": false,
+      "size": 1
+    },
+    "unsigned long": {
+      "endian": "little",
+      "kind": "int",
+      "signed": false,
+      "size": 4
+    },
+    "unsigned long long": {
+      "endian": "little",
+      "kind": "int",
+      "signed": false,
+      "size": 8
+    },
+    "unsigned short": {
+      "endian": "little",
+      "kind": "int",
+      "signed": false,
+      "size": 2
+    }
+  },
+  "enums": {},
+  "metadata": {
+    "format": "6.1.0",
+    "producer": {
+      "datetime": "2021-07-31T17:37:28.314801",
+      "name": "vmextract-by-hand",
+      "version": "0.0.1"
+    }
+  },
+  "symbols": {
+    "revision_id": {
+      "address": 0,
+      "constant_data": "MTU="
+    }
+  },
+  "user_types": {
+    "_VMCS": {
+      "fields": {
+        "ept": {
+          "offset": 320,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "executive_vmcs_ptr": {
+          "offset": 208,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "guest_cr3": {
+          "offset": 736,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "guest_cr4": {
+          "offset": 744,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "guest_pdpte": {
+          "offset": 928,
+          "type": {
+            "count": 4,
+            "kind": "array",
+            "subtype": {
+              "kind": "struct",
+              "name": "unsigned long long"
+            }
+          }
+        },
+        "guest_physical_addr": {
+          "offset": 328,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "host_cr3": {
+          "offset": 832,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "host_cr4": {
+          "offset": 840,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "vmcs_link_ptr": {
+          "offset": 248,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned long long"
+          }
+        },
+        "vpid": {
+          "offset": 220,
+          "type": {
+            "kind": "struct",
+            "name": "unsigned short"
+          }
+        }
+      },
+      "kind": "struct",
+      "size": 4096
+    }
+  }
+}
\ No newline at end of file