From b1c16456575d4d771f5b7db25a3085b450dd6cd6 Mon Sep 17 00:00:00 2001 From: eve Date: Thu, 3 Apr 2025 16:38:55 +0100 Subject: [PATCH] volshell: inform user that value displayed is only an offset for types like embedded structs --- volatility3/cli/volshell/generic.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 1c70ceb0a..e80d65957 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -622,7 +622,7 @@ class Volshell(interfaces.plugins.PluginInterface): elif isinstance(value, objects.Array): return repr([self._display_value(val) for val in value]) else: - return hex(value.vol.offset) + return f"offset: {hex(value.vol.offset)}" else: # non volobject if value is None: