From b89b0c0c38db46aaae0fc3229f928b3ed48426fa Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 14 May 2025 15:46:23 -0500 Subject: [PATCH] Layer Scanning: Temporary fix for cache growth One of the training samples' `LimeLayer` exhibits poor cache behavior - only 14 hits in a complete scan, with read sizes of 16MB each, resulting in an 8GB RSS. This is a temporary hack until we develop a more complete understanding of how common this is, and how best to mitigate it. --- volatility3/framework/interfaces/layers.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility3/framework/interfaces/layers.py b/volatility3/framework/interfaces/layers.py index 6c4e4b419..941521924 100644 --- a/volatility3/framework/interfaces/layers.py +++ b/volatility3/framework/interfaces/layers.py @@ -358,6 +358,10 @@ class DataLayerInterface( for layer_name, address, chunk_size in data_to_scan: try: data += self.context.layers[layer_name].read(address, chunk_size) + try: + self.context.layers[layer_name].read.cache_clear() + except AttributeError: + pass except exceptions.InvalidAddressException: vollog.debug( f"Invalid address in layer {layer_name} found scanning {self.name} at address {address:x}"