From 32ca62bbb1205b11be0338e741e3046d503153a8 Mon Sep 17 00:00:00 2001
From: j-t-1 <120829237+j-t-1@users.noreply.github.com>
Date: Fri, 3 Jan 2025 15:20:35 +0000
Subject: [PATCH 01/30] Make f-string slightly more readable

---
 .../framework/plugins/windows/shimcachemem.py  | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/volatility3/framework/plugins/windows/shimcachemem.py b/volatility3/framework/plugins/windows/shimcachemem.py
index b8e9b5bd7..9d968c30a 100644
--- a/volatility3/framework/plugins/windows/shimcachemem.py
+++ b/volatility3/framework/plugins/windows/shimcachemem.py
@@ -305,14 +305,14 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf
         If a number of validity checks are passed, this method will return the `SHIM_CACHE_HEAD`
         object. Otherwise, `None` is returned.
         """
-        # print("checking RTL_AVL_TABLE at offset %s" % hex(offset))
+        # Check RTL_AVL_TABLE at offset
         rtl_avl_table = context.object(
             symbol_table + constants.BANG + "_RTL_AVL_TABLE", layer_name, offset
         )
         if not rtl_avl_table.is_valid(mod_page_start, mod_page_end):
             return None
 
-        vollog.debug(f"Candidate RTL_AVL_TABLE found at offset {hex(offset)}")
+        vollog.debug(f"Candidate RTL_AVL_TABLE found at offset {offset:#x}")
 
         ersrc_size = context.symbol_space.get_type(
             kernel_symbol_table + constants.BANG + "_ERESOURCE"
@@ -324,13 +324,13 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf
             # 0x20 if context.symbol_space.get_type("pointer").size == 8 else 0x10
         )
         vollog.debug(
-            f"ERESOURCE size: {hex(ersrc_size)}, ERESOURCE alignment: {hex(ersrc_alignment)}"
+            f"ERESOURCE size: {ersrc_size:#x}, ERESOURCE alignment: {ersrc_alignment:#x}"
         )
 
         eresource_rel_off = ersrc_size + ((offset - ersrc_size) % ersrc_alignment)
         eresource_offset = offset - eresource_rel_off
 
-        vollog.debug(f"Constructing ERESOURCE at {hex(eresource_offset)}")
+        vollog.debug(f"Constructing ERESOURCE at {eresource_offset:#x}")
         eresource = context.object(
             kernel_symbol_table + constants.BANG + "_ERESOURCE",
             layer_name,
@@ -408,8 +408,8 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf
         # iterate over ahcache kernel module's .data section in search of *two* SHIM handles
         shim_heads = []
 
-        vollog.debug(f"PAGE offset: {hex(mod_page_offset)}")
-        vollog.debug(f".data offset: {hex(data_sec_offset)}")
+        vollog.debug(f"PAGE offset: {mod_page_offset:#x}")
+        vollog.debug(f".data offset: {data_sec_offset:#x}")
 
         handle_type = context.symbol_space.get_type(
             shimcache_symbol_table + constants.BANG + "SHIM_CACHE_HANDLE"
@@ -419,7 +419,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf
             data_sec_offset + data_sec_size,
             8 if symbols.symbol_table_is_64bit(context, nt_symbol_table) else 4,
         ):
-            vollog.debug(f"Building shim handle pointer at {hex(offset)}")
+            vollog.debug(f"Building shim handle pointer at {offset:#x}")
             shim_handle = context.object(
                 object_type=shimcache_symbol_table + constants.BANG + "pointer",
                 layer_name=kernel_layer_name,
@@ -430,7 +430,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf
             if shim_handle.is_valid(mod_page_offset, mod_page_offset + mod_page_size):
                 if shim_handle.head is not None:
                     vollog.debug(
-                        f"Found valid shim handle @ {hex(shim_handle.vol.offset)}"
+                        f"Found valid shim handle @ {shim_handle.vol.offset:#x}"
                     )
                     shim_heads.append(shim_handle.head)
                 if len(shim_heads) == 2:
@@ -440,7 +440,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf
             vollog.debug("Failed to identify two valid SHIM_CACHE_HANDLE structures")
             return
 
-        # On Windows 8 x64, the frist cache contains the shim cache
+        # On Windows 8 x64, the first cache contains the shim cache.
         # On Windows 8 x86, 8.1 x86/x64, and 10, the second cache contains the shim cache.
         if (
             not symbols.symbol_table_is_64bit(context, nt_symbol_table)

From 03049f789559af5c4cdb56f343460178b52220f9 Mon Sep 17 00:00:00 2001
From: Andrew Case <andrew@dfir.org>
Date: Fri, 3 Jan 2025 18:40:52 +0000
Subject: [PATCH 02/30] Add missing exception handling in env var recovery.
 Prevent backtraces

---
 volatility3/framework/plugins/linux/envars.py | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/volatility3/framework/plugins/linux/envars.py b/volatility3/framework/plugins/linux/envars.py
index 8cdbfe493..04b75c8a8 100644
--- a/volatility3/framework/plugins/linux/envars.py
+++ b/volatility3/framework/plugins/linux/envars.py
@@ -5,7 +5,7 @@
 import logging
 from typing import Iterable, Tuple
 
-from volatility3.framework import renderers, interfaces
+from volatility3.framework import renderers, interfaces, exceptions
 from volatility3.framework.configuration import requirements
 from volatility3.framework.interfaces import plugins
 from volatility3.framework.objects import utility
@@ -58,10 +58,16 @@ class Envars(plugins.PluginInterface):
             Tuples of (key, value) representing each environment variable.
         """
 
-        task_name = utility.array_to_string(task.comm)
+        # This ensures the `task` is valid as well as its
+        # memory mapping structures
+        try:
+            task_name = utility.array_to_string(task.comm)
+            env_start = task.mm.env_start
+            env_end = task.mm.env_end
+        except exceptions.InvalidAddressException:
+            return None
+
         task_pid = task.pid
-        env_start = task.mm.env_start
-        env_end = task.mm.env_end
         env_area_size = env_end - env_start
         if not (0 < env_area_size <= env_area_max_size):
             vollog.debug(

From 8ba60a2aaddf86e4cbd065c95d2553ce221db183 Mon Sep 17 00:00:00 2001
From: Andrew Case <andrew@dfir.org>
Date: Sat, 4 Jan 2025 16:49:02 +0000
Subject: [PATCH 03/30] Change add_process_layer to return None instead of
 throwing an exception as it was meant to be designed

---
 volatility3/framework/symbols/linux/extensions/__init__.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index b02f80433..df1c00e3d 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -324,9 +324,11 @@ class task_struct(generic.GenericIntelProcess):
             raise TypeError(
                 "Parent layer is not a translation layer, unable to construct process layer"
             )
-        dtb, layer_name = parent_layer.translate(pgd)
-        if not dtb:
+        try:
+            dtb, layer_name = parent_layer.translate(pgd)
+        except exceptions.InvalidAddressException:
             return None
+
         if preferred_name is None:
             preferred_name = self.vol.layer_name + f"_Process{self.pid}"
         # Add the constructed layer and return the name

From 5f1d318c715311ed12d67bde5a87a8a78e0d3bf0 Mon Sep 17 00:00:00 2001
From: j-t-1 <120829237+j-t-1@users.noreply.github.com>
Date: Sun, 5 Jan 2025 13:39:00 +0000
Subject: [PATCH 04/30] Tiny comment changes

---
 volatility3/framework/plugins/windows/cmdscan.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/volatility3/framework/plugins/windows/cmdscan.py b/volatility3/framework/plugins/windows/cmdscan.py
index 9645ee507..3dc70d649 100644
--- a/volatility3/framework/plugins/windows/cmdscan.py
+++ b/volatility3/framework/plugins/windows/cmdscan.py
@@ -67,6 +67,7 @@ class CmdScan(interfaces.plugins.PluginInterface):
 
         Args:
             conhost_proc: the process object for conhost.exe
+            size_filter: filter (keep) vads less than this size (bytes)
 
         Returns:
             A list of tuples of:
@@ -100,7 +101,7 @@ class CmdScan(interfaces.plugins.PluginInterface):
             kernel_symbol_table_name: The name of the table containing the kernel symbols
             config_path: The config path where to find symbol files
             procs: list of process objects
-            max_history: an initial set of CommandHistorySize values
+            max_history: An initial set of CommandHistorySize values
 
         Returns:
             The conhost process object, the command history structure, a dictionary of properties for
@@ -227,7 +228,6 @@ class CmdScan(interfaces.plugins.PluginInterface):
                                 "data": command_history.CommandCountMax,
                             }
                         )
-
                         command_history_properties.append(
                             {
                                 "level": 1,
@@ -236,6 +236,7 @@ class CmdScan(interfaces.plugins.PluginInterface):
                                 "data": "",
                             }
                         )
+
                         for (
                             cmd_index,
                             bucket_cmd,
@@ -352,7 +353,7 @@ class CmdScan(interfaces.plugins.PluginInterface):
 
     def _conhost_proc_filter(self, proc: interfaces.objects.ObjectInterface):
         """
-        Used to filter to only conhost.exe processes
+        Used to filter only conhost.exe processes
         """
         process_name = utility.array_to_string(proc.ImageFileName)
 

From ab60add9933ee3863c3f2329d2c99af314b5b453 Mon Sep 17 00:00:00 2001
From: j-t-1 <120829237+j-t-1@users.noreply.github.com>
Date: Sun, 5 Jan 2025 17:14:21 +0000
Subject: [PATCH 05/30] Update case insensitive check

Update link and use casefold() instead of lower().
---
 volatility3/framework/layers/registry.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py
index c684ccd40..6d85da982 100644
--- a/volatility3/framework/layers/registry.py
+++ b/volatility3/framework/layers/registry.py
@@ -192,9 +192,9 @@ class RegistryHive(linear.LinearlyMappedLayer):
         while key_array and node_key:
             subkeys = node_key[-1].get_subkeys()
             for subkey in subkeys:
-                # registry keys are not case sensitive so compare lowercase
-                # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724946(v=vs.85).aspx
-                if subkey.get_name().lower() == key_array[0].lower():
+                # registry keys are not case sensitive so compare likewise
+                # https://learn.microsoft.com/en-gb/windows/win32/sysinfo/structure-of-the-registry
+                if subkey.get_name().casefold() == key_array[0].casefold():
                     node_key = node_key + [subkey]
                     found_key, key_array = found_key + [key_array[0]], key_array[1:]
                     break

From 8f4f576e93a7594666f0e58f8ae73cce5538902c Mon Sep 17 00:00:00 2001
From: j-t-1 <120829237+j-t-1@users.noreply.github.com>
Date: Sun, 5 Jan 2025 21:09:15 +0000
Subject: [PATCH 06/30] Update case insensitive check

Update link and use casefold() instead of lower().
---
 volatility3/framework/layers/registry.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py
index 6d85da982..21e1a938e 100644
--- a/volatility3/framework/layers/registry.py
+++ b/volatility3/framework/layers/registry.py
@@ -193,7 +193,7 @@ class RegistryHive(linear.LinearlyMappedLayer):
             subkeys = node_key[-1].get_subkeys()
             for subkey in subkeys:
                 # registry keys are not case sensitive so compare likewise
-                # https://learn.microsoft.com/en-gb/windows/win32/sysinfo/structure-of-the-registry
+                # https://learn.microsoft.com/en-us/windows/win32/sysinfo/structure-of-the-registry
                 if subkey.get_name().casefold() == key_array[0].casefold():
                     node_key = node_key + [subkey]
                     found_key, key_array = found_key + [key_array[0]], key_array[1:]

From 94ec7d89c09b2a276e79fc4c7561828340d5712a Mon Sep 17 00:00:00 2001
From: j-t-1 <120829237+j-t-1@users.noreply.github.com>
Date: Sun, 5 Jan 2025 21:55:58 +0000
Subject: [PATCH 07/30] Tiny comment changes

---
 volatility3/framework/plugins/windows/cmdscan.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/volatility3/framework/plugins/windows/cmdscan.py b/volatility3/framework/plugins/windows/cmdscan.py
index 3dc70d649..0cd0addb2 100644
--- a/volatility3/framework/plugins/windows/cmdscan.py
+++ b/volatility3/framework/plugins/windows/cmdscan.py
@@ -67,7 +67,7 @@ class CmdScan(interfaces.plugins.PluginInterface):
 
         Args:
             conhost_proc: the process object for conhost.exe
-            size_filter: filter (keep) vads less than this size (bytes)
+            size_filter: size above which vads will not be returned
 
         Returns:
             A list of tuples of:
@@ -100,7 +100,7 @@ class CmdScan(interfaces.plugins.PluginInterface):
             kernel_layer_name: The name of the layer on which to operate
             kernel_symbol_table_name: The name of the table containing the kernel symbols
             config_path: The config path where to find symbol files
-            procs: list of process objects
+            procs: List of process objects
             max_history: An initial set of CommandHistorySize values
 
         Returns:

From b5bc54cfaed91f4d615790305c80ce802658dafe Mon Sep 17 00:00:00 2001
From: j-t-1 <120829237+j-t-1@users.noreply.github.com>
Date: Tue, 7 Jan 2025 15:18:34 +0000
Subject: [PATCH 08/30] Use in-place subtraction

Also tweak comments.
---
 volatility3/framework/renderers/conversion.py | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/volatility3/framework/renderers/conversion.py b/volatility3/framework/renderers/conversion.py
index e48684b31..f848b2dad 100644
--- a/volatility3/framework/renderers/conversion.py
+++ b/volatility3/framework/renderers/conversion.py
@@ -18,7 +18,7 @@ def wintime_to_datetime(
     unix_time = wintime // 10000000
     if unix_time == 0:
         return renderers.NotApplicableValue()
-    unix_time = unix_time - 11644473600
+    unix_time -= 11644473600
     try:
         return datetime.datetime.fromtimestamp(unix_time, datetime.timezone.utc)
         # Windows sometimes throws OSErrors rather than ValueError/OverflowError when it can't convert a value
@@ -71,7 +71,7 @@ def round(addr: int, align: int, up: bool = False) -> int:
     Args:
         addr: the address
         align: the alignment value
-        up: Whether to round up or not
+        up: whether to round up or not
 
     Returns:
         The aligned address
@@ -122,11 +122,12 @@ def convert_port(port_as_integer):
 
 
 def convert_network_four_tuple(family, four_tuple):
-    """Converts the connection four_tuple: (source ip, source port, dest ip,
-    dest port)
+    """Converts the connection four_tuple:
+
+    (source ip, source port, dest ip, dest port)
 
     into their string equivalents. IP addresses are expected as a tuple
-    of unsigned shorts Ports are converted to proper endianness as well
+    of unsigned shorts. Ports are converted to proper endianness as well.
     """
 
     if family == socket.AF_INET:

From 43ac6c4d6271c928d9bcdaf6407e01e1c96d7cf9 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Tue, 7 Jan 2025 10:24:46 -0600
Subject: [PATCH 09/30] Fix copy-pasted module docstrings

This updates the module docstrings for 5 modules that duplicate the
docstring from the `proc` module. This was presumably the result of using
the `proc` module as a template for the others.
---
 volatility3/framework/plugins/linux/bash.py          | 4 ++--
 volatility3/framework/plugins/linux/check_afinfo.py  | 4 ++--
 volatility3/framework/plugins/linux/check_syscall.py | 3 +--
 volatility3/framework/plugins/linux/elfs.py          | 4 ++--
 volatility3/framework/plugins/linux/lsmod.py         | 3 +--
 5 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/volatility3/framework/plugins/linux/bash.py b/volatility3/framework/plugins/linux/bash.py
index 056e3cd51..8acfeb848 100644
--- a/volatility3/framework/plugins/linux/bash.py
+++ b/volatility3/framework/plugins/linux/bash.py
@@ -1,8 +1,8 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-"""A module containing a collection of plugins that produce data typically
-found in Linux's /proc file system."""
+"""A module containing a plugin that recovers bash command history
+from bash process memory."""
 
 import datetime
 import struct
diff --git a/volatility3/framework/plugins/linux/check_afinfo.py b/volatility3/framework/plugins/linux/check_afinfo.py
index 201a443f7..7aa3cbdd2 100644
--- a/volatility3/framework/plugins/linux/check_afinfo.py
+++ b/volatility3/framework/plugins/linux/check_afinfo.py
@@ -1,8 +1,8 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-"""A module containing a collection of plugins that produce data typically
-found in Linux's /proc file system."""
+"""A module containing a plugin that verifies the operation function
+pointers of network protocols."""
 import logging
 from typing import List
 
diff --git a/volatility3/framework/plugins/linux/check_syscall.py b/volatility3/framework/plugins/linux/check_syscall.py
index 3537a9fa1..13d312f2f 100644
--- a/volatility3/framework/plugins/linux/check_syscall.py
+++ b/volatility3/framework/plugins/linux/check_syscall.py
@@ -1,8 +1,7 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-"""A module containing a collection of plugins that produce data typically
-found in Linux's /proc file system."""
+"""A module containing a plugin that checks the system call table for hooks."""
 import contextlib
 import logging
 from typing import List
diff --git a/volatility3/framework/plugins/linux/elfs.py b/volatility3/framework/plugins/linux/elfs.py
index 2fd740941..0d1c9c2dd 100644
--- a/volatility3/framework/plugins/linux/elfs.py
+++ b/volatility3/framework/plugins/linux/elfs.py
@@ -1,8 +1,8 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-"""A module containing a collection of plugins that produce data typically
-found in Linux's /proc file system."""
+"""A module containing a plugin for enumerating memory-mapped
+ELF files across all processes."""
 
 import logging
 from typing import List, Optional, Type
diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py
index 49e990e93..e9a2a7137 100644
--- a/volatility3/framework/plugins/linux/lsmod.py
+++ b/volatility3/framework/plugins/linux/lsmod.py
@@ -1,8 +1,7 @@
 # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
 #
-"""A module containing a collection of plugins that produce data typically
-found in Linux's /proc file system."""
+"""A module containing a plugin that lists loaded kernel modules."""
 
 import logging
 from typing import List, Iterable

From 32cb6e11f6abe86ce5284e1a618bae9ab1cd4a5f Mon Sep 17 00:00:00 2001
From: j-t-1 <120829237+j-t-1@users.noreply.github.com>
Date: Tue, 7 Jan 2025 19:41:02 +0000
Subject: [PATCH 10/30] Change one letter of a typo

---
 volatility3/framework/plugins/windows/driverscan.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/plugins/windows/driverscan.py b/volatility3/framework/plugins/windows/driverscan.py
index 24d81c3d5..d388ffbb7 100644
--- a/volatility3/framework/plugins/windows/driverscan.py
+++ b/volatility3/framework/plugins/windows/driverscan.py
@@ -64,7 +64,7 @@ class DriverScan(interfaces.plugins.PluginInterface):
         names associated with a driver
 
         Args:
-            driver: A Eriver object
+            driver: A Driver object
 
         Returns:
             A tuple of strings of (driver name, service key, driver alt. name)

From 585901105275a015a3c4326e486f4e2a52d8eb12 Mon Sep 17 00:00:00 2001
From: Abyss Watcher <abyss-w4tcher@proton.me>
Date: Fri, 10 Jan 2025 12:35:04 +0100
Subject: [PATCH 11/30] introduce customizable plugin arparse epilog

---
 volatility3/cli/__init__.py                 | 3 +++
 volatility3/framework/interfaces/plugins.py | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py
index 6172a17f3..87caaece6 100644
--- a/volatility3/cli/__init__.py
+++ b/volatility3/cli/__init__.py
@@ -368,6 +368,9 @@ class CommandLine:
                 help=plugin_list[plugin].__doc__,
                 description=plugin_list[plugin].__doc__,
             )
+            epilog = getattr(plugin_list[plugin], "_argparse_epilog", None)
+            if epilog is not None:
+                plugin_parser.epilog = epilog
             self.populate_requirements_argparse(plugin_parser, plugin_list[plugin])
 
         ###
diff --git a/volatility3/framework/interfaces/plugins.py b/volatility3/framework/interfaces/plugins.py
index f763815a6..6cd72f02e 100644
--- a/volatility3/framework/interfaces/plugins.py
+++ b/volatility3/framework/interfaces/plugins.py
@@ -112,6 +112,8 @@ class PluginInterface(
     # Be careful with inheritance around this (We default to requiring a version which doesn't exist, so it must be set)
     _required_framework_version: Tuple[int, int, int] = (0, 0, 0)
     """The _version variable is a quick way for plugins to define their current interface, it should follow SemVer rules"""
+    _argparse_epilog: str = None
+    """Display additional description of the plugin after the description of the arguments. See: https://docs.python.org/3/library/argparse.html#epilog"""
 
     def __init__(
         self,

From 530617a700e259f69d53f62f08ccc3382bcdd057 Mon Sep 17 00:00:00 2001
From: j-t-1 <120829237+j-t-1@users.noreply.github.com>
Date: Fri, 10 Jan 2025 11:52:54 +0000
Subject: [PATCH 12/30] Small readability improvements

---
 volatility3/framework/automagic/mac.py | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/volatility3/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py
index f3679d160..a883028d2 100644
--- a/volatility3/framework/automagic/mac.py
+++ b/volatility3/framework/automagic/mac.py
@@ -101,7 +101,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
                 except exceptions.InvalidAddressException:
                     vollog.log(
                         constants.LOGLEVEL_VVVV,
-                        f"Skipping invalid idlepml4_ptr: 0x{idlepml4_ptr:0x}",
+                        f"Skipping invalid idlepml4_ptr: {idlepml4_ptr:#x}",
                     )
                     continue
 
@@ -112,7 +112,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
                 if tmp_dtb % 4096:
                     vollog.log(
                         constants.LOGLEVEL_VVV,
-                        f"Skipping non-page aligned DTB: 0x{tmp_dtb:0x}",
+                        f"Skipping non-page aligned DTB: {tmp_dtb:#x}",
                     )
                     continue
 
@@ -136,7 +136,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
                 new_layer.config["kernel_virtual_offset"] = kaslr_shift
 
             if new_layer and dtb:
-                vollog.debug(f"DTB was found at: 0x{dtb:0x}")
+                vollog.debug(f"DTB was found at: {dtb:#x}")
                 return new_layer
         vollog.debug("No suitable mac banner could be matched")
         return None
@@ -182,7 +182,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
         aslr_shift = 0
 
         for offset, banner in offset_generator:
-            banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[0:2])
+            banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[:2])
 
             tmp_aslr_shift = offset - cls.virtual_to_physical_address(
                 version_json_address
@@ -208,7 +208,6 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
                 continue
 
             aslr_shift = tmp_aslr_shift & 0xFFFFFFFF
-            break
 
         vollog.log(constants.LOGLEVEL_VVVV, f"Mac find_aslr returned: {aslr_shift:0x}")
 
@@ -219,9 +218,9 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
         """Converts a virtual mac address to a physical one (does not account
         of ASLR)"""
         if addr > 0xFFFFFF8000000000:
-            addr = addr - 0xFFFFFF8000000000
+            addr -= 0xFFFFFF8000000000
         else:
-            addr = addr - 0xFF8000000000
+            addr -= 0xFF8000000000
 
         return addr
 

From a7661d45e78b10bc736946425055755c9627d111 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Fri, 10 Jan 2025 09:21:21 -0600
Subject: [PATCH 13/30] Windows: Certificates - handle uncaught
 RegistryFormatException

Changes variable import to module import, and catches an unhandled
`RegistryFormatException` in certificates.py
---
 .../plugins/windows/registry/certificates.py     | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py
index 8587b3719..a83badb90 100644
--- a/volatility3/plugins/windows/registry/certificates.py
+++ b/volatility3/plugins/windows/registry/certificates.py
@@ -1,11 +1,11 @@
 import contextlib
 import logging
 import struct
-from typing import List, Iterator, Optional, Tuple, Type
+from typing import Iterator, List, Optional, Tuple, Type
 
 from volatility3.framework import exceptions, interfaces, renderers
 from volatility3.framework.configuration import requirements
-from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes
+from volatility3.framework.symbols.windows.extensions import registry
 from volatility3.plugins.windows.registry import hivelist, printkey
 
 vollog = logging.getLogger(__name__)
@@ -81,7 +81,11 @@ class Certificates(interfaces.plugins.PluginInterface):
                 "Microsoft\\SystemCertificates",
                 "Software\\Microsoft\\SystemCertificates",
             ]:
-                with contextlib.suppress(KeyError, exceptions.InvalidAddressException):
+                with contextlib.suppress(
+                    KeyError,
+                    registry.RegistryFormatException,
+                    exceptions.InvalidAddressException,
+                ):
                     # Walk it
                     node_path = hive.get_key(top_key, return_list=True)
                     for (
@@ -92,7 +96,11 @@ class Certificates(interfaces.plugins.PluginInterface):
                         _volatility,
                         node,
                     ) in printkey.PrintKey.key_iterator(hive, node_path, recurse=True):
-                        if not is_key and RegValueTypes(node.Type).name == "REG_BINARY":
+                        if (
+                            not is_key
+                            and registry.RegValueTypes(node.Type)
+                            == registry.RegValueTypes.REG_BINARY
+                        ):
                             name, certificate_data = self.parse_data(node.decode_data())
                             unique_key_offset = (
                                 key_path.casefold().index(top_key.casefold())

From 96eca6e0162a77699c2befcce6df16f7deac4d23 Mon Sep 17 00:00:00 2001
From: Abyss Watcher <abyss-w4tcher@proton.me>
Date: Fri, 10 Jan 2025 19:38:07 +0100
Subject: [PATCH 14/30] more compact _argparse_epilog

---
 volatility3/cli/__init__.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py
index 87caaece6..37923362a 100644
--- a/volatility3/cli/__init__.py
+++ b/volatility3/cli/__init__.py
@@ -368,9 +368,9 @@ class CommandLine:
                 help=plugin_list[plugin].__doc__,
                 description=plugin_list[plugin].__doc__,
             )
-            epilog = getattr(plugin_list[plugin], "_argparse_epilog", None)
-            if epilog is not None:
-                plugin_parser.epilog = epilog
+            plugin_parser.epilog = getattr(
+                plugin_list[plugin], "_argparse_epilog", None
+            )
             self.populate_requirements_argparse(plugin_parser, plugin_list[plugin])
 
         ###

From 615d1d5a2e85dcd2f9d65493690a474c15f691cd Mon Sep 17 00:00:00 2001
From: Abyss Watcher <abyss-w4tcher@proton.me>
Date: Fri, 10 Jan 2025 19:49:25 +0100
Subject: [PATCH 15/30] more compact _argparse_epilog

---
 volatility3/cli/__init__.py | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py
index 37923362a..fde4fcc6d 100644
--- a/volatility3/cli/__init__.py
+++ b/volatility3/cli/__init__.py
@@ -367,9 +367,7 @@ class CommandLine:
                 plugin,
                 help=plugin_list[plugin].__doc__,
                 description=plugin_list[plugin].__doc__,
-            )
-            plugin_parser.epilog = getattr(
-                plugin_list[plugin], "_argparse_epilog", None
+                epilog=getattr(plugin_list[plugin], "_argparse_epilog", None),
             )
             self.populate_requirements_argparse(plugin_parser, plugin_list[plugin])
 

From a26ff8fa6e6ba03a6ea3ebe6c5f3b38b3a4d8851 Mon Sep 17 00:00:00 2001
From: j-t-1 <120829237+j-t-1@users.noreply.github.com>
Date: Fri, 10 Jan 2025 19:03:51 +0000
Subject: [PATCH 16/30] Small readability improvements

---
 volatility3/framework/automagic/mac.py | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/volatility3/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py
index a883028d2..3b16eb353 100644
--- a/volatility3/framework/automagic/mac.py
+++ b/volatility3/framework/automagic/mac.py
@@ -184,12 +184,12 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
         for offset, banner in offset_generator:
             banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[:2])
 
-            tmp_aslr_shift = offset - cls.virtual_to_physical_address(
+            aslr_shift = offset - cls.virtual_to_physical_address(
                 version_json_address
             )
 
             major_string = context.layers[layer_name].read(
-                version_major_phys_offset + tmp_aslr_shift, 4
+                version_major_phys_offset + aslr_shift, 4
             )
             major = struct.unpack("<I", major_string)[0]
 
@@ -197,17 +197,17 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
                 continue
 
             minor_string = context.layers[layer_name].read(
-                version_minor_phys_offset + tmp_aslr_shift, 4
+                version_minor_phys_offset + aslr_shift, 4
             )
             minor = struct.unpack("<I", minor_string)[0]
 
             if minor != banner_minor:
                 continue
 
-            if tmp_aslr_shift & 0xFFF != 0:
+            if aslr_shift & 0xFFF != 0:
                 continue
 
-            aslr_shift = tmp_aslr_shift & 0xFFFFFFFF
+        aslr_shift &= 0xFFFFFFFF
 
         vollog.log(constants.LOGLEVEL_VVVV, f"Mac find_aslr returned: {aslr_shift:0x}")
 

From 5c21f4a526954ebb4cef2693fd5ae940ac2077a2 Mon Sep 17 00:00:00 2001
From: j-t-1 <120829237+j-t-1@users.noreply.github.com>
Date: Fri, 10 Jan 2025 19:08:56 +0000
Subject: [PATCH 17/30] Small readability improvements

---
 volatility3/framework/automagic/mac.py | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/volatility3/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py
index 3b16eb353..94c259463 100644
--- a/volatility3/framework/automagic/mac.py
+++ b/volatility3/framework/automagic/mac.py
@@ -184,9 +184,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
         for offset, banner in offset_generator:
             banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[:2])
 
-            aslr_shift = offset - cls.virtual_to_physical_address(
-                version_json_address
-            )
+            aslr_shift = offset - cls.virtual_to_physical_address(version_json_address)
 
             major_string = context.layers[layer_name].read(
                 version_major_phys_offset + aslr_shift, 4

From 1cf0232d25fa6dffa21ae3c281e1f568bbb280ab Mon Sep 17 00:00:00 2001
From: Abyss Watcher <abyss-w4tcher@proton.me>
Date: Fri, 10 Jan 2025 21:19:31 +0100
Subject: [PATCH 18/30] less specific argparse epilog reference

---
 volatility3/cli/__init__.py                 | 2 +-
 volatility3/framework/interfaces/plugins.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py
index fde4fcc6d..82a2a4205 100644
--- a/volatility3/cli/__init__.py
+++ b/volatility3/cli/__init__.py
@@ -367,7 +367,7 @@ class CommandLine:
                 plugin,
                 help=plugin_list[plugin].__doc__,
                 description=plugin_list[plugin].__doc__,
-                epilog=getattr(plugin_list[plugin], "_argparse_epilog", None),
+                epilog=plugin_list[plugin].additional_description,
             )
             self.populate_requirements_argparse(plugin_parser, plugin_list[plugin])
 
diff --git a/volatility3/framework/interfaces/plugins.py b/volatility3/framework/interfaces/plugins.py
index 6cd72f02e..7ad78d0ba 100644
--- a/volatility3/framework/interfaces/plugins.py
+++ b/volatility3/framework/interfaces/plugins.py
@@ -112,7 +112,7 @@ class PluginInterface(
     # Be careful with inheritance around this (We default to requiring a version which doesn't exist, so it must be set)
     _required_framework_version: Tuple[int, int, int] = (0, 0, 0)
     """The _version variable is a quick way for plugins to define their current interface, it should follow SemVer rules"""
-    _argparse_epilog: str = None
+    additional_description: str = None
     """Display additional description of the plugin after the description of the arguments. See: https://docs.python.org/3/library/argparse.html#epilog"""
 
     def __init__(

From 7913fb2bb0aac4cc390ce6e42ad6621115f0ae7c Mon Sep 17 00:00:00 2001
From: ikelos <ikelos@users.noreply.github.com>
Date: Fri, 10 Jan 2025 21:07:08 +0000
Subject: [PATCH 19/30] Revert "Small readability improvements"

---
 volatility3/framework/automagic/mac.py | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/volatility3/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py
index 94c259463..f3679d160 100644
--- a/volatility3/framework/automagic/mac.py
+++ b/volatility3/framework/automagic/mac.py
@@ -101,7 +101,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
                 except exceptions.InvalidAddressException:
                     vollog.log(
                         constants.LOGLEVEL_VVVV,
-                        f"Skipping invalid idlepml4_ptr: {idlepml4_ptr:#x}",
+                        f"Skipping invalid idlepml4_ptr: 0x{idlepml4_ptr:0x}",
                     )
                     continue
 
@@ -112,7 +112,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
                 if tmp_dtb % 4096:
                     vollog.log(
                         constants.LOGLEVEL_VVV,
-                        f"Skipping non-page aligned DTB: {tmp_dtb:#x}",
+                        f"Skipping non-page aligned DTB: 0x{tmp_dtb:0x}",
                     )
                     continue
 
@@ -136,7 +136,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
                 new_layer.config["kernel_virtual_offset"] = kaslr_shift
 
             if new_layer and dtb:
-                vollog.debug(f"DTB was found at: {dtb:#x}")
+                vollog.debug(f"DTB was found at: 0x{dtb:0x}")
                 return new_layer
         vollog.debug("No suitable mac banner could be matched")
         return None
@@ -182,12 +182,14 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
         aslr_shift = 0
 
         for offset, banner in offset_generator:
-            banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[:2])
+            banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[0:2])
 
-            aslr_shift = offset - cls.virtual_to_physical_address(version_json_address)
+            tmp_aslr_shift = offset - cls.virtual_to_physical_address(
+                version_json_address
+            )
 
             major_string = context.layers[layer_name].read(
-                version_major_phys_offset + aslr_shift, 4
+                version_major_phys_offset + tmp_aslr_shift, 4
             )
             major = struct.unpack("<I", major_string)[0]
 
@@ -195,17 +197,18 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
                 continue
 
             minor_string = context.layers[layer_name].read(
-                version_minor_phys_offset + aslr_shift, 4
+                version_minor_phys_offset + tmp_aslr_shift, 4
             )
             minor = struct.unpack("<I", minor_string)[0]
 
             if minor != banner_minor:
                 continue
 
-            if aslr_shift & 0xFFF != 0:
+            if tmp_aslr_shift & 0xFFF != 0:
                 continue
 
-        aslr_shift &= 0xFFFFFFFF
+            aslr_shift = tmp_aslr_shift & 0xFFFFFFFF
+            break
 
         vollog.log(constants.LOGLEVEL_VVVV, f"Mac find_aslr returned: {aslr_shift:0x}")
 
@@ -216,9 +219,9 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface):
         """Converts a virtual mac address to a physical one (does not account
         of ASLR)"""
         if addr > 0xFFFFFF8000000000:
-            addr -= 0xFFFFFF8000000000
+            addr = addr - 0xFFFFFF8000000000
         else:
-            addr -= 0xFF8000000000
+            addr = addr - 0xFF8000000000
 
         return addr
 

From 884237534142ec10ba6e7386eedc06ef30d277d0 Mon Sep 17 00:00:00 2001
From: Abyss Watcher <abyss-w4tcher@proton.me>
Date: Fri, 10 Jan 2025 23:28:02 +0100
Subject: [PATCH 20/30] 2.15.0 -> 2.16.0 bump

---
 volatility3/framework/constants/_version.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py
index 2f0c53093..24f96fa89 100644
--- a/volatility3/framework/constants/_version.py
+++ b/volatility3/framework/constants/_version.py
@@ -1,6 +1,6 @@
 # We use the SemVer 2.0.0 versioning scheme
 VERSION_MAJOR = 2  # Number of releases of the library with a breaking change
-VERSION_MINOR = 15  # Number of changes that only add to the interface
+VERSION_MINOR = 16  # Number of changes that only add to the interface
 VERSION_PATCH = 0  # Number of changes that do not change the interface
 VERSION_SUFFIX = ""
 

From 6817d2c765fb5117a8ec6adb92cf343d37a92595 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Mon, 13 Jan 2025 16:00:50 +1100
Subject: [PATCH 21/30] linux: ensure process listing functions yield only
 valid tasks

---
 volatility3/framework/plugins/linux/pslist.py |  5 ++-
 .../symbols/linux/extensions/__init__.py      | 32 +++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py
index 37cf000fc..931acf29a 100644
--- a/volatility3/framework/plugins/linux/pslist.py
+++ b/volatility3/framework/plugins/linux/pslist.py
@@ -34,7 +34,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
     """Lists the processes present in a particular linux memory image."""
 
     _required_framework_version = (2, 13, 0)
-    _version = (4, 0, 0)
+    _version = (4, 1, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -250,6 +250,9 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
 
         # Note that the init_task itself is not yielded, since "ps" also never shows it.
         for task in init_task.tasks:
+            if not task.is_valid():
+                continue
+
             if filter_func(task):
                 continue
 
diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index df1c00e3d..a50b8ae09 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -307,6 +307,36 @@ class module(generic.GenericIntelProcess):
 
 
 class task_struct(generic.GenericIntelProcess):
+    def is_valid(self) -> bool:
+        layer = self._context.layers[self.vol.layer_name]
+        # Make sure the entire task content is readable
+        if not layer.is_valid(self.vol.offset, self.vol.size):
+            return False
+
+        if self.pid < 0:
+            return False
+
+        if not (self.signal and self.signal.is_readable()):
+            return False
+
+        if not (self.nsproxy and self.nsproxy.is_readable()):
+            return False
+
+        if not (self.real_parent and self.real_parent.is_readable()):
+            return False
+
+        if self.active_mm and not self.active_mm.is_readable():
+            return False
+
+        if self.mm:
+            if not self.mm.is_readable():
+                return False
+
+            if self.mm != self.active_mm:
+                return False
+
+        return True
+
     def add_process_layer(
         self, config_prefix: Optional[str] = None, preferred_name: Optional[str] = None
     ) -> Optional[str]:
@@ -401,6 +431,8 @@ class task_struct(generic.GenericIntelProcess):
         tasks_iterable = self._get_tasks_iterable()
         threads_seen = set([self.vol.offset])
         for task in tasks_iterable:
+            if not task.is_valid():
+                continue
             if task.vol.offset not in threads_seen:
                 threads_seen.add(task.vol.offset)
                 yield task

From 093b12b7cdf4a1623a5d534309f0673c0311cc6b Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Mon, 13 Jan 2025 16:52:45 +1100
Subject: [PATCH 22/30] Linux and Windows: Ensure linked list object extensions
 consistently yield valid entries

---
 .../symbols/linux/extensions/__init__.py      | 42 ++++++++++-------
 .../symbols/windows/extensions/__init__.py    | 47 +++++++++----------
 2 files changed, 48 insertions(+), 41 deletions(-)

diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index df1c00e3d..2065b3bb4 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -1209,35 +1209,43 @@ class list_head(objects.StructType, collections.abc.Iterable):
             Objects of the type specified via the "symbol_type" argument.
 
         """
-        layer = layer or self.vol.layer_name
+        layer_name = layer or self.vol.layer_name
+
+        trans_layer = self._context.layers[layer_name]
+        if not trans_layer.is_valid(self.vol.offset):
+            return None
 
         relative_offset = self._context.symbol_space.get_type(
             symbol_type
         ).relative_child_offset(member)
 
-        direction = "prev"
-        if forward:
-            direction = "next"
-        try:
-            link = getattr(self, direction).dereference()
-        except exceptions.InvalidAddressException:
+        direction = "next" if forward else "prev"
+
+        link_ptr = getattr(self, direction)
+        if not (link_ptr and link_ptr.is_readable()):
             return None
+        link = link_ptr.dereference()
+
         if not sentinel:
-            yield self._context.object(
-                symbol_type, layer, offset=self.vol.offset - relative_offset
-            )
+            obj_offset = self.vol.offset - relative_offset
+            if not trans_layer.is_valid(obj_offset):
+                return None
+
+            yield self._context.object(symbol_type, layer_name, offset=obj_offset)
+
         seen = {self.vol.offset}
         while link.vol.offset not in seen:
-            obj = self._context.object(
-                symbol_type, layer, offset=link.vol.offset - relative_offset
-            )
-            yield obj
+            obj_offset = link.vol.offset - relative_offset
+            if not trans_layer.is_valid(obj_offset):
+                return None
+
+            yield self._context.object(symbol_type, layer_name, offset=obj_offset)
 
             seen.add(link.vol.offset)
-            try:
-                link = getattr(link, direction).dereference()
-            except exceptions.InvalidAddressException:
+            link_ptr = getattr(link, direction)
+            if not (link_ptr and link_ptr.is_readable()):
                 break
+            link = link_ptr.dereference()
 
     def __iter__(self) -> Iterator[interfaces.objects.ObjectInterface]:
         return self.to_list(self.vol.parent.vol.type_name, self.vol.member_name)
diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py
index f12fd3f5b..214002f49 100755
--- a/volatility3/framework/symbols/windows/extensions/__init__.py
+++ b/volatility3/framework/symbols/windows/extensions/__init__.py
@@ -962,56 +962,55 @@ class LIST_ENTRY(objects.StructType, collections.abc.Iterable):
     ) -> Iterator[interfaces.objects.ObjectInterface]:
         """Returns an iterator of the entries in the list."""
 
-        layer = layer or self.vol.layer_name
+        layer_name = layer or self.vol.layer_name
+        native_layer_name = layer_name or self.vol.native_layer_name
+
+        trans_layer = self._context.layers[layer_name]
+        if not trans_layer.is_valid(self.vol.offset):
+            return None
 
         relative_offset = self._context.symbol_space.get_type(
             symbol_type
         ).relative_child_offset(member)
 
-        direction = "Blink"
-        if forward:
-            direction = "Flink"
+        direction = "Flink" if forward else "Blink"
 
-        trans_layer = self._context.layers[layer]
-
-        try:
-            is_valid = trans_layer.is_valid(self.vol.offset)
-            if not is_valid:
-                return None
-
-            link = getattr(self, direction).dereference()
-        except exceptions.InvalidAddressException:
+        link_ptr = getattr(self, direction)
+        if not (link_ptr and link_ptr.is_readable()):
             return None
+        link = link_ptr.dereference()
 
         if not sentinel:
+            obj_offset = self.vol.offset - relative_offset
+            if not trans_layer.is_valid(obj_offset):
+                return None
+
             yield self._context.object(
                 symbol_type,
-                layer,
-                offset=self.vol.offset - relative_offset,
-                native_layer_name=layer or self.vol.native_layer_name,
+                layer_name,
+                offset=obj_offset,
+                native_layer_name=native_layer_name,
             )
 
         seen = {self.vol.offset}
         while link.vol.offset not in seen:
             obj_offset = link.vol.offset - relative_offset
-
             if not trans_layer.is_valid(obj_offset):
                 return None
 
-            obj = self._context.object(
+            yield self._context.object(
                 symbol_type,
-                layer,
+                layer_name,
                 offset=obj_offset,
-                native_layer_name=layer or self.vol.native_layer_name,
+                native_layer_name=native_layer_name,
             )
-            yield obj
 
             seen.add(link.vol.offset)
 
-            try:
-                link = getattr(link, direction).dereference()
-            except exceptions.InvalidAddressException:
+            link_ptr = getattr(link, direction)
+            if not (link_ptr and link_ptr.is_readable()):
                 return None
+            link = link_ptr.dereference()
 
     def __iter__(self) -> Iterator[interfaces.objects.ObjectInterface]:
         return self.to_list(self.vol.parent.vol.type_name, self.vol.member_name)

From 0d9715136cc9cc96637996b2bb027a76b8b5e87a Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Mon, 13 Jan 2025 17:13:44 +1100
Subject: [PATCH 23/30] Linux: Ensure VMA enumration functions yield only valid
 objects consistently

---
 .../symbols/linux/extensions/__init__.py      | 46 +++++++++++++------
 1 file changed, 32 insertions(+), 14 deletions(-)

diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index df1c00e3d..61562270a 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -811,23 +811,30 @@ class mm_struct(objects.StructType):
     def _get_mmap_iter(self) -> Iterable[interfaces.objects.ObjectInterface]:
         """Returns an iterator for the mmap list member of an mm_struct. Use this only if
         required, get_vma_iter() will choose the correct _get_maple_tree_iter() or
-        _get_mmap_iter() automatically as required."""
+        _get_mmap_iter() automatically as required.
+
+        Yields:
+            vm_area_struct objects
+        """
 
         if not self.has_member("mmap"):
             raise AttributeError(
                 "_get_mmap_iter called on mm_struct where no mmap member exists."
             )
-        if not self.mmap:
+        vma_pointer = self.mmap
+        if not (vma_pointer and vma_pointer.is_readable()):
             return None
-        yield self.mmap
+        vma_object = vma_pointer.dereference()
+        yield vma_object
 
-        seen = {self.mmap.vol.offset}
-        link = self.mmap.vm_next
+        seen = {vma_pointer}
+        vma_pointer = vma_pointer.vm_next
 
-        while link != 0 and link.vol.offset not in seen:
-            yield link
-            seen.add(link.vol.offset)
-            link = link.vm_next
+        while vma_pointer and vma_pointer.is_readable() and vma_pointer not in seen:
+            vma_object = vma_pointer.dereference()
+            yield vma_object
+            seen.add(vma_pointer)
+            vma_pointer = vma_pointer.vm_next
 
     # TODO: As of version 3.0.0 this method should be removed
     def get_maple_tree_iter(self) -> Iterable[interfaces.objects.ObjectInterface]:
@@ -842,7 +849,11 @@ class mm_struct(objects.StructType):
     def _get_maple_tree_iter(self) -> Iterable[interfaces.objects.ObjectInterface]:
         """Returns an iterator for the mm_mt member of an mm_struct. Use this only if
         required, get_vma_iter() will choose the correct _get_maple_tree_iter() or
-        get_mmap_iter() automatically as required."""
+        get_mmap_iter() automatically as required.
+
+        Yields:
+            vm_area_struct objects
+        """
 
         if not self.has_member("mm_mt"):
             raise AttributeError(
@@ -850,20 +861,27 @@ class mm_struct(objects.StructType):
             )
         symbol_table_name = self.get_symbol_table_name()
         for vma_pointer in self.mm_mt.get_slot_iter():
-            # convert pointer to vm_area_struct and yield
-            vma = self._context.object(
+            # Convert pointer to vm_area_struct and yield
+            vma_object = self._context.object(
                 symbol_table_name + constants.BANG + "vm_area_struct",
                 layer_name=self.vol.native_layer_name,
                 offset=vma_pointer,
             )
-            yield vma
+            yield vma_object
 
     def get_vma_iter(self) -> Iterable[interfaces.objects.ObjectInterface]:
-        """Returns an iterator for the VMAs in an mm_struct. Automatically choosing the mmap or mm_mt as required."""
+        """Returns an iterator for the VMAs in an mm_struct.
+        Automatically choosing the mmap or mm_mt as required.
+
+        Yields:
+            vm_area_struct objects
+        """
 
         if self.has_member("mmap"):
+            # kernels < 6.1
             yield from self._get_mmap_iter()
         elif self.has_member("mm_mt"):
+            # kernels >= 6.1 d4af56c5c7c6781ca6ca8075e2cf5bc119ed33d1
             yield from self._get_maple_tree_iter()
         else:
             raise AttributeError("Unable to find mmap or mm_mt in mm_struct")

From 8bc04529350c3ce5a927099a72bc4e419a049db5 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Tue, 14 Jan 2025 11:21:23 +1100
Subject: [PATCH 24/30] linux: Improve compatibility with ancient kernels

---
 .../symbols/linux/extensions/__init__.py       | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index a50b8ae09..4a1a263dd 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -316,16 +316,26 @@ class task_struct(generic.GenericIntelProcess):
         if self.pid < 0:
             return False
 
-        if not (self.signal and self.signal.is_readable()):
+        if self.has_member("signal") and not (
+            self.signal and self.signal.is_readable()
+        ):
             return False
 
-        if not (self.nsproxy and self.nsproxy.is_readable()):
+        if self.has_member("nsproxy") and not (
+            self.nsproxy and self.nsproxy.is_readable()
+        ):
             return False
 
-        if not (self.real_parent and self.real_parent.is_readable()):
+        if self.has_member("real_parent") and not (
+            self.real_parent and self.real_parent.is_readable()
+        ):
             return False
 
-        if self.active_mm and not self.active_mm.is_readable():
+        if (
+            self.has_member("active_mm")
+            and self.active_mm
+            and not self.active_mm.is_readable()
+        ):
             return False
 
         if self.mm:

From 7fc2af5b4ecf4b1ced5c71357d164981b05ed309 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Tue, 14 Jan 2025 11:39:48 +1100
Subject: [PATCH 25/30] linux: Add an additional quick check before validating
 pointer readability

---
 volatility3/framework/symbols/linux/extensions/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index 4a1a263dd..e2c9454f6 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -313,7 +313,7 @@ class task_struct(generic.GenericIntelProcess):
         if not layer.is_valid(self.vol.offset, self.vol.size):
             return False
 
-        if self.pid < 0:
+        if self.pid < 0 or self.tgid < 0:
             return False
 
         if self.has_member("signal") and not (

From 1a84f96c70060bc09aab3c1b3348d980f8b9bc0e Mon Sep 17 00:00:00 2001
From: Kerry Goodwine <cgoodwine@volexity.com>
Date: Thu, 9 Jan 2025 15:49:24 -0500
Subject: [PATCH 26/30] Actions: Add new workflow for generating windows EXEs
 with pyinstaller

---
 .github/workflows/build-pyinstaller.yml | 50 +++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 .github/workflows/build-pyinstaller.yml

diff --git a/.github/workflows/build-pyinstaller.yml b/.github/workflows/build-pyinstaller.yml
new file mode 100644
index 000000000..bcba95403
--- /dev/null
+++ b/.github/workflows/build-pyinstaller.yml
@@ -0,0 +1,50 @@
+name: build-pyinstaller
+on:
+  push:
+    branches:
+      - stable
+      - develop
+      - 'release/**'
+  pull_request:
+    branches:
+      - stable
+      - 'release/**'
+
+jobs:
+
+  exe:
+    runs-on: windows-latest
+    strategy:
+      matrix:
+        python-version: ["3.11"]
+    steps:
+    - uses: actions/checkout@v3
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v4
+      with:
+        python-version: ${{ matrix.python-version }}
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install pyinstaller
+    
+    - name: Pyinstall executable
+      run: |
+        pyinstaller --clean -y vol.spec
+        pyinstaller --clean -y volshell.spec
+
+    - name: Move files
+      run: |
+        mv dist/vol.exe vol.exe
+        mv dist/volshell.exe volshell.exe
+
+    - name: Archive 
+      uses: actions/upload-artifact@v4
+      with:
+        name: volatility3-pyinstaller
+        path: |
+          vol.exe
+          volshell.exe
+          README.md
+          LICENSE.txt

From 9f08af47b161579bf31f9d45c8b248c23861388a Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Wed, 15 Jan 2025 12:51:52 +1100
Subject: [PATCH 27/30] Linux: Add support for Intel 32bit with PAE

---
 volatility3/framework/automagic/linux.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py
index f22cae012..542d26a8d 100644
--- a/volatility3/framework/automagic/linux.py
+++ b/volatility3/framework/automagic/linux.py
@@ -71,6 +71,12 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface):
                 elif "init_level4_pgt" in table.symbols:
                     layer_class = intel.LinuxIntel32e
                     dtb_symbol_name = "init_level4_pgt"
+                elif (
+                    "pkmap_count" in table.symbols
+                    and table.get_symbol("pkmap_count").type.count == 512
+                ):
+                    layer_class = intel.LinuxIntelPAE
+                    dtb_symbol_name = "swapper_pg_dir"
                 else:
                     layer_class = intel.LinuxIntel
                     dtb_symbol_name = "swapper_pg_dir"

From 28c74f8c1b853df3680de14f6fdc22958516a9c2 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Wed, 15 Jan 2025 13:23:39 +1100
Subject: [PATCH 28/30] Linux: Add support for Intel 32bit with PAE in early
 kernels, including versions 2.3.27 and 2.3.28.

---
 volatility3/framework/automagic/linux.py | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py
index 542d26a8d..cb4f3cc64 100644
--- a/volatility3/framework/automagic/linux.py
+++ b/volatility3/framework/automagic/linux.py
@@ -71,10 +71,9 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface):
                 elif "init_level4_pgt" in table.symbols:
                     layer_class = intel.LinuxIntel32e
                     dtb_symbol_name = "init_level4_pgt"
-                elif (
-                    "pkmap_count" in table.symbols
-                    and table.get_symbol("pkmap_count").type.count == 512
-                ):
+                elif "pkmap_count" in table.symbols and table.get_symbol(
+                    "pkmap_count"
+                ).type.count in (512, 2048):
                     layer_class = intel.LinuxIntelPAE
                     dtb_symbol_name = "swapper_pg_dir"
                 else:

From b27f98fed258b597e043a5c80304d8489da27b32 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Wed, 15 Jan 2025 14:37:35 +1100
Subject: [PATCH 29/30] linux: pslist: fix task credentials rendering

---
 volatility3/framework/plugins/linux/pslist.py | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py
index 37cf000fc..77b57e000 100644
--- a/volatility3/framework/plugins/linux/pslist.py
+++ b/volatility3/framework/plugins/linux/pslist.py
@@ -179,6 +179,10 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
                 file_output = "VMA start matching task start_code not found"
         return file_output
 
+    @staticmethod
+    def _format_cred(cred):
+        return renderers.NotAvailableValue() if cred is None else cred
+
     def _generator(
         self,
         pid_filter: Callable[[Any], bool],
@@ -212,16 +216,21 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
 
             task_fields = self.get_task_fields(task, decorate_comm)
 
+            task_uid = self._format_cred(task_fields.uid)
+            task_gid = self._format_cred(task_fields.gid)
+            task_euid = self._format_cred(task_fields.euid)
+            task_egid = self._format_cred(task_fields.egid)
+
             yield 0, (
                 format_hints.Hex(task_fields.offset),
                 task_fields.user_pid,
                 task_fields.user_tid,
                 task_fields.user_ppid,
                 task_fields.name,
-                task_fields.uid or renderers.NotAvailableValue(),
-                task_fields.gid or renderers.NotAvailableValue(),
-                task_fields.euid or renderers.NotAvailableValue(),
-                task_fields.egid or renderers.NotAvailableValue(),
+                task_uid,
+                task_gid,
+                task_euid,
+                task_egid,
                 task_fields.creation_time or renderers.NotAvailableValue(),
                 file_output,
             )

From adf81bc74a388d6ff5bffabe588bc5ca72147506 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Thu, 16 Jan 2025 19:59:31 +0000
Subject: [PATCH 30/30] Update copyright dates

---
 README.md          | 2 +-
 doc/source/conf.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index cc33d3cc4..b74bdab0b 100644
--- a/README.md
+++ b/README.md
@@ -88,7 +88,7 @@ The latest generated copy of the documentation can be found at: <https://volatil
 
 ## Licensing and Copyright
 
-Copyright (C) 2007-2024 Volatility Foundation
+Copyright (C) 2007-2025 Volatility Foundation
 
 All Rights Reserved
 
diff --git a/doc/source/conf.py b/doc/source/conf.py
index 7a9a72891..ca868aff1 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -167,7 +167,7 @@ master_doc = "index"
 
 # General information about the project.
 project = "Volatility 3"
-copyright = "2012-2024, Volatility Foundation"
+copyright = "2012-2025, Volatility Foundation"
 
 # The version info for the project you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the