This is in contrast to volatility-2.x where object were automatically
instantiated with a native_vm (or native_layer in 3.x parlance) and then
any dereferences occurred in the correct layer.
The space savings are now minimal since each object carries around only
a layer name, and not a reference to the entire space. However, given
situations such as kernel structures containing pointers into
process spaces, where the native_vm is useless, this decision is
designed to make working on a particular layer explicit and therefore
more obvious. It may mean exposing that up through levels of functions,
but hopefully it will make all the code more obvious and less
automagical.
Mike Auty