Files
volatility3/volatility3
David McDonald 079d2801f5 ShimcacheMem: Fix offset tracking
This fixes a bug in the plugin logic that causes valid entries to be
excluded in the following scenario:

- An entry is discovered but deemed invalid due to unreadable
  size/timestamps.
- The offset gets placed into the `seen` tracking set anyway
- Another entry (this time, with valid filesize/timestamps) with the
  same physical offset is encountered, but is skipped because this
  offset is already in the `seen` tracking set.

This updates the logic to only add the offset to the tracker if the
shimcache entry is valid.
2025-04-14 11:43:57 -05:00
..
2025-04-07 16:18:22 -05:00