.

gitignore
.readthedocs.yml
API_CHANGES.md
CITATION.cff
CODING_STYLE.md
LICENSE.txt
MANIFEST.in
README.md
pyproject.toml
vol.py
vol.spec
volshell.py
volshell.spec
doc/Makefile
doc/make.bat
doc/source/basics.rst
doc/source/complex-plugin.rst
doc/source/conf.py
doc/source/development.rst
doc/source/getting-started-linux-tutorial.rst
doc/source/getting-started-mac-tutorial.rst
doc/source/getting-started-windows-tutorial.rst
doc/source/glossary.rst
doc/source/index.rst
doc/source/simple-plugin.rst
doc/source/symbol-tables.rst
doc/source/using-as-a-library.rst
doc/source/vol-cli.rst
doc/source/vol2to3.rst
doc/source/volshell.rst
doc/source/_static/favicon.ico
doc/source/_static/vol.png
test/test_volatility.py
volatility3/__init__.py
volatility3.egg-info/PKG-INFO
volatility3.egg-info/SOURCES.txt
volatility3.egg-info/dependency_links.txt
volatility3.egg-info/entry_points.txt
volatility3.egg-info/requires.txt
volatility3.egg-info/top_level.txt
volatility3/cli/__init__.py
volatility3/cli/text_filter.py
volatility3/cli/text_renderer.py
volatility3/cli/volargparse.py
volatility3/cli/volshell/__init__.py
volatility3/cli/volshell/generic.py
volatility3/cli/volshell/linux.py
volatility3/cli/volshell/mac.py
volatility3/cli/volshell/windows.py
volatility3/framework/__init__.py
volatility3/framework/deprecation.py
volatility3/framework/exceptions.py
volatility3/framework/automagic/__init__.py
volatility3/framework/automagic/construct_layers.py
volatility3/framework/automagic/linux.py
volatility3/framework/automagic/mac.py
volatility3/framework/automagic/module.py
volatility3/framework/automagic/pdbscan.py
volatility3/framework/automagic/stacker.py
volatility3/framework/automagic/symbol_cache.py
volatility3/framework/automagic/symbol_finder.py
volatility3/framework/automagic/windows.py
volatility3/framework/configuration/__init__.py
volatility3/framework/configuration/requirements.py
volatility3/framework/constants/__init__.py
volatility3/framework/constants/_version.py
volatility3/framework/constants/architectures.py
volatility3/framework/constants/linux/__init__.py
volatility3/framework/constants/windows/__init__.py
volatility3/framework/contexts/__init__.py
volatility3/framework/interfaces/__init__.py
volatility3/framework/interfaces/automagic.py
volatility3/framework/interfaces/configuration.py
volatility3/framework/interfaces/context.py
volatility3/framework/interfaces/layers.py
volatility3/framework/interfaces/objects.py
volatility3/framework/interfaces/plugins.py
volatility3/framework/interfaces/renderers.py
volatility3/framework/interfaces/symbols.py
volatility3/framework/layers/__init__.py
volatility3/framework/layers/avml.py
volatility3/framework/layers/cloudstorage.py
volatility3/framework/layers/crash.py
volatility3/framework/layers/elf.py
volatility3/framework/layers/intel.py
volatility3/framework/layers/leechcore.py
volatility3/framework/layers/lime.py
volatility3/framework/layers/linear.py
volatility3/framework/layers/msf.py
volatility3/framework/layers/physical.py
volatility3/framework/layers/qemu.py
volatility3/framework/layers/registry.py
volatility3/framework/layers/resources.py
volatility3/framework/layers/segmented.py
volatility3/framework/layers/vmware.py
volatility3/framework/layers/xen.py
volatility3/framework/layers/codecs/__init__.py
volatility3/framework/layers/scanners/__init__.py
volatility3/framework/layers/scanners/multiregexp.py
volatility3/framework/objects/__init__.py
volatility3/framework/objects/templates.py
volatility3/framework/objects/utility.py
volatility3/framework/plugins/__init__.py
volatility3/framework/plugins/banners.py
volatility3/framework/plugins/configwriter.py
volatility3/framework/plugins/frameworkinfo.py
volatility3/framework/plugins/isfinfo.py
volatility3/framework/plugins/layerwriter.py
volatility3/framework/plugins/regexscan.py
volatility3/framework/plugins/timeliner.py
volatility3/framework/plugins/vmscan.py
volatility3/framework/plugins/yarascan.py
volatility3/framework/plugins/linux/__init__.py
volatility3/framework/plugins/linux/bash.py
volatility3/framework/plugins/linux/boottime.py
volatility3/framework/plugins/linux/capabilities.py
volatility3/framework/plugins/linux/check_afinfo.py
volatility3/framework/plugins/linux/check_creds.py
volatility3/framework/plugins/linux/check_idt.py
volatility3/framework/plugins/linux/check_modules.py
volatility3/framework/plugins/linux/check_syscall.py
volatility3/framework/plugins/linux/ebpf.py
volatility3/framework/plugins/linux/elfs.py
volatility3/framework/plugins/linux/envars.py
volatility3/framework/plugins/linux/hidden_modules.py
volatility3/framework/plugins/linux/iomem.py
volatility3/framework/plugins/linux/ip.py
volatility3/framework/plugins/linux/kallsyms.py
volatility3/framework/plugins/linux/keyboard_notifiers.py
volatility3/framework/plugins/linux/kmsg.py
volatility3/framework/plugins/linux/kthreads.py
volatility3/framework/plugins/linux/library_list.py
volatility3/framework/plugins/linux/lsmod.py
volatility3/framework/plugins/linux/lsof.py
volatility3/framework/plugins/linux/malfind.py
volatility3/framework/plugins/linux/module_extract.py
volatility3/framework/plugins/linux/modxview.py
volatility3/framework/plugins/linux/mountinfo.py
volatility3/framework/plugins/linux/netfilter.py
volatility3/framework/plugins/linux/pagecache.py
volatility3/framework/plugins/linux/pidhashtable.py
volatility3/framework/plugins/linux/proc.py
volatility3/framework/plugins/linux/psaux.py
volatility3/framework/plugins/linux/pscallstack.py
volatility3/framework/plugins/linux/pslist.py
volatility3/framework/plugins/linux/psscan.py
volatility3/framework/plugins/linux/pstree.py
volatility3/framework/plugins/linux/ptrace.py
volatility3/framework/plugins/linux/sockstat.py
volatility3/framework/plugins/linux/tty_check.py
volatility3/framework/plugins/linux/vmaregexscan.py
volatility3/framework/plugins/linux/vmayarascan.py
volatility3/framework/plugins/linux/vmcoreinfo.py
volatility3/framework/plugins/linux/graphics/fbdev.py
volatility3/framework/plugins/linux/tracing/__init__.py
volatility3/framework/plugins/linux/tracing/ftrace.py
volatility3/framework/plugins/linux/tracing/perf_events.py
volatility3/framework/plugins/linux/tracing/tracepoints.py
volatility3/framework/plugins/mac/__init__.py
volatility3/framework/plugins/mac/bash.py
volatility3/framework/plugins/mac/check_syscall.py
volatility3/framework/plugins/mac/check_sysctl.py
volatility3/framework/plugins/mac/check_trap_table.py
volatility3/framework/plugins/mac/dmesg.py
volatility3/framework/plugins/mac/ifconfig.py
volatility3/framework/plugins/mac/kauth_listeners.py
volatility3/framework/plugins/mac/kauth_scopes.py
volatility3/framework/plugins/mac/kevents.py
volatility3/framework/plugins/mac/list_files.py
volatility3/framework/plugins/mac/lsmod.py
volatility3/framework/plugins/mac/lsof.py
volatility3/framework/plugins/mac/malfind.py
volatility3/framework/plugins/mac/mount.py
volatility3/framework/plugins/mac/netstat.py
volatility3/framework/plugins/mac/proc_maps.py
volatility3/framework/plugins/mac/psaux.py
volatility3/framework/plugins/mac/pslist.py
volatility3/framework/plugins/mac/pstree.py
volatility3/framework/plugins/mac/socket_filters.py
volatility3/framework/plugins/mac/timers.py
volatility3/framework/plugins/mac/trustedbsd.py
volatility3/framework/plugins/mac/vfsevents.py
volatility3/framework/plugins/windows/__init__.py
volatility3/framework/plugins/windows/amcache.py
volatility3/framework/plugins/windows/bigpools.py
volatility3/framework/plugins/windows/cachedump.py
volatility3/framework/plugins/windows/callbacks.py
volatility3/framework/plugins/windows/cmdline.py
volatility3/framework/plugins/windows/cmdscan.py
volatility3/framework/plugins/windows/consoles.py
volatility3/framework/plugins/windows/crashinfo.py
volatility3/framework/plugins/windows/debugregisters.py
volatility3/framework/plugins/windows/deskscan.py
volatility3/framework/plugins/windows/desktops.py
volatility3/framework/plugins/windows/devicetree.py
volatility3/framework/plugins/windows/direct_system_calls.py
volatility3/framework/plugins/windows/dlllist.py
volatility3/framework/plugins/windows/driverirp.py
volatility3/framework/plugins/windows/drivermodule.py
volatility3/framework/plugins/windows/driverscan.py
volatility3/framework/plugins/windows/dumpfiles.py
volatility3/framework/plugins/windows/envars.py
volatility3/framework/plugins/windows/etwpatch.py
volatility3/framework/plugins/windows/filescan.py
volatility3/framework/plugins/windows/getservicesids.py
volatility3/framework/plugins/windows/getsids.py
volatility3/framework/plugins/windows/handles.py
volatility3/framework/plugins/windows/hashdump.py
volatility3/framework/plugins/windows/hollowprocesses.py
volatility3/framework/plugins/windows/iat.py
volatility3/framework/plugins/windows/indirect_system_calls.py
volatility3/framework/plugins/windows/info.py
volatility3/framework/plugins/windows/joblinks.py
volatility3/framework/plugins/windows/kpcrs.py
volatility3/framework/plugins/windows/ldrmodules.py
volatility3/framework/plugins/windows/lsadump.py
volatility3/framework/plugins/windows/malfind.py
volatility3/framework/plugins/windows/mbrscan.py
volatility3/framework/plugins/windows/memmap.py
volatility3/framework/plugins/windows/mftscan.py
volatility3/framework/plugins/windows/modscan.py
volatility3/framework/plugins/windows/modules.py
volatility3/framework/plugins/windows/mutantscan.py
volatility3/framework/plugins/windows/netscan.py
volatility3/framework/plugins/windows/netstat.py
volatility3/framework/plugins/windows/orphan_kernel_threads.py
volatility3/framework/plugins/windows/pe_symbols.py
volatility3/framework/plugins/windows/pedump.py
volatility3/framework/plugins/windows/poolscanner.py
volatility3/framework/plugins/windows/privileges.py
volatility3/framework/plugins/windows/processghosting.py
volatility3/framework/plugins/windows/pslist.py
volatility3/framework/plugins/windows/psscan.py
volatility3/framework/plugins/windows/pstree.py
volatility3/framework/plugins/windows/psxview.py
volatility3/framework/plugins/windows/scheduled_tasks.py
volatility3/framework/plugins/windows/sessions.py
volatility3/framework/plugins/windows/shimcachemem.py
volatility3/framework/plugins/windows/sids_and_privileges.json
volatility3/framework/plugins/windows/skeleton_key_check.py
volatility3/framework/plugins/windows/ssdt.py
volatility3/framework/plugins/windows/strings.py
volatility3/framework/plugins/windows/suspended_threads.py
volatility3/framework/plugins/windows/suspicious_threads.py
volatility3/framework/plugins/windows/svcdiff.py
volatility3/framework/plugins/windows/svclist.py
volatility3/framework/plugins/windows/svcscan.py
volatility3/framework/plugins/windows/symlinkscan.py
volatility3/framework/plugins/windows/thrdscan.py
volatility3/framework/plugins/windows/threads.py
volatility3/framework/plugins/windows/timers.py
volatility3/framework/plugins/windows/truecrypt.py
volatility3/framework/plugins/windows/unhooked_system_calls.py
volatility3/framework/plugins/windows/unloadedmodules.py
volatility3/framework/plugins/windows/vadinfo.py
volatility3/framework/plugins/windows/vadregexscan.py
volatility3/framework/plugins/windows/vadwalk.py
volatility3/framework/plugins/windows/vadyarascan.py
volatility3/framework/plugins/windows/verinfo.py
volatility3/framework/plugins/windows/virtmap.py
volatility3/framework/plugins/windows/windows.py
volatility3/framework/plugins/windows/windowstations.py
volatility3/framework/plugins/windows/registry/__init__.py
volatility3/framework/plugins/windows/registry/amcache.py
volatility3/framework/plugins/windows/registry/cachedump.py
volatility3/framework/plugins/windows/registry/getcellroutine.py
volatility3/framework/plugins/windows/registry/hashdump.py
volatility3/framework/plugins/windows/registry/hivelist.py
volatility3/framework/plugins/windows/registry/hivescan.py
volatility3/framework/plugins/windows/registry/lsadump.py
volatility3/framework/plugins/windows/registry/printkey.py
volatility3/framework/plugins/windows/registry/scheduled_tasks.py
volatility3/framework/plugins/windows/registry/userassist.json
volatility3/framework/plugins/windows/registry/userassist.py
volatility3/framework/renderers/__init__.py
volatility3/framework/renderers/conversion.py
volatility3/framework/renderers/format_hints.py
volatility3/framework/symbols/__init__.py
volatility3/framework/symbols/intermed.py
volatility3/framework/symbols/metadata.py
volatility3/framework/symbols/native.py
volatility3/framework/symbols/wrappers.py
volatility3/framework/symbols/generic/__init__.py
volatility3/framework/symbols/generic/qemu.json
volatility3/framework/symbols/linux/__init__.py
volatility3/framework/symbols/linux/bash.py
volatility3/framework/symbols/linux/bash32.json
volatility3/framework/symbols/linux/bash64.json
volatility3/framework/symbols/linux/elf.json
volatility3/framework/symbols/linux/kallsyms.py
volatility3/framework/symbols/linux/network.py
volatility3/framework/symbols/linux/xen.json
volatility3/framework/symbols/linux/extensions/__init__.py
volatility3/framework/symbols/linux/extensions/bash.py
volatility3/framework/symbols/linux/extensions/elf.py
volatility3/framework/symbols/linux/extensions/network.py
volatility3/framework/symbols/linux/utilities/__init__.py
volatility3/framework/symbols/linux/utilities/module_extract.py
volatility3/framework/symbols/linux/utilities/modules.py
volatility3/framework/symbols/linux/utilities/tainting.py
volatility3/framework/symbols/mac/__init__.py
volatility3/framework/symbols/mac/extensions/__init__.py
volatility3/framework/symbols/windows/__init__.py
volatility3/framework/symbols/windows/callbacks-x64.json
volatility3/framework/symbols/windows/callbacks-x86.json
volatility3/framework/symbols/windows/crash.json
volatility3/framework/symbols/windows/crash64.json
volatility3/framework/symbols/windows/crash_common.json
volatility3/framework/symbols/windows/kdbg.json
volatility3/framework/symbols/windows/kerb_ecrypt.json
volatility3/framework/symbols/windows/mbr.json
volatility3/framework/symbols/windows/mft.json
volatility3/framework/symbols/windows/pdb.json
volatility3/framework/symbols/windows/pdbconv.py
volatility3/framework/symbols/windows/pdbutil.py
volatility3/framework/symbols/windows/pe.json
volatility3/framework/symbols/windows/poolheader-x64-win7.json
volatility3/framework/symbols/windows/poolheader-x64.json
volatility3/framework/symbols/windows/poolheader-x86.json
volatility3/framework/symbols/windows/registry.json
volatility3/framework/symbols/windows/unloadedmodules-x64.json
volatility3/framework/symbols/windows/unloadedmodules-x86.json
volatility3/framework/symbols/windows/versions.py
volatility3/framework/symbols/windows/wow64.json
volatility3/framework/symbols/windows/bigpools/bigpools-vista-x64.json
volatility3/framework/symbols/windows/bigpools/bigpools-vista-x86.json
volatility3/framework/symbols/windows/bigpools/bigpools-win10-x64.json
volatility3/framework/symbols/windows/bigpools/bigpools-win10-x86.json
volatility3/framework/symbols/windows/bigpools/bigpools-x64.json
volatility3/framework/symbols/windows/bigpools/bigpools-x86.json
volatility3/framework/symbols/windows/consoles/consoles-win10-17763-3232-x64.json
volatility3/framework/symbols/windows/consoles/consoles-win10-17763-x64.json
volatility3/framework/symbols/windows/consoles/consoles-win10-18362-x64.json
volatility3/framework/symbols/windows/consoles/consoles-win10-19041-x64.json
volatility3/framework/symbols/windows/consoles/consoles-win10-20348-1970-x64.json
volatility3/framework/symbols/windows/consoles/consoles-win10-20348-2461-x64.json
volatility3/framework/symbols/windows/consoles/consoles-win10-20348-x64.json
volatility3/framework/symbols/windows/consoles/consoles-win10-22000-x64.json
volatility3/framework/symbols/windows/consoles/consoles-win10-22621-3527-x64.json
volatility3/framework/symbols/windows/consoles/consoles-win10-22621-x64.json
volatility3/framework/symbols/windows/consoles/consoles-win10-25398-x64.json
volatility3/framework/symbols/windows/extensions/__init__.py
volatility3/framework/symbols/windows/extensions/callbacks.py
volatility3/framework/symbols/windows/extensions/consoles.py
volatility3/framework/symbols/windows/extensions/crash.py
volatility3/framework/symbols/windows/extensions/gui.py
volatility3/framework/symbols/windows/extensions/kdbg.py
volatility3/framework/symbols/windows/extensions/mbr.py
volatility3/framework/symbols/windows/extensions/mft.py
volatility3/framework/symbols/windows/extensions/network.py
volatility3/framework/symbols/windows/extensions/pe.py
volatility3/framework/symbols/windows/extensions/pool.py
volatility3/framework/symbols/windows/extensions/registry.py
volatility3/framework/symbols/windows/extensions/services.py
volatility3/framework/symbols/windows/extensions/shimcache.py
volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json
volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json
volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json
volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json
volatility3/framework/symbols/windows/gui/gui-win10-17735-x64.json
volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json
volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json
volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json
volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json
volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json
volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json
volatility3/framework/symbols/windows/gui/gui-win8-x64.json
volatility3/framework/symbols/windows/netscan/netscan-vista-sp12-x64.json
volatility3/framework/symbols/windows/netscan/netscan-vista-x64.json
volatility3/framework/symbols/windows/netscan/netscan-vista-x86.json
volatility3/framework/symbols/windows/netscan/netscan-win10-10240-x86.json
volatility3/framework/symbols/windows/netscan/netscan-win10-10586-x86.json
volatility3/framework/symbols/windows/netscan/netscan-win10-14393-x86.json
volatility3/framework/symbols/windows/netscan/netscan-win10-15063-x64.json
volatility3/framework/symbols/windows/netscan/netscan-win10-15063-x86.json
volatility3/framework/symbols/windows/netscan/netscan-win10-16299-x64.json
volatility3/framework/symbols/windows/netscan/netscan-win10-17134-x64.json
volatility3/framework/symbols/windows/netscan/netscan-win10-17134-x86.json
volatility3/framework/symbols/windows/netscan/netscan-win10-17763-x64.json
volatility3/framework/symbols/windows/netscan/netscan-win10-18362-x64.json
volatility3/framework/symbols/windows/netscan/netscan-win10-18363-x64.json
volatility3/framework/symbols/windows/netscan/netscan-win10-19041-x64.json
volatility3/framework/symbols/windows/netscan/netscan-win10-19041-x86.json
volatility3/framework/symbols/windows/netscan/netscan-win10-20348-x64.json
volatility3/framework/symbols/windows/netscan/netscan-win10-x64.json
volatility3/framework/symbols/windows/netscan/netscan-win7-x64.json
volatility3/framework/symbols/windows/netscan/netscan-win7-x86.json
volatility3/framework/symbols/windows/netscan/netscan-win8-x64.json
volatility3/framework/symbols/windows/netscan/netscan-win8-x86.json
volatility3/framework/symbols/windows/netscan/netscan-win81-19935-x64.json
volatility3/framework/symbols/windows/netscan/netscan-win81-x64.json
volatility3/framework/symbols/windows/netscan/netscan-win81-x86.json
volatility3/framework/symbols/windows/services/services-vista-x64.json
volatility3/framework/symbols/windows/services/services-vista-x86.json
volatility3/framework/symbols/windows/services/services-win10-15063-x64.json
volatility3/framework/symbols/windows/services/services-win10-15063-x86.json
volatility3/framework/symbols/windows/services/services-win10-16299-x64.json
volatility3/framework/symbols/windows/services/services-win10-16299-x86.json
volatility3/framework/symbols/windows/services/services-win10-17763-x86.json
volatility3/framework/symbols/windows/services/services-win10-18362-x64.json
volatility3/framework/symbols/windows/services/services-win10-18362-x86.json
volatility3/framework/symbols/windows/services/services-win10-19041-x64.json
volatility3/framework/symbols/windows/services/services-win10-19041-x86.json
volatility3/framework/symbols/windows/services/services-win10-25398-x64.json
volatility3/framework/symbols/windows/services/services-win8-x64.json
volatility3/framework/symbols/windows/services/services-win8-x86.json
volatility3/framework/symbols/windows/services/services-xp-2003-x64.json
volatility3/framework/symbols/windows/services/services-xp-x86.json
volatility3/framework/symbols/windows/shimcache/shimcache-2003-x64.json
volatility3/framework/symbols/windows/shimcache/shimcache-2003-x86.json
volatility3/framework/symbols/windows/shimcache/shimcache-vista-x64.json
volatility3/framework/symbols/windows/shimcache/shimcache-vista-x86.json
volatility3/framework/symbols/windows/shimcache/shimcache-win10-x64.json
volatility3/framework/symbols/windows/shimcache/shimcache-win10-x86.json
volatility3/framework/symbols/windows/shimcache/shimcache-win7-x64.json
volatility3/framework/symbols/windows/shimcache/shimcache-win7-x86.json
volatility3/framework/symbols/windows/shimcache/shimcache-win8-x64.json
volatility3/framework/symbols/windows/shimcache/shimcache-win8-x86.json
volatility3/framework/symbols/windows/shimcache/shimcache-xp-sp2-x86.json
volatility3/framework/symbols/windows/shimcache/shimcache-xp-sp3-x86.json
volatility3/plugins/__init__.py
volatility3/plugins/linux/__init__.py
volatility3/plugins/mac/__init__.py
volatility3/plugins/windows/__init__.py
volatility3/plugins/windows/statistics.py
volatility3/plugins/windows/registry/__init__.py
volatility3/plugins/windows/registry/certificates.py
volatility3/schemas/__init__.py
volatility3/schemas/schema-0.1.0.json
volatility3/schemas/schema-2.0.0.json
volatility3/schemas/schema-2.1.0.json
volatility3/schemas/schema-4.0.0.json
volatility3/schemas/schema-4.1.0.json
volatility3/schemas/schema-6.0.0.json
volatility3/schemas/schema-6.1.0.json
volatility3/schemas/schema-6.2.0.json
volatility3/schemas/schema-6.3.0.json
volatility3/symbols/__init__.py
volatility3/symbols/generic/vmcs/haswell-architecture.json
volatility3/symbols/generic/vmcs/nehalem-architecture.json
volatility3/symbols/generic/vmcs/sandybridge-architecture.json
volatility3/symbols/generic/vmcs/skylake-architecture.json
volatility3/symbols/generic/vmcs/westmere-architecture.json