Regexscan fixes #1829

SolitudePy · 2025-06-07T08:51:31Z

use maxsize argument
switched match to search to search the whole chunk
moved some code from _generator() to run() to reduce overhead

ikelos

Thanks for this, shift the regex compilaytion back into the generator to avoid potential skew. I'm also unkeen on the utf-8/latin1 munging for the sake of it. Otherwise good catch on maxsize not being used

volatility3/framework/plugins/regexscan.py

ikelos · 2025-06-11T13:17:32Z

volatility3/framework/plugins/regexscan.py


            # reapply the regex in order to extract just the match
-            regex_result = re.match(regex_pattern, result_data)
+            regex_result = compiled_pattern.search(result_data)


The need for this is somewhat annoying, but probably can't be improved at this point without breaking the regexscanner...

volatility3/framework/plugins/regexscan.py

ikelos

Looks much better, thanks. Just a couple more tweaks, nearly there 5:)

SolitudePy added 3 commits June 6, 2025 23:55

use maxsize argument

306b7ff

use search instead of match

f01310c

generator overhead

eba4e4b