add a comment to yarascan which explains why module lookups will fail when operating in kernelmode on x64. it'll be a known issue of the plugin for 2.1, after which time we'll update trunk's Pointer.v() and be able to test more thoroughly before a release

volatility/plugins/malware/malfind.py

@@ -379,9 +379,18 @@ class YaraScan(taskmods.DllList):
             # the starting range is 0x80000000 because we may be dealing with
             # an image with the /3GB boot switch. 
             kdbg = tasks.get_kdbg(addr_space)
-            start = kdbg.MmSystemRangeStart.dereference_as("address")
 
-            # Addresses should be truncated to 48 bits.
+            # FIXME: Addresses should be truncated to 48 bits. Currently
+            # we do that in Pointer.__eq__ but not in Pointer.v(). This prevents
+            # module lookups in yarascan's --kernel mode on x64 from working
+            # properly because win32.tasks.find_module cannot match the truncated
+            # address with non-truncated mod.DllBase.v(). Changing Pointer.v()
+            # could have wide spread effects, so this yarascan issue will need to
+            # be a "known issue" for 2.1 and we'll fix it immediately after, so 
+            # code moving forward handles it right. In particular, after fixing it, 
+            # we can dereference MmSystemRangeStart as a Pointer instead of an 
+            # address and then remove the manual bitmask below. 
+            start = kdbg.MmSystemRangeStart.dereference_as("address")
             start = start & 0xffffffffffff
 
             # Modules so we can map addresses to owners