Wrappers so existing code keeps reading nicely.

Translate a kernel-image VA to PA via the engine's kaslr_phys_shift. Works for any symbol in the static kernel image (.text/.rodata/.data/.bss).

Walks the framed-snappy stream starting at `file_off`, producing frames whose decompressed bytes map to physical addresses [chunk_pa_start, ...]. Retu

A loaded module has a recognizable name byte string at a known offset inside its `struct module` (offset 0x18 on 6.x x86_64). Names are printable, NUL

Captured physical ranges, when the format can report them cheaply. Sparse stream views such as /mem/phys.raw may zero-fill everything outside these ra

Convenience.

getenv that treats an empty value as unset (empty %VAR% / $VAR is useless).

Banner (from the linux_banner symbol contents) — populated by caller.

Infer the shell from a history filename so the `source` column can name the actual shell (bash/zsh/fish/…) instead of a generic mechanism.

Cheap, best-effort size for directory listings. MUST NOT run a lazy producer — it's called for every child during a folder enumeration, so making it e

NOT warmed by --precompute: size() is already cheap (size_fn_), so these never show 0 in a listing, and warming every recovered file would pull the wh

for header reporting