It is also possible to add false positive (since kdbgscan is just a simple scan for a known signature), which can force Volatility to present whatever results one wishes when traversing lists such as the process list or the module list (i.e. one can create entire fake lists which are not even used by the kernel at all).