WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-26 19:44:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

Automagic: Extended the possible DTB locations for Win 11

Browse Source
This commit is contained in:
Mike Auty
2021-09-07 09:25:39 +01:00
parent be54de140e
commit 02a1ff31b4
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/automagic/windows.py
+1 -1
View File
@@ -184,7 +184,7 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface):
layer = layer_type(context, config_path = config_path, name = new_layer_name, metadata = {'os': 'Windows'})
test_sets = [("Detecting Self-referential pointer for recent windows",
[DtbSelfRefPae(), DtbSelfRef64bit()], [(0x1a0000, 0x100000), (0x650000, 0x50000)]),
[DtbSelfRefPae(), DtbSelfRef64bit()], [(0x1a0000, 0x100000), (0x650000, 0xa0000)]),
("Older windows fixed location self-referential pointers",
[DtbSelfRefPae(), DtbSelfRef32bit(), DtbSelfRef64bitOldWindows()], [(0x30000, 0x1000000)])
]