From 02a1ff31b44a6a783f361aa100e7319b73118a00 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 7 Sep 2021 09:25:39 +0100 Subject: [PATCH] Automagic: Extended the possible DTB locations for Win 11 --- volatility3/framework/automagic/windows.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py index e0ab92de2..37b696a9a 100644 --- a/volatility3/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -184,7 +184,7 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface): layer = layer_type(context, config_path = config_path, name = new_layer_name, metadata = {'os': 'Windows'}) test_sets = [("Detecting Self-referential pointer for recent windows", - [DtbSelfRefPae(), DtbSelfRef64bit()], [(0x1a0000, 0x100000), (0x650000, 0x50000)]), + [DtbSelfRefPae(), DtbSelfRef64bit()], [(0x1a0000, 0x100000), (0x650000, 0xa0000)]), ("Older windows fixed location self-referential pointers", [DtbSelfRefPae(), DtbSelfRef32bit(), DtbSelfRef64bitOldWindows()], [(0x30000, 0x1000000)]) ]