From 48e802e255f3e8b7108b8aee0daf64109dc6a571 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 12 Sep 2021 12:55:42 +0100 Subject: [PATCH] Automagic: Ensure reserved bits are for valid pages --- volatility3/framework/automagic/windows.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py index 57bfe0dd8..e67f20be8 100644 --- a/volatility3/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -62,7 +62,7 @@ class DtbSelfReferential: ptr, = struct.unpack(self.ptr_struct, ptr_data) # For both Intel-32e, bit 7 is reserved (more are reserved in PAE), so if that's ever set, # we can move on - if ptr & self.reserved_bits: + if (ptr & self.reserved_bits) and (ptr & 0x01): return None if ((ptr & self.mask) == (data_offset + page_offset)) and (data_offset + page_offset > 0): # Pointer must be valid