diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py index d133b492c..f05be0659 100644 --- a/volatility3/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -385,7 +385,7 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface): hits = context.layers[layer_name].scan(context, PageMapScanner( [DtbSelfRef64bit(), DtbSelfRefPae(), DtbSelfRef32bit()]), - sections = [(0x1a0000, 0x550000), (0x30000, 0x10000)], + sections = [(0x180000, 0x580000), (0x30000, 0x10000)], progress_callback = progress_callback) # Flatten the generator hits = list(hits)