From 4b56ee4c731acb81fb0cd57f11458344adcf0ba1 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Thu, 2 Sep 2021 23:01:05 +0100
Subject: [PATCH] Automagic: Increase windows self-ref segment for win7

---
 volatility3/framework/automagic/windows.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py
index d133b492c..f05be0659 100644
--- a/volatility3/framework/automagic/windows.py
+++ b/volatility3/framework/automagic/windows.py
@@ -385,7 +385,7 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface):
             hits = context.layers[layer_name].scan(context,
                                                    PageMapScanner(
                                                        [DtbSelfRef64bit(), DtbSelfRefPae(), DtbSelfRef32bit()]),
-                                                   sections = [(0x1a0000, 0x550000), (0x30000, 0x10000)],
+                                                   sections = [(0x180000, 0x580000), (0x30000, 0x10000)],
                                                    progress_callback = progress_callback)
             # Flatten the generator
             hits = list(hits)