add more documentation

volatility3/framework/automagic/windows.py

@@ -39,6 +39,10 @@ vollog = logging.getLogger(__name__)
 
 
 class Intel32LayerCheck:
+    # These addresses are at a fixed location:
+    # "The KUSER_SHARED_DATA structure is a single page (4096 bytes) in memory 
+    # that is mapped at a fixed, hardcoded address in both kernel and user side of VAS."
+    # See: https://www.microsoft.com/en-us/msrc/blog/2022/04/randomizing-the-kuser_shared_data-structure-on-windows
     KUSER_USER_SPACE_ADDR = 0x7FFE0000
     KUSER_KERNEL_SPACE_ADDR = 0xFFDF0000
     # This field offset did not change across Windows versions.