From 67a49029eaeb222fddd679483e3d5bf2625d7483 Mon Sep 17 00:00:00 2001
From: Abyss Watcher <abyss-w4tcher@proton.me>
Date: Mon, 13 Jul 2026 19:55:28 +0200
Subject: [PATCH] add more documentation

---
 volatility3/framework/automagic/windows.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py
index f5973228f..fa4f7983e 100644
--- a/volatility3/framework/automagic/windows.py
+++ b/volatility3/framework/automagic/windows.py
@@ -39,6 +39,10 @@ vollog = logging.getLogger(__name__)
 
 
 class Intel32LayerCheck:
+    # These addresses are at a fixed location:
+    # "The KUSER_SHARED_DATA structure is a single page (4096 bytes) in memory 
+    # that is mapped at a fixed, hardcoded address in both kernel and user side of VAS."
+    # See: https://www.microsoft.com/en-us/msrc/blog/2022/04/randomizing-the-kuser_shared_data-structure-on-windows
     KUSER_USER_SPACE_ADDR = 0x7FFE0000
     KUSER_KERNEL_SPACE_ADDR = 0xFFDF0000
     # This field offset did not change across Windows versions.