From 75feba009918906f99b5a5cc294e56442b6f263d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 8 Sep 2021 21:31:45 +0100 Subject: [PATCH] Automagic: Sort DTB results by test --- volatility3/framework/automagic/windows.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py index 6a404ae0f..8c479bff0 100644 --- a/volatility3/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -206,7 +206,7 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface): sections = sections, progress_callback = progress_callback) # Flatten the generator - hits = list(hits) + hits = sorted(list(hits), key = lambda x: tests.index(x[0])) if hits: # TODO: Decide which to use if there are multiple options test, page_map_offset = hits[0]