WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 12:47:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #507 from volatilityfoundation/issues/issue505

Browse Source 
Windows: Increase self-referential check
This commit is contained in:
ikelos
2021-05-26 22:12:33 +01:00
committed by GitHub
parent 069a3da751 abafa58f1a
commit 77d0debdac
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/automagic/windows.py
+1 -2
View File
@@ -128,12 +128,11 @@ class DtbTest64bit(DtbTest):
def __init__(self) -> None:
super().__init__(layer_type = layers.intel.WindowsIntel32e,
ptr_struct = "Q",
ptr_reference = range(0x1E0, 0x1FF),
ptr_reference = range(0x100, 0x1FF),
mask = 0x3FFFFFFFFFF000)
# As of Windows-10 RS1+, the ptr_reference is randomized:
# https://blahcat.github.io/2020/06/15/playing_with_self_reference_pml4_entry/
# So far, we've only seen examples between 0x1e0 and 0x1ff
class DtbTestPae(DtbTest):