From abafa58f1a474a2a6a6d60e01a611025a21d3108 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Sun, 23 May 2021 15:49:28 +0100
Subject: [PATCH] Windows: Increase self-referential check

---
 volatility3/framework/automagic/windows.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py
index 873a020a0..3844e89e6 100644
--- a/volatility3/framework/automagic/windows.py
+++ b/volatility3/framework/automagic/windows.py
@@ -128,12 +128,11 @@ class DtbTest64bit(DtbTest):
     def __init__(self) -> None:
         super().__init__(layer_type = layers.intel.WindowsIntel32e,
                          ptr_struct = "Q",
-                         ptr_reference = range(0x1E0, 0x1FF),
+                         ptr_reference = range(0x100, 0x1FF),
                          mask = 0x3FFFFFFFFFF000)
 
     # As of Windows-10 RS1+, the ptr_reference is randomized:
     # https://blahcat.github.io/2020/06/15/playing_with_self_reference_pml4_entry/
-    # So far, we've only seen examples between 0x1e0 and 0x1ff
 
 
 class DtbTestPae(DtbTest):