WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-06 17:57:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #510 from volatilityfoundation/revert-507-issues/issue505

Browse Source 
Revert "Windows: Increase self-referential check"
This commit is contained in:
ikelos
2021-05-26 23:45:00 +01:00
committed by GitHub
parent 0214fa35a1 3bb23b29e3
commit 7ef7dd88f0
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/automagic/windows.py
+2 -1
View File
@@ -128,11 +128,12 @@ class DtbTest64bit(DtbTest):
def __init__(self) -> None:
super().__init__(layer_type = layers.intel.WindowsIntel32e,
ptr_struct = "Q",
ptr_reference = range(0x100, 0x1FF),
ptr_reference = range(0x1E0, 0x1FF),
mask = 0x3FFFFFFFFFF000)
# As of Windows-10 RS1+, the ptr_reference is randomized:
# https://blahcat.github.io/2020/06/15/playing_with_self_reference_pml4_entry/
# So far, we've only seen examples between 0x1e0 and 0x1ff
class DtbTestPae(DtbTest):