From 3bb23b29e38b27e0114a2af94861207048d0aa04 Mon Sep 17 00:00:00 2001 From: ikelos Date: Wed, 26 May 2021 23:43:35 +0100 Subject: [PATCH] Revert "Windows: Increase self-referential check" --- volatility3/framework/automagic/windows.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py index 3844e89e6..873a020a0 100644 --- a/volatility3/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -128,11 +128,12 @@ class DtbTest64bit(DtbTest): def __init__(self) -> None: super().__init__(layer_type = layers.intel.WindowsIntel32e, ptr_struct = "Q", - ptr_reference = range(0x100, 0x1FF), + ptr_reference = range(0x1E0, 0x1FF), mask = 0x3FFFFFFFFFF000) # As of Windows-10 RS1+, the ptr_reference is randomized: # https://blahcat.github.io/2020/06/15/playing_with_self_reference_pml4_entry/ + # So far, we've only seen examples between 0x1e0 and 0x1ff class DtbTestPae(DtbTest):