Merge pull request #416 from volatilityfoundation/issues/intel-pae-metadata

Layers: Ensure intel PAE reports pae in the metadata

volatility/framework/layers/intel.py

@@ -247,6 +247,7 @@ class IntelPAE(Intel):
     _maxphyaddr = 40
     _maxvirtaddr = 32
     _structure = [('page directory pointer', 2, False), ('page directory', 9, True), ('page table', 9, True)]
+    _direct_metadata = collections.ChainMap({'pae', True}, Intel._direct_metadata)
 
 
 class Intel32e(Intel):

volatility/framework/symbols/windows/extensions/__init__.py

@@ -6,9 +6,8 @@ import collections.abc
 import datetime
 import functools
 import logging
-import struct
 import math
-from typing import Iterable, Iterator, Optional, Union, Dict, Tuple, List
+from typing import Iterable, Iterator, Optional, Union, Tuple, List
 
 from volatility.framework import constants, exceptions, interfaces, objects, renderers, symbols
 from volatility.framework.layers import intel