mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-17 20:35:40 +02:00
Add in a much larger range if earlier checks don't find the DTB
This commit is contained in:
@@ -199,13 +199,24 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface):
|
||||
(
|
||||
"Detecting Self-referential pointer for recent windows",
|
||||
[DtbSelfRef64bit()],
|
||||
[(0x150000, 0x150000), (0x550000, 0x1A0000), (0x900000, 0x100000)],
|
||||
[
|
||||
(0x150000, 0x150000),
|
||||
(0x550000, 0x1A0000),
|
||||
(0x900000, 0x100000),
|
||||
],
|
||||
),
|
||||
(
|
||||
"Older windows fixed location self-referential pointers",
|
||||
[DtbSelfRefPae(), DtbSelfRef32bit(), DtbSelfRef64bitOldWindows()],
|
||||
[(0x30000, 0x1000000)],
|
||||
),
|
||||
(
|
||||
"Very large memory with high DTBs (slow)",
|
||||
[DtbSelfRef64bit()],
|
||||
[
|
||||
(0xA00000, 0x5000000),
|
||||
],
|
||||
),
|
||||
]
|
||||
|
||||
@classmethod
|
||||
|
||||
Reference in New Issue
Block a user