diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py index 1a5e6a235..873a020a0 100644 --- a/volatility3/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -128,9 +128,13 @@ class DtbTest64bit(DtbTest): def __init__(self) -> None: super().__init__(layer_type = layers.intel.WindowsIntel32e, ptr_struct = "Q", - ptr_reference = [0x1ED, 0x1FB], + ptr_reference = range(0x1E0, 0x1FF), mask = 0x3FFFFFFFFFF000) + # As of Windows-10 RS1+, the ptr_reference is randomized: + # https://blahcat.github.io/2020/06/15/playing_with_self_reference_pml4_entry/ + # So far, we've only seen examples between 0x1e0 and 0x1ff + class DtbTestPae(DtbTest):