From a1c5f5e5e5ed2ba53711b34eeb63271fddf18ef2 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 3 Apr 2021 13:33:20 +0100 Subject: [PATCH] Automagic: Improve secondary 64-bit self-ref finder --- volatility3/framework/automagic/windows.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py index 1a5e6a235..873a020a0 100644 --- a/volatility3/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -128,9 +128,13 @@ class DtbTest64bit(DtbTest): def __init__(self) -> None: super().__init__(layer_type = layers.intel.WindowsIntel32e, ptr_struct = "Q", - ptr_reference = [0x1ED, 0x1FB], + ptr_reference = range(0x1E0, 0x1FF), mask = 0x3FFFFFFFFFF000) + # As of Windows-10 RS1+, the ptr_reference is randomized: + # https://blahcat.github.io/2020/06/15/playing_with_self_reference_pml4_entry/ + # So far, we've only seen examples between 0x1e0 and 0x1ff + class DtbTestPae(DtbTest):