From a2ac55ba0bf0100aa1cb6095cd827229ec19d49b Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 29 Feb 2020 00:21:11 +0000 Subject: [PATCH] Wintel: Reorder the DTB tests Reorder the DTB tests, since 64-bits have more to match and are likely more common these days. We've had an instance where a 32-bit DTB was detected because of a self-referential pointer over a 64-bit DTB leading to an inaccessible image. This fixes issue #193. --- volatility/framework/automagic/windows.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility/framework/automagic/windows.py b/volatility/framework/automagic/windows.py index 9d6733ead..89fc80b00 100644 --- a/volatility/framework/automagic/windows.py +++ b/volatility/framework/automagic/windows.py @@ -213,7 +213,7 @@ class PageMapScanner(interfaces.layers.ScannerInterface): architecture.""" overlap = 0x4000 thread_safe = True - tests = [DtbTest32bit(), DtbTest64bit(), DtbTestPae()] + tests = [DtbTest64bit(), DtbTest32bit(), DtbTestPae()] """The default tests to run when searching for DTBs""" def __init__(self, tests: List[DtbTest]) -> None: @@ -239,7 +239,7 @@ class WintelHelper(interfaces.automagic.AutomagicInterface): It will scan for existing TranslationLayers that do not have a DTB using the :class:`PageMapScanner` """ priority = 20 - tests = [DtbTest32bit(), DtbTest64bit(), DtbTestPae()] + tests = [DtbTest64bit(), DtbTest32bit(), DtbTestPae()] def __call__(self, context: interfaces.context.ContextInterface,