From a85f6f80f8e2bc10bfe31a690cca1d035895263c Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Fri, 22 Nov 2019 22:40:52 +0000
Subject: [PATCH] Linux automagic: Add support for more recent init_top_pgt
 symbol.

---
 volatility/framework/automagic/linux.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/volatility/framework/automagic/linux.py b/volatility/framework/automagic/linux.py
index ade5964d2..4910dd2aa 100644
--- a/volatility/framework/automagic/linux.py
+++ b/volatility/framework/automagic/linux.py
@@ -74,7 +74,10 @@ class LintelStacker(interfaces.automagic.StackerLayerInterface):
                                                           progress_callback = progress_callback)
 
                 layer_class = intel.Intel  # type: Type
-                if 'init_level4_pgt' in table.symbols:
+                if 'init_top_pgt' in table.symbols:
+                    layer_class = intel.Intel32e
+                    dtb_symbol_name = 'init_top_pgt'
+                elif 'init_level4_pgt' in table.symbols:
                     layer_class = intel.Intel32e
                     dtb_symbol_name = 'init_level4_pgt'
                 else: