From b1156fa0a167dbb8a42ded9f781056103f3dba18 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 26 Aug 2021 16:18:27 +0100 Subject: [PATCH] Automagic: Remove the superfluous num_entries fields --- volatility3/framework/automagic/windows.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py index c583a7131..fbbbc9222 100644 --- a/volatility3/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -124,8 +124,7 @@ class DtbTest32bit(DtbTest): super().__init__(layer_type = layers.intel.WindowsIntel, ptr_struct = "I", ptr_reference = [0x300], - mask = 0xFFFFF000, - num_entries = 1024) + mask = 0xFFFFF000) class DtbTest64bit(DtbTest): @@ -134,8 +133,7 @@ class DtbTest64bit(DtbTest): super().__init__(layer_type = layers.intel.WindowsIntel32e, ptr_struct = "Q", ptr_reference = range(0x1ff, 0x100, -1), - mask = 0x3FFFFFFFFFF000, - num_entries = 512) + mask = 0x3FFFFFFFFFF000) # As of Windows-10 RS1+, the ptr_reference is randomized: # https://blahcat.github.io/2020/06/15/playing_with_self_reference_pml4_entry/