From bb3f411e22c37097e3676330f06a5ab1f1a172f9 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Thu, 2 Sep 2021 22:54:25 +0100
Subject: [PATCH] Automagic: Add a section for where old kernels live

---
 volatility3/framework/automagic/windows.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py
index eba79ef98..d133b492c 100644
--- a/volatility3/framework/automagic/windows.py
+++ b/volatility3/framework/automagic/windows.py
@@ -385,7 +385,7 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface):
             hits = context.layers[layer_name].scan(context,
                                                    PageMapScanner(
                                                        [DtbSelfRef64bit(), DtbSelfRefPae(), DtbSelfRef32bit()]),
-                                                   sections = [(0x1a0000, 0x550000)],
+                                                   sections = [(0x1a0000, 0x550000), (0x30000, 0x10000)],
                                                    progress_callback = progress_callback)
             # Flatten the generator
             hits = list(hits)