From 9c2de16e2ac48b31f40061292837408b70a0e476 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Mon, 6 Apr 2026 22:14:22 +0100
Subject: [PATCH] Add in a much larger range if earlier checks don't find the
 DTB

---
 volatility3/framework/automagic/windows.py | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py
index e57bf6974..1627f7c1a 100644
--- a/volatility3/framework/automagic/windows.py
+++ b/volatility3/framework/automagic/windows.py
@@ -199,13 +199,24 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface):
         (
             "Detecting Self-referential pointer for recent windows",
             [DtbSelfRef64bit()],
-            [(0x150000, 0x150000), (0x550000, 0x1A0000), (0x900000, 0x100000)],
+            [
+                (0x150000, 0x150000),
+                (0x550000, 0x1A0000),
+                (0x900000, 0x100000),
+            ],
         ),
         (
             "Older windows fixed location self-referential pointers",
             [DtbSelfRefPae(), DtbSelfRef32bit(), DtbSelfRef64bitOldWindows()],
             [(0x30000, 0x1000000)],
         ),
+        (
+            "Very large memory with high DTBs (slow)",
+            [DtbSelfRef64bit()],
+            [
+                (0xA00000, 0x5000000),
+            ],
+        ),
     ]
 
     @classmethod