From d0ed42456cb24fbcf3f10ec3419618c168cdc575 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 8 Jan 2026 22:34:32 +0000 Subject: [PATCH] Increment the size of the amount scanned, not just the start location --- volatility3/framework/automagic/windows.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py index 5ba531d1a..cd584b6a1 100644 --- a/volatility3/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -200,7 +200,7 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface): ( "Detecting Self-referential pointer for recent windows", [DtbSelfRef64bit()], - [(0x150000, 0x150000), (0x550000, 0xA0000)], + [(0x150000, 0x150000), (0x550000, 0x1A0000)], ), ( "Older windows fixed location self-referential pointers",