WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-17 20:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Improve Win11 DTB detection

Browse Source 
It seems windows 11 has started moving the DTB further afield.  This
change adds another region located empirically, so it might need
extending for everything between the second and third regions
potentially.  It may also be possible to shrink the third region, but
that will need more example images (it's still not clear what causes
the use of the higher DTB, although the image it was found in was 18Gb).
This commit is contained in:
Mike Auty
2026-02-20 18:34:39 +00:00
parent fd22429b0b
commit e095851ab9
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/automagic/windows.py
+1 -1
View File
@@ -200,7 +200,7 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface):
(
"Detecting Self-referential pointer for recent windows",
[DtbSelfRef64bit()],
[(0x150000, 0x150000), (0x550000, 0x1A0000)],
[(0x150000, 0x150000), (0x550000, 0x1A0000), (0x900000, 0x100000)],
),
(
"Older windows fixed location self-referential pointers",