From e095851ab962dc8ee8a257c92f26ea3b60b9e345 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 20 Feb 2026 18:34:33 +0000 Subject: [PATCH] Improve Win11 DTB detection It seems windows 11 has started moving the DTB further afield. This change adds another region located empirically, so it might need extending for everything between the second and third regions potentially. It may also be possible to shrink the third region, but that will need more example images (it's still not clear what causes the use of the higher DTB, although the image it was found in was 18Gb). --- volatility3/framework/automagic/windows.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py index cd584b6a1..bed2a4376 100644 --- a/volatility3/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -200,7 +200,7 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface): ( "Detecting Self-referential pointer for recent windows", [DtbSelfRef64bit()], - [(0x150000, 0x150000), (0x550000, 0x1A0000)], + [(0x150000, 0x150000), (0x550000, 0x1A0000), (0x900000, 0x100000)], ), ( "Older windows fixed location self-referential pointers",