From e18b37abf5c64dc541cd41a36b7f660c122a1c77 Mon Sep 17 00:00:00 2001
From: Abyss Watcher <abyss-w4tcher@proton.me>
Date: Mon, 1 Dec 2025 15:54:58 +0100
Subject: [PATCH] remove PTEs "large_page" attribute and re-order large_page
 check

---
 volatility3/framework/layers/intel.py | 32 ++++++++++++++-------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py
index 848580004..f750f3f2f 100644
--- a/volatility3/framework/layers/intel.py
+++ b/volatility3/framework/layers/intel.py
@@ -38,7 +38,7 @@ class Intel(linear.LinearlyMappedLayer):
     # NOTE: _maxphyaddr is MAXPHYADDR as defined in the Intel specs *NOT* the maximum physical address
     _maxphyaddr = 32
     _maxvirtaddr = _maxphyaddr
-    _structure = [("page directory", 10, False), ("page table", 10, True)]
+    _structure = [("page directory", 10, True), ("page table", 10, False)]
     _direct_metadata = collections.ChainMap(
         {"architecture": "Intel32"},
         {"mapped": True},
@@ -221,18 +221,6 @@ class Intel(linear.LinearlyMappedLayer):
                     entry,
                     "Page Fault at entry " + hex(entry) + " in table " + name,
                 )
-            # Check if we're a large page
-            if large_page and (entry & self._PAGE_PSE):
-                # Mask off the PAT bit
-                if entry & self._PAGE_PAT_LARGE:
-                    entry -= self._PAGE_PAT_LARGE
-                # We're a large page, the rest is finished below
-                # If we want to implement PSE-36, it would need to be done here
-                break
-            # Figure out how much of the offset we should be using
-            start = position
-            position -= size
-            index = self._mask(page_address, start, position + 1) >> (position + 1)
 
             # Grab the base address of the table we'll be getting the next entry from
             base_address = self._mask(
@@ -249,6 +237,11 @@ class Intel(linear.LinearlyMappedLayer):
                     "Page Fault at entry " + hex(entry) + " in table " + name,
                 )
 
+            # Figure out how much of the offset we should be using
+            start = position
+            position -= size
+            index = self._mask(page_address, start, position + 1) >> (position + 1)
+
             # Read the data for the next entry
             entry_data_start = index << self._index_shift
             entry_data = table[entry_data_start : entry_data_start + self._entry_size]
@@ -262,6 +255,15 @@ class Intel(linear.LinearlyMappedLayer):
             # Read out the new entry from memory
             (entry,) = struct.unpack(self._entry_format, entry_data)
 
+            # Check if we're a large page
+            if large_page and (entry & self._PAGE_PSE):
+                # Mask off the PAT bit
+                if entry & self._PAGE_PAT_LARGE:
+                    entry -= self._PAGE_PAT_LARGE
+                # We're a large page, the rest is finished below
+                # If we want to implement PSE-36, it would need to be done here
+                break
+
         return entry, position
 
     @functools.lru_cache(maxsize=1025)
@@ -429,7 +431,7 @@ class IntelPAE(Intel):
     _structure = [
         ("page directory pointer", 2, False),
         ("page directory", 9, True),
-        ("page table", 9, True),
+        ("page table", 9, False),
     ]
     _direct_metadata = collections.ChainMap({"pae": True}, Intel._direct_metadata)
 
@@ -449,7 +451,7 @@ class Intel32e(Intel):
         ("page map layer 4", 9, False),
         ("page directory pointer", 9, True),
         ("page directory", 9, True),
-        ("page table", 9, True),
+        ("page table", 9, False),
     ]