From ee2a868c97271c92d4eed1850d462476e8cb6c3b Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 12 Sep 2021 11:35:44 +0100 Subject: [PATCH] Automagic: Windows 32-bit bit 7 is not always 0 --- volatility3/framework/automagic/windows.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py index f3ad05a92..0cda68332 100644 --- a/volatility3/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -84,7 +84,7 @@ class DtbSelfRef32bit(DtbSelfReferential): ptr_struct = "I", mask = 0xFFFFF000, valid_range = [0x300], - reserved_bits = 0x80) + reserved_bits = 0x0) class DtbSelfRef64bit(DtbSelfReferential):