Files
volatility3/volatility3
Mike Auty 2371c1158d Windows: Ensure DTBs don't have all valid entries
We were finding that PAE results were being masked by certain pages with
64bit results.  The DTBs could be distinguished from good DTBs because
every entry was valid (which for a 64-bit or even 32-bit DTB is
extremely unlikely except on systems with *vast* quanties of memory.

As such, this now tests for all entries being allocated and doesn't return the
DTB if this is the case.
2021-08-26 11:50:04 +01:00
..
2021-07-22 21:36:37 +01:00