mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-02 14:28:58 +02:00
Mike Auty
e095851ab9
It seems windows 11 has started moving the DTB further afield. This change adds another region located empirically, so it might need extending for everything between the second and third regions potentially. It may also be possible to shrink the third region, but that will need more example images (it's still not clear what causes the use of the higher DTB, although the image it was found in was 18Gb).