diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py index e57bf69747..1627f7c1a8 100644 --- a/volatility3/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -199,13 +199,24 @@ class WindowsIntelStacker(interfaces.automagic.StackerLayerInterface): ( "Detecting Self-referential pointer for recent windows", [DtbSelfRef64bit()], - [(0x150000, 0x150000), (0x550000, 0x1A0000), (0x900000, 0x100000)], + [ + (0x150000, 0x150000), + (0x550000, 0x1A0000), + (0x900000, 0x100000), + ], ), ( "Older windows fixed location self-referential pointers", [DtbSelfRefPae(), DtbSelfRef32bit(), DtbSelfRef64bitOldWindows()], [(0x30000, 0x1000000)], ), + ( + "Very large memory with high DTBs (slow)", + [DtbSelfRef64bit()], + [ + (0xA00000, 0x5000000), + ], + ), ] @classmethod