Merge pull request #580 from volatilityfoundation/issues/large-page-fix

Layers: Fix bug where PAT flag is treated as address

Author: ikelos

volatility3/framework/layers/intel.py

@@ -135,6 +135,9 @@ def _translate_entry(self, offset: int) -> Tuple[int, int]:
                                                               "Page Fault at entry " + hex(entry) + " in table " + name)
             # Check if we're a large page
             if large_page and (entry & (1 << 7)):
+                # Mask off the PAT bit
+                if entry & (1 << 12):
+                    entry -= (1 << 12)
                 # We're a large page, the rest is finished below
                 # If we want to implement PSE-36, it would need to be done here
                 break