Skip to content

Commit 28c74f8

Browse files
committed
Linux: Add support for Intel 32bit with PAE in early kernels, including versions 2.3.27 and 2.3.28.
1 parent 9f08af4 commit 28c74f8

File tree

1 file changed

+3
-4
lines changed

1 file changed

+3
-4
lines changed

volatility3/framework/automagic/linux.py

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -71,10 +71,9 @@ def stack(
7171
elif "init_level4_pgt" in table.symbols:
7272
layer_class = intel.LinuxIntel32e
7373
dtb_symbol_name = "init_level4_pgt"
74-
elif (
75-
"pkmap_count" in table.symbols
76-
and table.get_symbol("pkmap_count").type.count == 512
77-
):
74+
elif "pkmap_count" in table.symbols and table.get_symbol(
75+
"pkmap_count"
76+
).type.count in (512, 2048):
7877
layer_class = intel.LinuxIntelPAE
7978
dtb_symbol_name = "swapper_pg_dir"
8079
else:

0 commit comments

Comments
 (0)