We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent a677714 commit 9f08af4Copy full SHA for 9f08af4
volatility3/framework/automagic/linux.py
@@ -71,6 +71,12 @@ def stack(
71
elif "init_level4_pgt" in table.symbols:
72
layer_class = intel.LinuxIntel32e
73
dtb_symbol_name = "init_level4_pgt"
74
+ elif (
75
+ "pkmap_count" in table.symbols
76
+ and table.get_symbol("pkmap_count").type.count == 512
77
+ ):
78
+ layer_class = intel.LinuxIntelPAE
79
+ dtb_symbol_name = "swapper_pg_dir"
80
else:
81
layer_class = intel.LinuxIntel
82
dtb_symbol_name = "swapper_pg_dir"
0 commit comments