Skip to content

Commit 9f08af4

Browse files
committed
Linux: Add support for Intel 32bit with PAE
1 parent a677714 commit 9f08af4

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

volatility3/framework/automagic/linux.py

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,12 @@ def stack(
7171
elif "init_level4_pgt" in table.symbols:
7272
layer_class = intel.LinuxIntel32e
7373
dtb_symbol_name = "init_level4_pgt"
74+
elif (
75+
"pkmap_count" in table.symbols
76+
and table.get_symbol("pkmap_count").type.count == 512
77+
):
78+
layer_class = intel.LinuxIntelPAE
79+
dtb_symbol_name = "swapper_pg_dir"
7480
else:
7581
layer_class = intel.LinuxIntel
7682
dtb_symbol_name = "swapper_pg_dir"

0 commit comments

Comments
 (0)