diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 95703aaf75..5135c6ccfc 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -298,7 +298,10 @@ def stack( if is_32bit: layer_class = intel.IntelPAE if is_pae else intel.Intel else: - layer_class = intel.Intel32e + if cls._vmcoreinfo_is_5level(vmcoreinfo): + layer_class = intel.Intel32e5Level + else: + layer_class = intel.Intel32e uts_release = vmcoreinfo["OSRELEASE"] @@ -428,3 +431,12 @@ def _vmcoreinfo_is_32bit(vmcoreinfo) -> Tuple[bool, bool]: is_32bit = dtb_vaddr <= 2**32 return is_32bit, is_pae + + @staticmethod + def _vmcoreinfo_is_5level(vmcoreinfo) -> bool: + """Returns True if 5-level paging is enabled at runtime""" + pgtable_l5 = vmcoreinfo.get("NUMBER(pgtable_l5_enabled)") + if pgtable_l5 is not None: + return pgtable_l5 == 1 + + return False diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 380d0e49f4..0b2e7f10b4 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -489,6 +489,26 @@ class Intel32e(Intel): ] +class Intel32e5Level(Intel): + """Class for handling 64-bit (32-bit extensions) for Intel + architectures with 5 level page tables.""" + + _direct_metadata = collections.ChainMap( + {"architecture": "Intel64"}, Intel._direct_metadata + ) + _entry_format = " bool: