add 5-level paging detection and support

volatility3/framework/automagic/linux.py

@@ -298,7 +298,10 @@ def stack(
             if is_32bit:
                 layer_class = intel.IntelPAE if is_pae else intel.Intel
             else:
-                layer_class = intel.Intel32e
+                if cls._vmcoreinfo_is_5level(vmcoreinfo):
+                    layer_class = intel.Intel32e5Level
+                else:
+                    layer_class = intel.Intel32e
 
             uts_release = vmcoreinfo["OSRELEASE"]
 
@@ -428,3 +431,12 @@ def _vmcoreinfo_is_32bit(vmcoreinfo) -> Tuple[bool, bool]:
             is_32bit = dtb_vaddr <= 2**32
 
         return is_32bit, is_pae
+
+    @staticmethod
+    def _vmcoreinfo_is_5level(vmcoreinfo) -> bool:
+        """Returns True if 5-level paging is enabled at runtime"""
+        pgtable_l5 = vmcoreinfo.get("NUMBER(pgtable_l5_enabled)")
+        if pgtable_l5 is not None:
+            return pgtable_l5 == 1
+
+        return False

volatility3/framework/layers/intel.py

@@ -489,6 +489,26 @@ class Intel32e(Intel):
     ]
 
 
+class Intel32e5Level(Intel):
+    """Class for handling 64-bit (32-bit extensions) for Intel
+    architectures with 5 level page tables."""
+
+    _direct_metadata = collections.ChainMap(
+        {"architecture": "Intel64"}, Intel._direct_metadata
+    )
+    _entry_format = "<Q"
+    _bits_per_register = 64
+    _maxphyaddr = 52
+    _maxvirtaddr = 57
+    _structure = [
+        ("page map layer 5", 9, False),
+        ("page map layer 4", 9, False),
+        ("page directory pointer", 9, True),
+        ("page directory", 9, True),
+        ("page table", 9, False),
+    ]
+
+
 class WindowsMixin(Intel):
     @staticmethod
     def _page_is_valid(entry: int) -> bool: