Re: [Vol-users] 64bit memory images

Hi Brian, There is no such thing as a stupid question; don't worry. To my knowledge nobody has published much information about doing memory analysis on 64-bit systems, so the following is mostly conjecture. When working in 64-bit mode Intel processors use a different method of translating the virtual addresses used by programs and the operating system into the physical addresses in RAM where data really lives. As such there are going to be several differences in the operating system for a) keeping track of where data lives and b) virtual to physical address translation. You can read much more about these difference in the Intel Architecture Software Developer's Manuals, http://www.intel.com/products/processor/manuals/. BTW, Intel will mail you hard copies of those books for free. Really! As many as you'd like of whichever ones you'd like. Enjoy! As for the differences in anything else, like I said, I don't think anybody has published on those yet. You could be the first! cheers, -- Jesse jessek(a)speakeasy.net