Re: [Vol-users] Get virtual address corresponding to a dll
12 Feb
2012
12 Feb
'12
6:27 p.m.
Hmm what command exactly did you use to see 0x252438? That looks like
a physical address but you said it came from dlllist output - and
dlllist only shows virtual addresses.
MHL
On Sun, Feb 12, 2012 at 6:08 PM, Michael Cohen <scudette(a)gmail.com> wrote:
Hi Eknath,
What do you mean by Virtual Address? Each process has its own
virtual address and the same dll can be mapped multiple times into
different processes. You can use memmaps to see every process's memory
mapping and see which processes map a specific physical address.
Michael.
On 12 February 2012 13:52, Eknath Venkataramani <eknath.iyer(a)gmail.com> wrote:
I have a foo.dll loaded in memory. Using
`dlllist` I can see that the
physical address is 0x252438. How do I get the virtual address?
--
Eknath Venkataramani
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users