Re: [Vol-users] Get virtual address corresponding to a dll
12 Feb
2012
12 Feb
'12
6:08 p.m.
Hi Eknath,
What do you mean by Virtual Address? Each process has its own
virtual address and the same dll can be mapped multiple times into
different processes. You can use memmaps to see every process's memory
mapping and see which processes map a specific physical address.
Michael.
On 12 February 2012 13:52, Eknath Venkataramani <eknath.iyer(a)gmail.com> wrote:
I have a foo.dll loaded in memory. Using `dlllist` I
can see that the
physical address is 0x252438. How do I get the virtual address?
--
Eknath Venkataramani
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users