Re: [Vol-users] Lookup Process Name by Memory Address on Windows XP
Matthew Wong
13 Nov
2013
13 Nov
'13
8:46 p.m.
Thanks all!
Could Volatility able to generate a complete memory dump? Or I need to use
other tools?
--
matt
On Wed, Nov 13, 2013 at 11:15 PM, Vico Marziale <vicodark(a)gmail.com> wrote:
Check this out:
https://code.google.com/p/volatility/wiki/CommandReference#strings
On Wed, Nov 13, 2013 at 7:22 AM, Matthew Wong <matthew(a)coredumps.net>wrote:
Hello All,
I'm new to Volatility.
Say I found the string "password=hello world" somewhere in the memory, is
there anyway for me to know which process that memory block is currently
allocated to?
--
matt
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
Attachments:
- attachment.html (text/html — 2.7 KB)