10:48 a.m.
HI,
There was some talk on the #volatility irc channel.. Won't go into details,
Basically, wondering how one can use vtop from volshell as it is not a
plugin.
thanks
11:31 a.m.
The new hh() in volshell shows some details on how to reach different
address spaces:
>> hh()
Use self.addrspace for Kernel/Virtual AS
Use self.addrspace.base for Physical AS
Use self.proc to get the current _EPROCESS object
and self.proc.get_process_address_space() for the current process AS
and self.proc.get_load_modules() for the current process DLLs
So if you want to translate an address using a kernel DTB:
>> self.addrspace.vtop(address)
If you wanted to translate an address using a specific process's DTB:
>> cc(pid = XXX)
>> self.proc.get_process_address_space().vtop(address)
MHL
On Thu, Apr 18, 2013 at 10:48 AM, kongo sec <kongo86.sec(a)gmail.com> wrote:
HI,
There was some talk on the #volatility irc channel.. Won't go into details,
Basically, wondering how one can use vtop from volshell as it is not a
plugin.
thanks
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
4228
days inactive
4228
days old
vol-users@lists.volatilityfoundation.org
1 comments
2 participants
participants (2)
-
kongo sec -
Michael Hale Ligh