python-haystack icon indicating copy to clipboard operation
python-haystack copied to clipboard

Locate discarded memory mapping in windows dumps

Open trolldbois opened this issue 9 years ago • 0 comments

List HEAP structures found in memdump that do not pass validation and/or that are not listed in PEB. These heaps are probably "deleted" memory. If the mapping is rebased to it's address space, a valid memory graph could probably be extracted. Not necessarily from the same source binary.

trolldbois avatar Dec 25 '16 07:12 trolldbois