python-haystack
python-haystack copied to clipboard
Locate discarded memory mapping in windows dumps
List HEAP structures found in memdump that do not pass validation and/or that are not listed in PEB. These heaps are probably "deleted" memory. If the mapping is rebased to it's address space, a valid memory graph could probably be extracted. Not necessarily from the same source binary.