Timeline for recovering a process dump from a memory dump with WinDbg
Current License: CC BY-SA 4.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| S Jul 11, 2022 at 7:36 | history | suggested | Viktor | CC BY-SA 4.0 |
Typos fixed
|
| Jul 10, 2022 at 20:14 | review | Suggested edits | |||
| S Jul 11, 2022 at 7:36 | |||||
| Jul 10, 2022 at 20:02 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Mar 12, 2022 at 19:03 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Feb 10, 2022 at 18:55 | answer | added | blabb | timeline score: 1 | |
| Feb 9, 2022 at 21:31 | comment | added | AK_ | @blabb I'm not a reverse engineer so help me understand how do I do the above? Where is the start of the process then? and how do I calculate its size? | |
| Feb 9, 2022 at 18:20 | comment | added | blabb | PROCESS ffffb501f8c23580 <-- this is the address NO............that is the start of the structure_EPROCESS ....... it is kernel address not start of process address your process virtual address will be in Virtual Address Descriptor you need to brush up some basics | |
| Feb 9, 2022 at 11:45 | history | asked | AK_ | CC BY-SA 4.0 |