I need to find the memory address where starts the NonPagedPool. I saw some people doing it with Rekall, but I'm having a lot of problems with it.
Is that possible with Volatility ?
Tks
Add a comment
|
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
Anybody can ask a question
Anybody can answer
The best answers are voted up and rise to the top
