All Questions

Tagged with
Filter by
Sorted by
Tagged with
1
vote
0answers
52 views

How to identify the NonPagedPool Start Memory address from a memory dump

I need to find the memory address where starts the NonPagedPool. I saw some people doing it with Rekall, but I'm having a lot of problems with it. Is that possible with Volatility ? Tks
3
votes
1answer
108 views

Certain bytes in the memory (RAM) get changed after the program starts. Why?

I'm in a situation where I have an executable file. When I start it within the debugger (x32dbg), with breakpoints set to every occasion (DLL entry, DLL load, Thread start,..), to restrict the amount ...