Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options answers only user 3473

Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation.

2
votes
for va to phys address translation there is a windbg bang command !vtop 0 < VirtualAddress > . a sample output from that command below kd> !vtop 0 403000 X86VtoP: Virt 00403000, pagedir 11800480 X8 …
answered Oct 9 '14 by blabb
1
vote
nt!KdDebuggerDatablock used to be a public global symbol in NT lkd> x/v nt!KdDebuggerDataBlock pub global 80545b60 0 nt!KdDebuggerDataBlock = <no type information> dpS nt!KdDebuggerDa …
answered Oct 17 '14 by blabb
2
votes
The image in query cant be viewed. i assume you are asking ---- why i cant see the assembly code pertaining to my code portion only and what are those extra assembly code which i didnt seem …
answered Aug 8 '18 by blabb
4
votes
In normal condition alt+f9 execute till user code should get you back to user code
answered Jan 8 '14 by blabb
4
votes
Assuming you want to see it in Windbg. You can follow this walk through for each pointer points to successive LDR_DATA_TABLE_ENTRY the output is from calc.exe. 0:000> dt ntdll!_LDR_DATA_TABLE_ENTRY …
answered May 28 '14 by blabb
2
votes
There seems to be a local array on the stack frame that takes up 78h = 120d bytes on the stack, indicated by this line : no the local var is of type int and it takes 4 bytes on 32 bit machine i …
answered Sep 12 by blabb
2
votes
way to find out the address in your setup could be to search the dump for the specific DWORD that is shown in !vad output a RWX page in winlogon memory a sample of which is also pasted below kd> kb … execution is happening try !vad on winlogon and confirm if it is RWX and search winlogon memory kd> dd 01072b04 l4 01072b04 968dab54 00000002 02f70000 00000000 kd> !process 0 0 winlogon.exe PROCESS …
answered Jan 28 '14 by blabb
0
votes
execute this bat file you will need windbg in path it attaches to a running process (hard coded as calc.exe you can script it with %1) dumps the memory map filtered by page_readonly and mapped …
answered Mar 11 '15 by blabb
0
votes
windows > greater than vista implement a security feature called ASLR (Address Space Layout Randomisation ) this feature randomly changes the Base Address of the binary each time it is restarted th …
answered Mar 27 '18 by blabb
1
vote
well if you can use a debugger then you can employ a variety of monitoring techniques. The example below is for a windows app being debugged by windbg. but gdb is equally versatile and you should …
answered Aug 10 '17 by blabb
4
votes
1 ) your std::string is not a plain ascii string it is a structure (actually a class) so you cannot take the address and find the string in your specific case since your string test 's length is le …
answered Feb 19 by blabb
2
votes
this is from win7 but that shouldn't matter much ProcessHeap From Peb of current Process 0:000> dt ntdll!_PEB ProcessHeap @$proc +0x018 ProcessHeap : 0x00430000 Void heap Stat For the same …
answered Oct 16 '16 by blabb
0
votes
There Are Many Apis that can help you locate the pertinent windows the simplest being FindWindow And GetWindowText you can run a complete enumeration with EnumWindows using A user provided callback fu …
answered Oct 8 by blabb