Hot answers tagged

2

Simple, it's a section that will supposedly be mapped as paged memory. This can contain code or data and is governed by the PAGED_CODE macro, among others, at source code level. That is, whatever gets stored in that section cannot be accessed at arbitrary IRQLs. Quote: If the IRQL > APC_LEVEL, the PAGED_CODE macro causes the system to ASSERT. Also see ...


2

Yes, Windows 10 can be used for malware analysis. All the modern RE tools, such as IDA Pro, Ghidra, Binary Ninja, etc. run on it.


1

official way is as pointed out by other answers use symchk.exe from windbg installation but you can also fetch it by putting together few dbghelp and winsock functions find below a poc that uses wget.exe #include <stdio.h> #include <windows.h> #include <dbghelp.h> #pragma comment(lib,"dbghelp.lib") #pragma comment(lib,"user32....


Only top voted, non community-wiki answers of a minimum length are eligible