Stack Exchange network consists of 178 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Q&A for work
Connect and share knowledge within a single location that is structured and easy to search.
View all activity pages
I was able to find the correct address in winlogon.exe process for Windows XP SP2. It is 0x71ac4.
I dumped the winlogon.exe process from memory using volatility. Then with a hex-editor I was able to ...