user3365
  • Member for 8 years, 1 month
  • Last seen more than a month ago
VADs with RWX permission in winlogon.exe process
1 votes

I was able to find the correct address in winlogon.exe process for Windows XP SP2. It is 0x71ac4. I dumped the winlogon.exe process from memory using volatility. Then with a hex-editor I was able to ...

View answer