Post-Mortem RAM Forensics - CanSecWest
Post-Mortem RAM Forensics - CanSecWest
Post-Mortem RAM Forensics - CanSecWest
SHOW LESS
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>CanSecWest</strong>2007<br />
27<br />
PoC: Virtual Addressing<br />
• The Process Environment<br />
Block(PEB) is always in the same<br />
place!<br />
– Well, it’s a virtual address, so it’s<br />
‘real’ location needs to be decoded<br />
from virtual to physical using other<br />
values from the structure<br />
VIDAS
Change language