Hi Brian,
There is no such thing as a stupid question; don't worry. To my knowledge nobody
has published much information about doing memory analysis on 64-bit systems, so
the following is mostly conjecture.
When working in 64-bit mode Intel processors use a different method of
translating the virtual addresses used by programs and the operating system into
the physical addresses in RAM where data really lives. As such there are going to
be several differences in the operating system for a) keeping track of where data
lives and b) virtual to physical address translation. You can read much more
about these difference in the Intel Architecture Software Developer's Manuals,
http://www.intel.com/products/processor/manuals/. BTW, Intel will mail you hard
copies of those books for free. Really! As many as you'd like of whichever ones
you'd like. Enjoy!
As for the differences in anything else, like I said, I don't think anybody has
published on those yet. You could be the first!
cheers,
--
Jesse
jessek(a)speakeasy.net
Hi all,
Forgive me if this is a stupid question, i'm a bit new to physical memory
analysis.
Is the structure of physical memory on a 64bit operating system different
than that of a 32bit operating system, and if so does volatility have the
capability to parse 64bit images?
v/r
--
-Brian
