Re: [Vol-users] DPC procedure localization

Jaroslav, Kernel timers come and go at a very high rate which leads to a significant number of invalid or spurious timer artifacts which result from the fact that the memory dump was acquired from the system while it was running. Not that the last two timers are signaled and the periods are not coherent. It is possible that the last two "timer" objects reside in memory that once was a kernel timer object and has since been freed and that some of the timer fields (e.g. the routine address) have been overwritten with incoherent data. Try running the !pool command on the last two timer addresses (0x863ead10 and 0x85e451e8) and see if that memory is currently allocated. (I am assuming that you either have or can convert your memory dump to MS crashdump format.) Regards, George. On 6/3/2013 9:15 AM, BRTAN Jaroslav wrote: ______________________________**_________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilesystems.**com/mailman/listinfo/vol-users<http://lis…