Re: [Vol-users] Windows kernel memory.

Thank you for your answers. What I meant to say was that moddump plugin uses find_space function to find a process whose address space maps the searched driver.    def find_space(self, addr_space, procs, mod_base):        """Search for an address space (usually looking for a GUI process)"""        if addr_space.is_valid_address(mod_base):            return addr_space        for proc in procs:            ps_ad = proc.get_process_address_space()            if ps_ad != None:                if ps_ad.is_valid_address(mod_base):                    return ps_ad        return None