[Vol-dev] What is _ADDRESS_OBJECT?

Jun Koi junkoi2004 at gmail.com
Sun Apr 5 22:19:05 CDT 2009


Hi,

I am working to make Volatility work for Vista. In file vtypes.py,
there is something named "_ADDRESS_OBJECT". I cannot find it structure
using Windbg, like I can do with other data structs (such as
_EPROCESS).

So where can I find information about _ADDRESS_OBJECT, with Windbg, or
any other tool?

Thanks a lot,
Jun


More information about the Vol-dev mailing list