[Vol-users] 64bit memory images

Jesse Kornblum jessek at speakeasy.net
Fri Jan 2 08:49:06 CST 2009

Hi Brian,

There is no such thing as a stupid question; don't worry. To my knowledge nobody
has published much information about doing memory analysis on 64-bit systems, so
the following is mostly conjecture. 

When working in 64-bit mode Intel processors use a different method of
translating the virtual addresses used by programs and the operating system into
the physical addresses in RAM where data really lives. As such there are going to
be several differences in the operating system for a) keeping track of where data
lives and b) virtual to physical address translation. You can read much more
about these difference in the Intel Architecture Software Developer's Manuals,
http://www.intel.com/products/processor/manuals/. BTW, Intel will mail you hard
copies of those books for free. Really! As many as you'd like of whichever ones
you'd like. Enjoy!

As for the differences in anything else, like I said, I don't think anybody has
published on those yet. You could be the first! 


jessek at speakeasy.net

More information about the Vol-users mailing list