[Vol-users] Lookup Process Name by Memory Address on Windows XP

Matthew Wong matthew at coredumps.net
Wed Nov 13 07:22:32 CST 2013

Hello All,

I'm new to Volatility.

Say I found the string "password=hello world" somewhere in the memory, is
there anyway for me to know which process that memory block is currently
allocated to?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.volatilityfoundation.org/pipermail/vol-users/attachments/20131113/db429366/attachment.html

More information about the Vol-users mailing list