Post-Mortem RAM Forensics - CanSecWest
Post-Mortem RAM Forensics - CanSecWest
Post-Mortem RAM Forensics - CanSecWest
SHOW LESS
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>CanSecWest</strong>2007<br />
23<br />
…and smells like an EProcess…<br />
• Use these offsets to perform<br />
various checks: (simplified for ppt)<br />
– Except for “IDLE” processes must<br />
have a priority > 0<br />
– Processes must have a page<br />
directory<br />
– All threads must be located in above<br />
the kernel memory bound<br />
– Quantum, workingset max, max #<br />
processes, sync events, etc<br />
VIDAS
Change language