Volatility Framework - VTOP or *PTOV

General (Technical, Procedural, Software, Hardware etc.)

Last Post by citizen 9 years ago

2 Posts

1 Users

0 Reactions

1,038 Views

RSS

citizen

(@citizen)

Eminent Member

Joined: 10 years ago

Posts: 38

Topic starter 07/06/2016 8:08 pm

Curious if anyone has written, or found, a module for mass translations of virtual addresses to Physical for VADs?

A little bit of the opposite does anyone have a good solution for verifying if physical address space is associated with allocated space (or a virtual address translation)?

(https://github.com/volatilityfoundation/volatility/wiki/Command-Reference See VTOP for manual steps)

Thanks as always for any feedback provided.

Quote

citizen

(@citizen)

Eminent Member

Joined: 10 years ago

Posts: 38

Topic starter 17/06/2016 8:47 pm

I was able to use the "strings' module for my needs. The link in the original post has information on that module as well.

Thanks to anyone who read the post hoping to offer recommendation.

ReplyQuote

8 Forums
15.7 K Topics
92.3 K Posts
232 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed