« November 2005 | Main | February 2006 »

Memory analysis

Timestamps in Thread and Process Objects

(Dieser Artikel ist auch auf Deutsch verfügbar.)

The Windows kernel creates a distinct object for every process and every thread in its memory. It is possible to extract these blocks of data from memory images. At this even the remnants of terminated processes and threads can be found. Among their status information there are several timestamps.

(more...)

By Andreas Schuster at 12/13/2005, 02:50 PM |

Memory analysis

_ETHREAD version 5.0.2195.7045

This article provides a listing of the _ETHREAD structure of Microsoft Windows 2000. All data has been produced with the help of the free Microsoft kernel debugger and ntoskrnl.exe version 5.0.2195.7045. Knowledge about this structure could be helpful when analysing a memory dump.

(more...)

By Andreas Schuster at 12/12/2005, 03:36 PM |