Tuesday, August 6, 2013


This plugin renders VAD information in a format similar to that of immunity debuggers "Memory Map" display window.  VadIMM will attempt to display the processes ImageBase plus size and PE section information.  I got a lot of help and give credit to code already written by the vol developers, particularly for the Map Types section.



python vol.py vadimm -f be2.vmem  
Volatile Systems Volatility Framework 2.2

No comments:

Post a Comment