Detecting Malware and Threats in Windows, Linux, and Mac Memory Michael Hale Ligh, Andrew Case, Jamie Levy, ... OCF_THREADOWNED The TYPE_WINDOW objects are thread-owned; they are allocated from the desktop heap (or ... in turn identifies the location of the sessiona#39;s USER handle tableaa map to all USER objects in use on the system. ... On a Windows 7 x64 system, the tagSHAREDINFO looks like this: _gSharedInfo global variable is in the .data section of win32k.sys.
Title | : | The Art of Memory Forensics |
Author | : | Michael Hale Ligh, Andrew Case, Jamie Levy, AAron Walters |
Publisher | : | John Wiley & Sons - 2014-07-22 |
You must register with us as either a Registered User before you can Download this Book. You'll be greeted by a simple sign-up page.
Once you have finished the sign-up process, you will be redirected to your download Book page.
How it works: