PDA

View Full Version : dumping the memory of ntoskrnl.exe


Romanov
March 6th, 2010, 09:40 AM
Hello how do i dump the process memory of ntoskrnl.exe I see it running under the system process. Is there any program that can do this? ::)

GlobalForce
March 6th, 2010, 10:07 AM
That's a common one these days. Mr. Castner's been kind enough to round up a few pages (http://forum.aumha.org/viewtopic.php?f=62&t=26706). Need further help, ask here (http://www.windowsbbs.com/general-discussions/33471-dump-data-collection-tool-instructions.html).

Meriadoc
March 6th, 2010, 02:47 PM
WinDbg, WinHex