The Art of Memory Forensics

$ python vol.py pslist > pslist.txt
$ python vol.py pslist --output-file=pslist.txt

For example, if various plugins create _EPROCESS objects and they all commonly need to determine whether the process is suspicious, based on several factors, you can use an object class to add such logic. A simple example is shown in the following code:

third-party modules that Volatility can leverage and the specific plugins that utilize them

knowledge of an operating system’s specific implementation of an abstract data structure is paramount to learning why certain attacks (that manipulate the structure(s)) are successful and how memory analysis tools can help you detect such attacks

Hash table with chained-overflow example

Structure Type Definition _LIST_ENTRY64 on 64-Bit Versions of Windows

An example linked-list implementation used frequently in the Linux kernel is the circular linked list

Singly-linked list example

Structure Type Definition for _UNICODE_STRING on 64-Bit Versions of Windows

when analyzing the physical address space of a system that leverages paged virtual memory, you could encounter a string that crosses a page boundary to a page that is no longer memory resident, which would require special processing or heuristics to determine the actual size of the string