« Crash Dumps and Password Exposure
Structural Memory Patterns (Part 3) »

Structural Memory Patterns (Part 2)

The next pattern is called Aggregate Snapshot. It is any memory dump or software trace file that is combined from Memory Snapshots. Typical examples include:

  • A minidump file where only specific memory ranges are included
  • A software trace file combined from structured memory snapshots

Note. I’ve also created a dedicated page to list all structural patterns: 

Structural Memory Analysis Patterns

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

This entry was posted on Sunday, September 26th, 2010 at 9:27 pm and is filed under Crash Dump Analysis, Debugging, Memoretics, Memory Analysis Forensics and Intelligence, Structural Memory Patterns. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

One Response to “Structural Memory Patterns (Part 2)”

  1. Crash Dump Analysis » Blog Archive » Structural Memory Patterns (Part 7) Says:
    October 18th, 2010 at 3:48 pm

    […] For certain types of memory snapshots (like software traces) an anchor region coinsides with its structure description (message trace format for structured snapshots) and a trace file header (if any) for aggregate snapshots. […]

Leave a Reply

You must be logged in to post a comment.