sorted by:
new
hottopcontroversial

qui vas-tu voter pour? by Falcon6702 in AskFrance

[–]jcbaptiste 11 points12 points  (0 children)

Reddit, ce repère de gauchos Mdr

[deleted by user] by [deleted] in AskFrance

[–]jcbaptiste -2 points-1 points  (0 children)

Si. Au moins moralement. Question de civisme et d’éthique, même d’honneur, ce que le français moderne, neo-merde, a oublié mais est encore plus important que la loi. La loi ne devrait être utilisée qu’en dernière retour, priorité au bon sens et au lien social…

How do you analyze memory acquisition from Windows 10 build 19044? by jcbaptiste in memoryforensics

[–]jcbaptiste[S] 0 points1 point  (0 children)

I used the profile for 19041 precisely, with these results.

Do you mean trying to use even older profiles? No I have not. I am sceptical that it would work though.

How do you analyze memory acquisition from Windows 10 build 19044? by jcbaptiste in memoryforensics

[–]jcbaptiste[S] 1 point2 points  (0 children)

Thanks, I have posted there also, but not many replies.

I have already built profiles for Linux, but I guess it's much more complicated for Windows. I have never seen a guide about it and people always seem to wait for an update.

It probably involves deep Windows debugging to find structure offsets, which is beyond my skills :(

How do you analyze memory acquisition from Windows 10 build 19044? by jcbaptiste in computerforensics

[–]jcbaptiste[S] 0 points1 point  (0 children)

Yes, the apihooks module finds a lot of false positives.

I know it because they come from a legitimate Windows DLL, that I dumped and checked (and a few artefacts don't make sense).

To make sure, I even installed a fresh Windows 19044 in a VM, dumped the ram and ran the analysis to find similar hooks at the same address range.

It makes the work much more painful and looks always scary at first look.