Is it possible to inspect the kernel memory? How? #2591
-
|
I've run it as admin. Is there any more steps? |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
|
It's a minimal process without any user-mode address space, and can't be accessed like other user-mode processes: You can find more information in the Windows Internals book:
LiveKD: Live kernel dump: |
Beta Was this translation helpful? Give feedback.
-
|
@dmex Is it possible to inspect and alter it in real-time? |
Beta Was this translation helpful? Give feedback.
It's a minimal process without any user-mode address space, and can't be accessed like other user-mode processes:
https://github.com/user-attachments/assets/71281031-a895-420e-b951-b2d9550255b6
You can find more information in the Windows Internals book:
https://learn.microsoft.com/en-us/sysinternals/resources/windows-internals
LiveKD:
https://learn.microsoft.com/en-us/sysinternals/downloads/livekd
Live kernel dump:
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/task-manager-live-dump#create-a-live-kernel-memory-dump-of-the-system-using-task-manager