Flushing DLLs from memory

From: H C (keydet89@yahoo.com)
Date: 10/20/01 

Message-ID: <20011020003118.17824.qmail@web20510.mail.yahoo.com>
Date: Fri, 19 Oct 2001 17:31:18 -0700 (PDT)
From: H C <keydet89@yahoo.com>
Subject: Flushing DLLs from memory
To: forensics@securityfocus.com, focus-ms@securityfocus.com

I've been looking into 'live' forensics issues on
NT/2K, and one thing I'm not having any luck with is
how to flush DLLs from memory.

Looking at Rob Lee's page, he's working on
statically-linked binaries for the *nix platforms.
This is an interesting issue, but perhaps not as
simple for NT/2K. I know how to check for which DLLs
a particular program depends on, and I know that the
program and it's DLLs can be loaded onto a CD...the
program can be run from a command prompt after
supplying 'PATH="."'. However, how does one flush the
currently loaded DLLs from memory such that only the
'known good' DLLs from the CD are used?

Thanks,

Carv

__________________________________________________
Do You Yahoo!?
Make a great connection at Yahoo! Personals.
http://personals.yahoo.com

Relevant Pages

  • Re: Memory limit reached with Windows Mobile
    ... I do understand what a test is, and I do understand how memory management ... ctacke: re-read Patrick's questions, ... 1- Load the same DLL over and over. ... Loading native DLLs takes at least 64k each. ...
    (microsoft.public.pocketpc.developer)
  • Re: Explicit loading does not work
    ... This utility just prints virtual memory layout for the application with XIP attributes if any. ... Application DLLs can not be loaded at the address where XIP dlls reside. ... when this space is out, HeapAlloc begins allocating virtual memory from the XIP ...
    (microsoft.public.windowsce.embedded.vc)
  • Re: Memory limit reached with Windows Mobile
    ... ctacke: re-read Patrick's questions, ... 1- Load the same DLL over and over. ... Loading native DLLs takes at least 64k each. ... good thing due to the 64k minimum virtual memory size each will take. ...
    (microsoft.public.pocketpc.developer)
  • Re: Memory limit reached with Windows Mobile
    ... That would explain the memory problem - you just can't do that. ... You have to load stuff when it's ... All native DLLs get loaded ...
    (microsoft.public.pocketpc.developer)
  • Memory limit reached with Windows Mobile
    ... We are currently having memory issues with our Pocket PC application. ... 2003 and the Compact Framework 1.0 SP3. ... If a process loads 4 Mb of DLLs, then 8 Mb of data, he can no ... longer load DLLs, ...
    (microsoft.public.pocketpc.developer)