Re: Flushing DLLs from memory
From: Robert Collins (robert.collins@itdomain.com.au)Date: 10/23/01
- Previous message: Free, Bob: "RE: Flushing DLLs from memory"
- In reply to: H C: "Flushing DLLs from memory"
- Next in thread: Kinsey, Robert: "RE: Flushing DLLs from memory"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Message-ID: <023c01c15b57$fea1e630$0200a8c0@lifelesswks> From: "Robert Collins" <robert.collins@itdomain.com.au> To: "H C" <keydet89@yahoo.com>, <forensics@securityfocus.com>, <focus-ms@securityfocus.com> Subject: Re: Flushing DLLs from memory Date: Tue, 23 Oct 2001 10:16:41 +1000
----- Original Message -----
From: "H C" <keydet89@yahoo.com>
To: <forensics@securityfocus.com>; <focus-ms@securityfocus.com>
Sent: Saturday, October 20, 2001 10:31 AM
Subject: Flushing DLLs from memory
> I've been looking into 'live' forensics issues on
> NT/2K, and one thing I'm not having any luck with is
> how to flush DLLs from memory.
>
> Looking at Rob Lee's page, he's working on
> statically-linked binaries for the *nix platforms.
> This is an interesting issue, but perhaps not as
> simple for NT/2K. I know how to check for which DLLs
> a particular program depends on, and I know that the
> program and it's DLLs can be loaded onto a CD...the
> program can be run from a command prompt after
> supplying 'PATH="."'. However, how does one flush the
> currently loaded DLLs from memory such that only the
> 'known good' DLLs from the CD are used?
In memory .dll's are not automatically reused. However, if any of the
.dll's your app is dependent on have shared memory areas, then you might
run into stability issues if you load up incompatible versions.
Rob
- Previous message: Free, Bob: "RE: Flushing DLLs from memory"
- In reply to: H C: "Flushing DLLs from memory"
- Next in thread: Kinsey, Robert: "RE: Flushing DLLs from memory"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
