carlpulley/volatility — Issue #10: Stack unwinding doesn't generate expected output
Author: carlpulley
Created: 2011-10-21 08:07:24+00:00
State: open
Labels: Bug

Using the community edition of Moonsols [Windows Memory Toolkit](http://www.moonsols.com/windows-memory-toolkit/), we can convert the Honeynet banking challenge memory sample (i.e. Bob.vmem) into a Windows crash dump.

Loading this crash dump into WinDbg and switching context to (say thread ID 1600 of PID 888) allows the threads stack to be dumped.

The WinDbg stack dump is very different to that returned by exportstack.py!