memory_dump_vad
Inspect a specific VAD memory region in a memory dump to identify injected code by providing image path, PID, and VAD start address.
Instructions
Examine a specific VAD (memory region). Useful for injected code regions.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| pid | Yes | Process ID | |
| image_path | Yes | Path to memory dump file | |
| vad_address | Yes | VAD start address (hex) |