As we’re closing in on the release date of version 3.0, it’s time to announce some more new features: the advanced edition will come with support for Windows DMP and Windows Hibernation files.
There are many internal formats of Windows DMP files and Cerbero now supports all of the most common ones. Here are for instance some screen-shots showing information contained in minidumps.
Of course, when the full memory snapshot is available, it is possible to explore it as if it was a raw memory image. Here we can see address space inspection performed on a DMP file.
Hibernation files are also supported for all Windows version from XP to Win10. Here we can see memory analysis performed on Hibernation files.
Stay tuned as there’s more to come also regarding memory analysis.