cato447/ctf
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

huge commit

Browse Source
This commit is contained in:
cato447
2026-03-09 21:44:25 +01:00
parent ab2e537520
commit d1017bae51
441 changed files with 3438154 additions and 1363 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
2026/srdnlen_quals/forensic/chapter2/gemini_ideas/extract_files.py Normal file
View File

@@ -0,0 +1,54 @@
# The target magic bytes we want to find (OLE Compound Document)
TARGET_MAGIC = bytes([0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1])
def find_xored_works_doc(filename):
print(f"Reading {filename}...")
with open(filename, 'rb') as f:
data = f.read()
print("Scanning for 2-byte XOR encrypted OLE headers...")
matches_found = 0
for i in range(len(data) - 8):
window = data[i:i+8]
# Derive the potential 2-byte key
k1 = window[0] ^ TARGET_MAGIC[0]
k2 = window[1] ^ TARGET_MAGIC[1]
# Check if the rest of the window matches this 2-byte key
match = True
for j in range(2, 8):
expected_key = k1 if j % 2 == 0 else k2
if window[j] ^ TARGET_MAGIC[j] != expected_key:
match = False
break
if match:
matches_found += 1
print(f"\n[!] ENCRYPTED MATCH FOUND at offset: {hex(i)}")
print(f"[!] The 'Two Relics' (XOR Key) are: {hex(k1)} {hex(k2)}")
# Extract and decrypt a 2MB chunk
extract_size = 2 * 1024 * 1024
extracted_data = bytearray(data[i:i+extract_size])
# Decrypt the chunk
for idx in range(len(extracted_data)):
key = k1 if idx % 2 == 0 else k2
extracted_data[idx] ^= key
out_name = f"extracted_data/decrypted_works_doc_{hex(i)}.wps"
with open(out_name, 'wb') as out:
out.write(extracted_data)
print(f"[+] Decrypted chunk saved to {out_name}")
if matches_found == 0:
print("\nNo encrypted OLE headers found.")
else:
print(f"\nFinished scanning. Found {matches_found} encrypted fragments.")
# Run the script against your carved RAM file
find_xored_works_doc("./virtual_machine_ram.bin") # Replace with your actual filename

61
2026/srdnlen_quals/forensic/chapter2/gemini_ideas/find_headers.py Normal file
View File

@@ -0,0 +1,61 @@
import sys
# The known plaintexts we are looking for (The "Relics")
TARGETS = {
"ZIP_Archive": b"PK\x03\x04\x14\x00",
"DOS_Executable": b"MZ\x90\x00\x03\x00",
"Flag_String": b"srdnlen{",
"MS_Works": b"\xD0\xCF\x11\xE0\xA1\xB1"
}
def hunt_relics(filename):
print(f"[*] Loading {filename} into memory...")
with open(filename, 'rb') as f:
data = f.read()
for name, magic in TARGETS.items():
print(f"[*] Hunting for XOR-encrypted {name}...")
magic_len = len(magic)
# Slide a window across the entire file
for i in range(len(data) - magic_len):
window = data[i:i+magic_len]
# Derive the key by XORing the RAM data with the expected magic bytes
key = [window[j] ^ magic[j] for j in range(magic_len)]
# Skip if it's just unencrypted data (key is all 0x00)
if all(k == 0 for k in key):
continue
# Pattern 1: Is it a 1-byte repeating key? (e.g., K K K K K K)
if all(k == key[0] for k in key):
print(f"\n[!] BINGO! {name} found at offset {hex(i)}")
print(f"[!] Encrypted with 1-byte key: {hex(key[0])}")
dump_and_decrypt(data, i, [key[0]], name)
# Pattern 2: Is it a 2-byte repeating key? (e.g., K1 K2 K1 K2 K1 K2)
elif all(key[j] == key[j % 2] for j in range(magic_len)):
print(f"\n[!] BINGO! {name} found at offset {hex(i)}")
print(f"[!] Encrypted with 2-byte key: {hex(key[0])} {hex(key[1])}")
dump_and_decrypt(data, i, [key[0], key[1]], name)
def dump_and_decrypt(data, offset, key, name):
# Extract a chunk of memory (1 Megabyte should cover most CTF files)
chunk_size = 1024 * 1024
extracted = bytearray(data[offset:offset+chunk_size])
# Decrypt the extracted chunk using the discovered key
key_len = len(key)
for i in range(len(extracted)):
extracted[i] ^= key[i % key_len]
# Save the decrypted payload
out_name = f"recovered_{name}_{hex(offset)}.bin"
with open(out_name, 'wb') as f:
f.write(extracted)
print(f"[+] Decrypted file saved to -> {out_name}")
if __name__ == "__main__":
# Ensure this matches the name of your 128MB extraction
hunt_relics("../virtual_machine_ram.bin")

496
2026/srdnlen_quals/forensic/chapter2/gemini_ideas/find_virtual_ram.py Normal file
View File

@@ -0,0 +1,496 @@
import re
data = """
0x0 | 0x0 | 0 | 0x7ffe0000 | MEM_FREE | PAGE_NOACCESS | N/A
0x7ffe0000 | 0x7ffe0000 | 2 | 0x1000 | MEM_COMMIT | PAGE_READONLY | MEM_PRIVATE
0x7ffe1000 | 0x0 | 0 | 0xa000 | MEM_FREE | PAGE_NOACCESS | N/A
0x7ffeb000 | 0x7ffeb000 | 2 | 0x1000 | MEM_COMMIT | PAGE_READONLY | MEM_PRIVATE
0x7ffec000 | 0x0 | 0 | 0x1dec14000 | MEM_FREE | PAGE_NOACCESS | N/A
0x25ec00000 | 0x25ec00000 | 4 | 0x119000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x25ed19000 | 0x25ec00000 | 4 | 0x3000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x25ed1c000 | 0x25ec00000 | 4 | 0x12000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x25ed2e000 | 0x25ec00000 | 4 | 0x6000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x25ed34000 | 0x25ec00000 | 4 | 0x2000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x25ed36000 | 0x25ec00000 | 4 | 0x14000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x25ed4a000 | 0x25ec00000 | 4 | 0xb6000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x25ee00000 | 0x25ee00000 | 4 | 0x1e8000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x25efe8000 | 0x25ee00000 | 4 | 0x3000 | MEM_COMMIT | N/A | MEM_PRIVATE
0x25efeb000 | 0x25ee00000 | 4 | 0x15000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x25f000000 | 0x0 | 0 | 0x1200000 | MEM_FREE | PAGE_NOACCESS | N/A
0x260200000 | 0x260200000 | 4 | 0x1fb000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x2603fb000 | 0x260200000 | 4 | 0x3000 | MEM_COMMIT | N/A | MEM_PRIVATE
0x2603fe000 | 0x260200000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x260400000 | 0x260400000 | 4 | 0x1fb000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x2605fb000 | 0x260400000 | 4 | 0x3000 | MEM_COMMIT | N/A | MEM_PRIVATE
0x2605fe000 | 0x260400000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x260600000 | 0x260600000 | 4 | 0x1fb000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x2607fb000 | 0x260600000 | 4 | 0x3000 | MEM_COMMIT | N/A | MEM_PRIVATE
0x2607fe000 | 0x260600000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x260800000 | 0x0 | 0 | 0x200000 | MEM_FREE | PAGE_NOACCESS | N/A
0x260a00000 | 0x260a00000 | 4 | 0x1fb000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x260bfb000 | 0x260a00000 | 4 | 0x3000 | MEM_COMMIT | N/A | MEM_PRIVATE
0x260bfe000 | 0x260a00000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x260c00000 | 0x260c00000 | 4 | 0x1fb000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x260dfb000 | 0x260c00000 | 4 | 0x3000 | MEM_COMMIT | N/A | MEM_PRIVATE
0x260dfe000 | 0x260c00000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x260e00000 | 0x260e00000 | 4 | 0x1f9000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x260ff9000 | 0x260e00000 | 4 | 0x3000 | MEM_COMMIT | N/A | MEM_PRIVATE
0x260ffc000 | 0x260e00000 | 4 | 0x4000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x261000000 | 0x261000000 | 4 | 0x1f9000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x2611f9000 | 0x261000000 | 4 | 0x3000 | MEM_COMMIT | N/A | MEM_PRIVATE
0x2611fc000 | 0x261000000 | 4 | 0x4000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x261200000 | 0x261200000 | 4 | 0x1fb000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x2613fb000 | 0x261200000 | 4 | 0x3000 | MEM_COMMIT | N/A | MEM_PRIVATE
0x2613fe000 | 0x261200000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x261400000 | 0x261400000 | 4 | 0x1fb000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x2615fb000 | 0x261400000 | 4 | 0x3000 | MEM_COMMIT | N/A | MEM_PRIVATE
0x2615fe000 | 0x261400000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x261600000 | 0x261600000 | 4 | 0x1fb000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x2617fb000 | 0x261600000 | 4 | 0x3000 | MEM_COMMIT | N/A | MEM_PRIVATE
0x2617fe000 | 0x261600000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x261800000 | 0x261800000 | 4 | 0x1fb000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x2619fb000 | 0x261800000 | 4 | 0x3000 | MEM_COMMIT | N/A | MEM_PRIVATE
0x2619fe000 | 0x261800000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x261a00000 | 0x261a00000 | 4 | 0x1db000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x261bdb000 | 0x261a00000 | 4 | 0x3000 | MEM_COMMIT | N/A | MEM_PRIVATE
0x261bde000 | 0x261a00000 | 4 | 0x22000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x261c00000 | 0x261c00000 | 4 | 0x1fb000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x261dfb000 | 0x261c00000 | 4 | 0x3000 | MEM_COMMIT | N/A | MEM_PRIVATE
0x261dfe000 | 0x261c00000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x261e00000 | 0x0 | 0 | 0x1519e200000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400000000 | 0x15400000000 | 2 | 0x4000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15400004000 | 0x0 | 0 | 0xc000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400010000 | 0x15400010000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15400012000 | 0x0 | 0 | 0xe000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400020000 | 0x15400020000 | 4 | 0xa000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1540002a000 | 0x0 | 0 | 0x6000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400030000 | 0x15400030000 | 4 | 0x6000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x15400036000 | 0x0 | 0 | 0xa000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400040000 | 0x15400040000 | 4 | 0x6000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15400046000 | 0x0 | 0 | 0xa000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400050000 | 0x15400050000 | 4 | 0x51e000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1540056e000 | 0x0 | 0 | 0x2000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400570000 | 0x15400570000 | 64 | 0x10000 | MEM_COMMIT | PAGE_EXECUTE_READWRITE | MEM_PRIVATE
0x15400580000 | 0x15400580000 | 2 | 0x2000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15400582000 | 0x0 | 0 | 0xe000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400590000 | 0x15400590000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x15400591000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154005a0000 | 0x154005a0000 | 2 | 0x4000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154005a4000 | 0x0 | 0 | 0xc000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154005b0000 | 0x154005b0000 | 4 | 0xe000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154005be000 | 0x0 | 0 | 0x12000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154005d0000 | 0x154005d0000 | 4 | 0xd000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154005dd000 | 0x0 | 0 | 0x3000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154005e0000 | 0x154005e0000 | 2 | 0x34000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15400614000 | 0x0 | 0 | 0xc000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400620000 | 0x15400620000 | 2 | 0x3000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15400623000 | 0x0 | 0 | 0xd000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400630000 | 0x15400630000 | 2 | 0x12000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15400642000 | 0x0 | 0 | 0xe000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400650000 | 0x15400650000 | 2 | 0x2000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15400652000 | 0x0 | 0 | 0xe000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400660000 | 0x15400660000 | 2 | 0x3000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15400663000 | 0x0 | 0 | 0xd000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400670000 | 0x15400670000 | 2 | 0x1000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15400671000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400680000 | 0x15400680000 | 2 | 0x3000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15400683000 | 0x0 | 0 | 0xd000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400690000 | 0x15400690000 | 4 | 0x11000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x154006a1000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154006b0000 | 0x154006b0000 | 2 | 0x1000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154006b1000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154006c0000 | 0x154006c0000 | 2 | 0x80000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15400740000 | 0x15400740000 | 2 | 0x3000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15400743000 | 0x0 | 0 | 0xd000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400750000 | 0x15400750000 | 2 | 0xa000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x1540075a000 | 0x0 | 0 | 0x6000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400760000 | 0x15400760000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15400761000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400770000 | 0x15400770000 | 2 | 0x8000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15400778000 | 0x0 | 0 | 0x8000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400780000 | 0x15400780000 | 4 | 0x4b0000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15400c30000 | 0x15400c30000 | 4 | 0x12d000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15400d5d000 | 0x0 | 0 | 0x3000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15400d60000 | 0x15400d60000 | 2 | 0x1310000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15402070000 | 0x0 | 0 | 0x30000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154020a0000 | 0x154020a0000 | 2 | 0x3000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154020a3000 | 0x0 | 0 | 0x1d000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154020c0000 | 0x154020c0000 | 2 | 0x1153000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15403213000 | 0x0 | 0 | 0x1d000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403230000 | 0x15403230000 | 2 | 0x191000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154033c1000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154033d0000 | 0x154033d0000 | 2 | 0x3000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154033d3000 | 0x0 | 0 | 0x1d000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154033f0000 | 0x154033f0000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154033f1000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403400000 | 0x15403400000 | 4 | 0x26000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15403426000 | 0x0 | 0 | 0xa000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403430000 | 0x15403430000 | 2 | 0x4000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15403434000 | 0x0 | 0 | 0xc000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403440000 | 0x15403440000 | 4 | 0x2b000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1540346b000 | 0x0 | 0 | 0x5000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403470000 | 0x15403470000 | 4 | 0xf000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1540347f000 | 0x0 | 0 | 0x1000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403480000 | 0x15403480000 | 4 | 0x100000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15403580000 | 0x15403580000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15403581000 | 0x0 | 0 | 0x1f000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154035a0000 | 0x154035a0000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x154035a2000 | 0x0 | 0 | 0xe000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154035b0000 | 0x154035b0000 | 2 | 0x4000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154035b4000 | 0x0 | 0 | 0xc000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154035c0000 | 0x154035c0000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x154035c1000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154035d0000 | 0x154035d0000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x154035d1000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154035e0000 | 0x154035e0000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x154035e1000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154035f0000 | 0x154035f0000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x154035f1000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403600000 | 0x15403600000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x15403601000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403610000 | 0x15403610000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x15403611000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403620000 | 0x15403620000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x15403621000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403630000 | 0x15403630000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x15403631000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403640000 | 0x15403640000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x15403641000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403650000 | 0x15403650000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x15403651000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403660000 | 0x15403660000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x15403661000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403670000 | 0x15403670000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x15403671000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403680000 | 0x15403680000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x15403681000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403690000 | 0x15403690000 | 2 | 0x3000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15403693000 | 0x0 | 0 | 0xd000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154036a0000 | 0x154036a0000 | 4 | 0x100000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x154037a0000 | 0x154037a0000 | 4 | 0x1d000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154037bd000 | 0x0 | 0 | 0x3000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154037c0000 | 0x154037c0000 | 2 | 0x11000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154037d1000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154037e0000 | 0x154037e0000 | 4 | 0x7000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154037e7000 | 0x154037e0000 | 4 | 0xf9000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x154038e0000 | 0x154038e0000 | 2 | 0x4c000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x1540392c000 | 0x0 | 0 | 0x4000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403930000 | 0x15403930000 | 2 | 0xa2000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154039d2000 | 0x0 | 0 | 0x1e000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154039f0000 | 0x154039f0000 | 2 | 0x17000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15403a07000 | 0x0 | 0 | 0x9000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403a10000 | 0x15403a10000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x15403a11000 | 0x0 | 0 | 0x2f000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403a40000 | 0x15403a40000 | 2 | 0xb000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15403a4b000 | 0x0 | 0 | 0x25000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403a70000 | 0x15403a70000 | 2 | 0x11000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15403a81000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403a90000 | 0x15403a90000 | 2 | 0x4000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15403a94000 | 0x0 | 0 | 0xc000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403aa0000 | 0x15403aa0000 | 2 | 0x4000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15403aa4000 | 0x0 | 0 | 0xc000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403ab0000 | 0x15403ab0000 | 2 | 0x1000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15403ab1000 | 0x0 | 0 | 0x6f000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403b20000 | 0x15403b20000 | 4 | 0x5c000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15403b7c000 | 0x0 | 0 | 0x54000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403bd0000 | 0x15403bd0000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15403bd1000 | 0x0 | 0 | 0x25f000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403e30000 | 0x15403e30000 | 2 | 0x4000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15403e34000 | 0x0 | 0 | 0x10c000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403f40000 | 0x15403f40000 | 2 | 0x1000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15403f41000 | 0x0 | 0 | 0x4f000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15403f90000 | 0x15403f90000 | 4 | 0x33000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15403fc3000 | 0x0 | 0 | 0x5d000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15404020000 | 0x15404020000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x15404021000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15404030000 | 0x15404030000 | 2 | 0x2000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15404032000 | 0x0 | 0 | 0xe000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15404040000 | 0x15404040000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15404041000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15404050000 | 0x15404050000 | 4 | 0xf000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1540405f000 | 0x15404050000 | 4 | 0xf1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15404150000 | 0x15404150000 | 4 | 0x5d000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154041ad000 | 0x15404150000 | 4 | 0x1000 | MEM_COMMIT | PAGE_NOACCESS | MEM_PRIVATE
0x154041ae000 | 0x15404150000 | 4 | 0x59000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15404207000 | 0x15404150000 | 4 | 0x41000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15404248000 | 0x15404150000 | 4 | 0x42000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1540428a000 | 0x15404150000 | 4 | 0x1000 | MEM_COMMIT | PAGE_NOACCESS | MEM_PRIVATE
0x1540428b000 | 0x15404150000 | 4 | 0x42000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154042cd000 | 0x15404150000 | 4 | 0x42000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1540430f000 | 0x15404150000 | 4 | 0x25a000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15404569000 | 0x15404150000 | 4 | 0x163000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x154046cc000 | 0x15404150000 | 4 | 0xa000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154046d6000 | 0x15404150000 | 4 | 0xf3000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x154047c9000 | 0x15404150000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154047ca000 | 0x15404150000 | 4 | 0x956000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15405120000 | 0x0 | 0 | 0x60000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15405180000 | 0x15405180000 | 4 | 0x1000000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x15406180000 | 0x15406180000 | 4 | 0x320000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154064a0000 | 0x15406180000 | 4 | 0x1000 | MEM_COMMIT | PAGE_NOACCESS | MEM_PRIVATE
0x154064a1000 | 0x15406180000 | 4 | 0x80000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15406521000 | 0x15406180000 | 4 | 0x1000 | MEM_COMMIT | PAGE_NOACCESS | MEM_PRIVATE
0x15406522000 | 0x15406180000 | 4 | 0x45d000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1540697f000 | 0x15406180000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15406980000 | 0x15406980000 | 4 | 0xd000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1540698d000 | 0x0 | 0 | 0x3000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15406990000 | 0x15406990000 | 4 | 0x10000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154069a0000 | 0x0 | 0 | 0x100000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15406aa0000 | 0x15406aa0000 | 2 | 0x3000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15406aa3000 | 0x0 | 0 | 0xd000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15406ab0000 | 0x15406ab0000 | 2 | 0x4000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15406ab4000 | 0x0 | 0 | 0xc000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15406ac0000 | 0x15406ac0000 | 2 | 0x8000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15406ac8000 | 0x0 | 0 | 0x8000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15406ad0000 | 0x15406ad0000 | 4 | 0xd000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15406add000 | 0x0 | 0 | 0x3000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15406ae0000 | 0x15406ae0000 | 4 | 0xd000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15406aed000 | 0x0 | 0 | 0x3000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15406af0000 | 0x15406af0000 | 4 | 0x14d000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15406c3d000 | 0x0 | 0 | 0x1d43000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15408980000 | 0x15408980000 | 4 | 0x3000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15408983000 | 0x15408980000 | 4 | 0x1001000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15409984000 | 0x15408980000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15409985000 | 0x0 | 0 | 0xb000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15409990000 | 0x15409990000 | 4 | 0xd000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1540999d000 | 0x15409990000 | 4 | 0x1001000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1540a99e000 | 0x15409990000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1540a99f000 | 0x0 | 0 | 0x1000 | MEM_FREE | PAGE_NOACCESS | N/A
0x1540a9a0000 | 0x1540a9a0000 | 1 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1540a9a2000 | 0x1540a9a0000 | 1 | 0x7fe000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1540b1a0000 | 0x1540b1a0000 | 4 | 0x8001000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154131a1000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154131b0000 | 0x154131b0000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x154131b1000 | 0x154131b0000 | 4 | 0xa801000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1541d9b2000 | 0x154131b0000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1541d9b3000 | 0x0 | 0 | 0xd000 | MEM_FREE | PAGE_NOACCESS | N/A
0x1541d9c0000 | 0x1541d9c0000 | 4 | 0x4000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1541d9c4000 | 0x1541d9c0000 | 4 | 0x1002000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1541e9c6000 | 0x1541d9c0000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1541e9c7000 | 0x0 | 0 | 0x9000 | MEM_FREE | PAGE_NOACCESS | N/A
0x1541e9d0000 | 0x1541e9d0000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1541e9d1000 | 0x1541e9d0000 | 4 | 0x231000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1541ec02000 | 0x1541e9d0000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1541ec03000 | 0x0 | 0 | 0xd000 | MEM_FREE | PAGE_NOACCESS | N/A
0x1541ec10000 | 0x1541ec10000 | 4 | 0xf59000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1541fb69000 | 0x1541ec10000 | 4 | 0xf000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1541fb78000 | 0x1541ec10000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1541fb79000 | 0x1541ec10000 | 4 | 0x7000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1541fb80000 | 0x1541ec10000 | 4 | 0x5f000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1541fbdf000 | 0x1541ec10000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1541fbe0000 | 0x1541fbe0000 | 4 | 0xfcf000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15420baf000 | 0x1541fbe0000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15420bb0000 | 0x15420bb0000 | 4 | 0xfcf000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15421b7f000 | 0x15420bb0000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15421b80000 | 0x15421b80000 | 4 | 0xf88000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15422b08000 | 0x15421b80000 | 4 | 0x1000 | MEM_COMMIT | PAGE_NOACCESS | MEM_PRIVATE
0x15422b09000 | 0x15421b80000 | 4 | 0x41000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15422b4a000 | 0x15421b80000 | 4 | 0x1000 | MEM_COMMIT | PAGE_NOACCESS | MEM_PRIVATE
0x15422b4b000 | 0x15421b80000 | 4 | 0x4000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15422b4f000 | 0x15421b80000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15422b50000 | 0x15422b50000 | 4 | 0xa90000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154235e0000 | 0x15422b50000 | 4 | 0x5000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x154235e5000 | 0x15422b50000 | 4 | 0x2a000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1542360f000 | 0x15422b50000 | 4 | 0x4000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15423613000 | 0x15422b50000 | 4 | 0xb000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1542361e000 | 0x15422b50000 | 4 | 0x8000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15423626000 | 0x15422b50000 | 4 | 0x14b000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15423771000 | 0x15422b50000 | 4 | 0x7000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15423778000 | 0x15422b50000 | 4 | 0x9000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15423781000 | 0x15422b50000 | 4 | 0xf000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15423790000 | 0x15422b50000 | 4 | 0x50000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154237e0000 | 0x15422b50000 | 4 | 0x7000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x154237e7000 | 0x15422b50000 | 4 | 0x17000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154237fe000 | 0x15422b50000 | 4 | 0xf000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1542380d000 | 0x15422b50000 | 4 | 0x19000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15423826000 | 0x15422b50000 | 4 | 0xf000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15423835000 | 0x15422b50000 | 4 | 0x78000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154238ad000 | 0x15422b50000 | 4 | 0xf000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x154238bc000 | 0x15422b50000 | 4 | 0x2c000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154238e8000 | 0x15422b50000 | 4 | 0xf000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x154238f7000 | 0x15422b50000 | 4 | 0xf000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15423906000 | 0x15422b50000 | 4 | 0xf000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15423915000 | 0x15422b50000 | 4 | 0x107000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15423a1c000 | 0x15422b50000 | 4 | 0x21000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15423a3d000 | 0x15422b50000 | 4 | 0x53000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15423a90000 | 0x15422b50000 | 4 | 0x1000 | MEM_COMMIT | PAGE_NOACCESS | MEM_PRIVATE
0x15423a91000 | 0x15422b50000 | 4 | 0x21000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15423ab2000 | 0x15422b50000 | 4 | 0x5000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15423ab7000 | 0x15422b50000 | 4 | 0x9000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15423ac0000 | 0x15422b50000 | 4 | 0x41000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15423b01000 | 0x15422b50000 | 4 | 0x17000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15423b18000 | 0x15422b50000 | 4 | 0x8000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15423b20000 | 0x15423b20000 | 64 | 0x41000 | MEM_COMMIT | PAGE_EXECUTE_READWRITE | MEM_PRIVATE
0x15423b61000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15423b70000 | 0x15423b70000 | 4 | 0x4000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15423b74000 | 0x15423b70000 | 4 | 0x504000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15424078000 | 0x15423b70000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15424079000 | 0x0 | 0 | 0x3527000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154275a0000 | 0x154275a0000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x154275a1000 | 0x154275a0000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_MAPPED
0x154275a2000 | 0x0 | 0 | 0xe000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154275b0000 | 0x154275b0000 | 4 | 0x10000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x154275c0000 | 0x154275c0000 | 2 | 0x2a000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154275ea000 | 0x0 | 0 | 0x6000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154275f0000 | 0x154275f0000 | 2 | 0x4000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154275f4000 | 0x0 | 0 | 0xc000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15427600000 | 0x15427600000 | 2 | 0x3000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15427603000 | 0x0 | 0 | 0xd000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15427610000 | 0x15427610000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15427612000 | 0x0 | 0 | 0xe000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15427620000 | 0x15427620000 | 2 | 0x3000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15427623000 | 0x0 | 0 | 0xd000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15427630000 | 0x15427630000 | 2 | 0x9000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15427639000 | 0x0 | 0 | 0x7000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15427640000 | 0x15427640000 | 2 | 0x9000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15427649000 | 0x0 | 0 | 0x7000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15427650000 | 0x15427650000 | 2 | 0x3000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15427653000 | 0x0 | 0 | 0xd000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15427660000 | 0x15427660000 | 2 | 0x3000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15427663000 | 0x0 | 0 | 0xd000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15427670000 | 0x15427670000 | 4 | 0x12000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15427682000 | 0x15427670000 | 4 | 0x50000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x154276d2000 | 0x0 | 0 | 0xe000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154276e0000 | 0x154276e0000 | 2 | 0x3000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154276e3000 | 0x0 | 0 | 0xd000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154276f0000 | 0x154276f0000 | 2 | 0xd3000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154277c3000 | 0x0 | 0 | 0xd000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154277d0000 | 0x154277d0000 | 2 | 0x4000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154277d4000 | 0x154277d0000 | 2 | 0x4000 | MEM_RESERVE | NONE | MEM_MAPPED
0x154277d8000 | 0x0 | 0 | 0x8000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154277e0000 | 0x154277e0000 | 4 | 0xff000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154278df000 | 0x154277e0000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x154278e0000 | 0x154278e0000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154278e1000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154278f0000 | 0x154278f0000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_MAPPED
0x154278f1000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15427900000 | 0x15427900000 | 4 | 0xf000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1542790f000 | 0x15427900000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15427910000 | 0x15427910000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15427912000 | 0x15427910000 | 4 | 0x60000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15427972000 | 0x0 | 0 | 0xe000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15427980000 | 0x15427980000 | 2 | 0x4e000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154279ce000 | 0x15427980000 | 2 | 0x1b2000 | MEM_RESERVE | NONE | MEM_MAPPED
0x15427b80000 | 0x15427b80000 | 2 | 0x181000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15427d01000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15427d10000 | 0x15427d10000 | 2 | 0x7000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15427d17000 | 0x0 | 0 | 0x9000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15427d20000 | 0x15427d20000 | 2 | 0x1000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15427d21000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15427d30000 | 0x15427d30000 | 2 | 0x1000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15427d31000 | 0x0 | 0 | 0x2f000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15427d60000 | 0x15427d60000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15427d62000 | 0x15427d60000 | 4 | 0xe000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15427d70000 | 0x15427d70000 | 2 | 0x2c1000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15428031000 | 0x15427d70000 | 2 | 0x1140000 | MEM_RESERVE | NONE | MEM_MAPPED
0x15429171000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15429180000 | 0x15429180000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15429182000 | 0x15429180000 | 4 | 0x60000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x154291e2000 | 0x0 | 0 | 0xe000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154291f0000 | 0x154291f0000 | 2 | 0x3000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154291f3000 | 0x0 | 0 | 0xd000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15429200000 | 0x15429200000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15429201000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15429210000 | 0x15429210000 | 2 | 0x1000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15429211000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15429220000 | 0x15429220000 | 4 | 0x2000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15429222000 | 0x15429220000 | 4 | 0xe000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15429230000 | 0x15429230000 | 2 | 0x3d000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x1542926d000 | 0x0 | 0 | 0x3000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15429270000 | 0x15429270000 | 2 | 0x1000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15429271000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15429280000 | 0x15429280000 | 2 | 0x8000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15429288000 | 0x0 | 0 | 0x8000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15429290000 | 0x15429290000 | 2 | 0x1000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15429291000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154292a0000 | 0x154292a0000 | 2 | 0x1000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154292a1000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154292b0000 | 0x154292b0000 | 2 | 0x20000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x154292d0000 | 0x154292d0000 | 4 | 0xf000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x154292df000 | 0x154292d0000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x154292e0000 | 0x154292e0000 | 2 | 0x178000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15429458000 | 0x0 | 0 | 0x8000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15429460000 | 0x15429460000 | 2 | 0x33b000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x1542979b000 | 0x0 | 0 | 0x5000 | MEM_FREE | PAGE_NOACCESS | N/A
0x154297a0000 | 0x154297a0000 | 2 | 0x1a2000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15429942000 | 0x0 | 0 | 0xe000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15429950000 | 0x15429950000 | 4 | 0xff000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15429a4f000 | 0x15429950000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15429a50000 | 0x15429a50000 | 4 | 0x1ff000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15429c4f000 | 0x15429a50000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15429c50000 | 0x15429c50000 | 4 | 0x84000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15429cd4000 | 0x15429c50000 | 4 | 0x1000 | MEM_COMMIT | PAGE_NOACCESS | MEM_PRIVATE
0x15429cd5000 | 0x15429c50000 | 4 | 0xad000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15429d82000 | 0x15429c50000 | 4 | 0x1000 | MEM_COMMIT | PAGE_NOACCESS | MEM_PRIVATE
0x15429d83000 | 0x15429c50000 | 4 | 0x133000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15429eb6000 | 0x15429c50000 | 4 | 0x1000 | MEM_COMMIT | PAGE_NOACCESS | MEM_PRIVATE
0x15429eb7000 | 0x15429c50000 | 4 | 0x75000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15429f2c000 | 0x15429c50000 | 4 | 0x1000 | MEM_COMMIT | PAGE_NOACCESS | MEM_PRIVATE
0x15429f2d000 | 0x15429c50000 | 4 | 0x13000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15429f40000 | 0x15429c50000 | 4 | 0xf000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x15429f4f000 | 0x15429c50000 | 4 | 0x93000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15429fe2000 | 0x15429c50000 | 4 | 0x1000 | MEM_COMMIT | PAGE_NOACCESS | MEM_PRIVATE
0x15429fe3000 | 0x15429c50000 | 4 | 0x41000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1542a024000 | 0x15429c50000 | 4 | 0x1000 | MEM_COMMIT | PAGE_NOACCESS | MEM_PRIVATE
0x1542a025000 | 0x15429c50000 | 4 | 0x2a000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1542a04f000 | 0x15429c50000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1542a050000 | 0x1542a050000 | 64 | 0x2240000 | MEM_COMMIT | PAGE_EXECUTE_READWRITE | MEM_PRIVATE
0x1542c290000 | 0x1542c290000 | 4 | 0x2000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1542c292000 | 0x1542c290000 | 4 | 0x101000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1542c393000 | 0x1542c290000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1542c394000 | 0x0 | 0 | 0xc000 | MEM_FREE | PAGE_NOACCESS | N/A
0x1542c3a0000 | 0x1542c3a0000 | 4 | 0x10841000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1543cbe1000 | 0x1542c3a0000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1543cbe2000 | 0x0 | 0 | 0xe000 | MEM_FREE | PAGE_NOACCESS | N/A
0x1543cbf0000 | 0x1543cbf0000 | 4 | 0x9000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1543cbf9000 | 0x1543cbf0000 | 4 | 0x1001000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1543dbfa000 | 0x1543cbf0000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1543dbfb000 | 0x0 | 0 | 0x5000 | MEM_FREE | PAGE_NOACCESS | N/A
0x1543dc00000 | 0x1543dc00000 | 4 | 0x2000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1543dc02000 | 0x1543dc00000 | 4 | 0x181000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1543dd83000 | 0x1543dc00000 | 4 | 0x1000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1543dd84000 | 0x0 | 0 | 0xc000 | MEM_FREE | PAGE_NOACCESS | N/A
0x1543dd90000 | 0x1543dd90000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x1543dd91000 | 0x1543dd90000 | 4 | 0xff000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x1543de90000 | 0x0 | 0 | 0x5470000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15443300000 | 0x15443300000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15443301000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15443310000 | 0x15443310000 | 4 | 0x1000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x15443311000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15443320000 | 0x15443320000 | 2 | 0x1000000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15444320000 | 0x15444320000 | 2 | 0xeb000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x1544440b000 | 0x0 | 0 | 0x5000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15444410000 | 0x15444410000 | 2 | 0x800000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15444c10000 | 0x15444c10000 | 2 | 0x1000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15444c11000 | 0x0 | 0 | 0xf000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15444c20000 | 0x15444c20000 | 8 | 0x48000 | MEM_COMMIT | PAGE_WRITECOPY | MEM_MAPPED
0x15444c68000 | 0x0 | 0 | 0x18000 | MEM_FREE | PAGE_NOACCESS | N/A
0x15444c80000 | 0x15444c80000 | 2 | 0x1000 | MEM_COMMIT | PAGE_READONLY | MEM_MAPPED
0x15444c81000 | 0x0 | 0 | 0x1719737f000 | MEM_FREE | PAGE_NOACCESS | N/A
0x2c5dc000000 | 0x2c5dc000000 | 4 | 0xa0000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x2c5dc0a0000 | 0x2c5dc000000 | 4 | 0x10000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x2c5dc0b0000 | 0x2c5dc000000 | 4 | 0x30000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x2c5dc0e0000 | 0x2c5dc000000 | 4 | 0x20000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x2c5dc100000 | 0x2c5dc000000 | 4 | 0x30000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x2c5dc130000 | 0x2c5dc000000 | 4 | 0x40000 | MEM_RESERVE | NONE | MEM_PRIVATE
0x2c5dc170000 | 0x2c5dc000000 | 4 | 0x1e90000 | MEM_COMMIT | PAGE_READWRITE | MEM_PRIVATE
0x2c5de000000 | 0x2c5dc000000 | 4 | 0x3e000000 | MEM_RESERVE | NONE | MEM_PRIVATE
"""
# Find all lines matching MEM_COMMIT, PAGE_READWRITE, MEM_PRIVATE
results = []
for line in data.strip().split('\n'):
parts = [p.strip() for p in line.split('|')]
if len(parts) >= 7:
if parts[4] == 'MEM_COMMIT' and parts[5] == 'PAGE_READWRITE' and parts[6] == 'MEM_PRIVATE':
size_hex = parts[3]
try:
size_int = int(size_hex, 16)
if size_int > 0x100000: # Filter for sizes greater than 1MB
results.append((parts[0], size_hex, size_int / (1024*1024)))
except:
pass
# Sort by size descending
results.sort(key=lambda x: x[2], reverse=True)
for r in results:
print(f"Base: {r[0]}, Size: {r[1]} ({r[2]:.2f} MB)")

22
2026/srdnlen_quals/forensic/chapter2/gemini_ideas/xor_files.py Normal file
View File

@@ -0,0 +1,22 @@
import sys
def xor_files(file1_path, file2_path, out_path):
with open(file1_path, 'rb') as f1, open(file2_path, 'rb') as f2:
data1 = f1.read()
data2 = f2.read()
if len(data1) != len(data2):
print("Warning: Files are not the exact same size!")
# XOR byte by byte
xored_data = bytearray(a ^ b for a, b in zip(data1, data2))
with open(out_path, 'wb') as out_file:
out_file.write(xored_data)
print(f"Success! XORed output saved to {out_path}")
if __name__ == "__main__":
if len(sys.argv) != 4:
print("Usage: python3 xor_relics.py <file1> <file2> <output>")
else:
xor_files(sys.argv[1], sys.argv[2], sys.argv[3])