Windows IR/CF Tools

File Release Notes and Changelog

Release Name: lspi

Notes: LiSt Process Image This script/exe can be used to extract the process image from a memory (RAM) dump. This script/exe ONLY works on dumps from Windows 2000 systems. To use this script/exe, first run lsproc to get the offset to the process, then use the dump file and offset to the process in question as arguments to lspi.