Systems, Methods, and Computer Readable Medium for Analyzing Memory

A computer system for analyzing memory types, comprising:

• a memory containing:
• a plurality of virtual registers for emulating real hardware registers in the computer system, a virtual register being initialized with a value stored in a corresponding real hardware register;
• an instruction emulator for emulating the execution of instructions by the computer system, the instruction emulator utilizing one or more of the plurality of virtual registers when executing instructions requiring real hardware registers;
• a plurality of real memory accessors, each real memory accessor finding a memory location in a corresponding memory type, one real memory accessor of the plurality of real memory accessors being an active real memory accessor;
• and
• a processor for running the instruction emulator and the active real memory accessor.

A computer readable medium whose contents cause a computer system to analyze a memory dump utilizing a modified live memory command, by performing the steps of:

• retrieving a memory command which, when executed, performs analysis on live memory, the command having first and second portions, the first portion, when executed, locates a first control block in live memory;
• modifying the first portion to invoke a virtual machine for locating a second control block in a memory dump;
• and
• executing the modified portion in the virtual machine to access the second control block.