https://blog.kalrong.net/en/2016/12/14/seccon-2016-memory-analysis-forensic-100/