So what I am doing is, I am reading data from //./Device/PhysicalMemory and I am dumping it to disk. I want to find and read data from the EPROCESS, PEB, TEB etc.. struct from the data. So my question, is Would I have to find this by pattern or does Windows delegate certain pages to these structures? I am really confused on this. If it does delegate certain pages to these structures does the format change? If it does by how much?