Let's say you are analyzing a crashdump or a memory image after a compromise or developing malware or exploit primitives. Api functions are one thing but making

Let's say you are analyzing a crashdump or a memory image after a compromise or developing malware or exploit primitives. Api functions are one thing but making sense if the data in memory or abusing api (and non-api) functions is easier when you see all the hidden structures available.